Why Cybersecurity is Important for Small Businesses

Massive cyberattacks crop up in the news almost every year. Large entities such as WhatsApp, U.S. Customs and Border Protection, and Microsoft’s Visual Studio tool were all affected by data breaches in 2019. Yet, the fact that small businesses face cyberattacks much more frequently tends to get overlooked. 

Verizon found that 43% of all cyberattacks targeted small businesses in 2019. Despite that statistic, many small organizations put cybersecurity precautions on the back burner. There are a number of reasons small organizations may not make cybersecurity a priority –– some within their control, and others not.

For example, robust security software can exceed a small business’s budget. Along that same vein, there may not be enough room for an experienced IT department. On the other hand, the small business’s underdog status in the industry may make them believe they’re less of a target. It’s easy to fall into this line of thinking, but that doesn’t make cybersecurity any less important for small businesses.

Weak Cybersecurity Cripples Small Businesses

Whether a limited budget or wishful thinking is behind weak cybersecurity, there’s no denying small businesses pay dearly when hit with a cyberattack.

In 2019, Hiscox reported that cyberattacks cost businesses of all sizes an average of $200,000. For a multimillion dollar company, that isn’t too much of a price to pay. However, $200,000 can be a hefty blow to small business owners/operators, especially if they don’t have an insurance plan or financial backing. What’s more, Inc reported that 60% of small businesses affected by a security breach fail within the following six months.

Not only do small business owners lose significant revenue to cyberattacks, but they also lose the trust of their customers. Businesses that manage to continue on after taking such a hit must restore their reputation while struggling to regain financial stability.

How Attacks Reach Small Businesses

Cyberattacks reach companies through a multitude of avenues. 69% of breaches are caused by outsiders, perpetuated both by individuals and organized criminal groups. Breaches from outsiders are most often accomplished through credential stuffing. Credential stuffing is a type of attack where a bad actor gains unauthorized access to a business’s network by testing out credentials from previous breaches. This method has been used in a number of high profile cases, including:

• Yahoo! in 2013-14
• Ebay in 2014
• JP Morgan Chase in 2014
• Uber in 2016

Meanwhile, in cases such as the Anthem data breach in 2015 and the RSA breach in 2011, bad actors catch victims in phishing or social engineering attempts.

Businesses of every size have potential to become victims of data breaches. Strong security software, a competent IT team, and regular team security training can go a long way in handling such attacks, but efforts should always be focused on prevention more than treatment. That’s why following cybersecurity best practices is key.

Cybersecurity Best Practices for Small Businesses

Identities can be secured by upholding cybersecurity best practices. Such practices include:

• Enforcing password policies: Long, complex passwords can thwart credential stuffing attempts. 
• Using SSH keys: SSH keys provide a secure way to access machines.
• Enforcing full disk encryption (FDE): When a machine is locked, FDE encrypts the harddrive until presented with credentials that are authorized to decrypt it. This protects data stored on the harddrive in the event the machine becomes compromised. 
• Requiring multi-factor authentication (MFA): Requiring MFA on as many resources as possible acts as another barrier to brute force attacks. 
• Requiring an anti-malware service on each system: This helps protect endpoints automatically, though the strength of the service will depend on your budget.
• Enforcing screensaver and/or USB lock: Screensaver lock prevents unauthorized interference with a machine. USB locks prevent an infected flash drive from compromising an unsuspecting user’s machine. 
• Disabling guest accounts: Guest accounts allow users to anonymously access local data and applications. To prevent internal attacks, it’s best to disable this feature.
• Segmenting the network: Not only does segmenting the network put less strain on bandwidth, but it also keeps attackers from obtaining full access to it. 
• Authenticating users via RADIUS: RADIUS authentication helps secure the WiFi network by requiring users to enter a unique set of credentials before they gain access. This helps make sure that only trusted users may access the network, though should be used in conjunction with a few of the practices mentioned above (i.e., MFA).
• Patching all machines: Machines should be kept up to date as often as possible. When a new patch is released, it’s important to make sure that it gets installed on all the machines in your organization. 

Users should also attend regular training on cybersecurity trends and best practices. Without knowing what they should look out for, users can easily become liabilities. They should also have a written reference of those practices and expectations. Such resources serve as handy references when a user is unsure of how to proceed with a suspicious email, or if they need to reset their password.

Learn More

Many components go into securing IT infrastructure. If you’d like to learn more about how you can protect your small business, check out some of our other resources on cybersecurity. Otherwise, if you have any questions, feel free to drop us a line.