Here’s the deal: there is no business too small to interest cyber thieves. Sadly, your business is at risk if you have even a single computer connected to the internet.
According to a recent SBA survey, 88% of small business owners suspect their business is vulnerable to a cyber threat (malware, viruses, ransomware, and phishing). And they’re right. Cybercriminals are increasingly targeting small businesses knowing they have fewer resources to invest in cyber security.
Small businesses also arguably have the most to lose from being hit with a damaging cyber-attack — downtime, out-of-pocket remediation costs, and damage to their reputation.
This is why GetCyber advocates the three-pronged approach of “Precaution, Protection, Remediation” for optimal efficiency and effectiveness against cyber threats.
Cyber Risks: Know your enemy and their motives
Three types of cyber threat actors target small businesses: cybercriminals are motivated by profit; hacktivists are motivated by ideology; insiders are motivated by discontent (legitimate or otherwise).
Their way into your network is equally varied: a past or current employee with access infects your system; a link in your supply chain that “talks to” your network and becomes the point of infiltration; the grubby hands of the dark web reach into your network to deposit some nefarious code that will wreak havoc on your business and your reputation. Cyber threat training and a focus on developing a strong security culture are critical ways to reduce risk.
Every email, every query, every ping is suspect until verified through double authentication or repulsed at the entry point.
Phishing attacks account for about 90% of all breaches that organizations face; they’ve grown 65% over the last year, account for over $12 billion in business losses, and grow more sophisticated by the day. They prey upon the human tendency to trust versus targeting a technological weakness. Security training is an essential tool for preventing successful phishing in your business’s network.
When cybercriminals drop malicious code onto a network, that’s called a malware attack, and it’s the second most common cyber threat against small businesses. Malware allows criminals to gain access to networks, steal proprietary information, or destroy data on computers. Whatever its form, malware can render devices useless and provide hackers entry to data through the back door. Endpoint Protection and Anti-Virus software are fairly reliable shields against the average malware attack on a small business.
Unfortunately, the pandemic-induced, hasty move to remote and hybrid work has presented an embarrassment of riches for cyber thieves because employees increasingly use their own devices to access work resources on the business network. This mixing of personal and work devices is a security nightmare because personal devices often lack the sophisticated end-point protection and antivirus software that many work-issued devices have as default. Any personal cell phone, tablet, or laptop used for work purposes is part of your network — whether you realize it or not — which means they can be compromised through a malware attack.
Ransomware affects thousands of businesses annually, and these breaches are exceedingly lucrative for cybercriminals. Ransomware infects company data and encrypts it — essentially shutting it down and hiding it from view. The criminals then contact the small business and ask to be paid to provide the digital key to unlock the data. As you can imagine, this is a supremely unpleasant situation for any small business owner — pay a ransom that could involve vast amounts of money or try to move forward with a compromised company devoid of essential business data and customer records.
While the news is full of ransomware attacks on hospitals, enterprises, and municipalities, the hard truth is that in 2021, 71% of ransomware attacks targeted small businesses with an average ransom demand of $116,000.
Still, feeling impervious? Consider this: Recently, cybercriminals and hacktivists have become adept at automating their attacks to target thousands of small businesses at once.
Once you know what you’re up against, you can develop a strategic plan to keep harm at bay.
Precaution: Take measures now to reduce future loss
Several practical steps can be taken to minimize exposure to cyber risk. A well-thought-out company policy is the first step in preventing possible loss. A critical element of this process is compiling quality cybersecurity policy documentation. The problem is that while small companies can often operate by word of mouth and intuition, cybersecurity is one area where you must document your protocols. The Small Business Administration’s Cybersecurity portal provides online training, checklists, and information specific to protect online businesses. Clear protocols around documentation provide the foundation for good cyber security practice.
Employee education is another area where small businesses can reduce their cybersecurity risk. It is also one of the most effective ways to minimize loss, given employees become accountable for their cybersecurity activity. Employee education takes many forms, such as security training, attack simulations, etc. Each employee should also sign a document stating that they have been informed of the policies and understand that actions may be taken if they do not follow security policies.
Protection: Never trust. Always verify. Have a realistic picture of your network.
As cyber-attack types increase, so do the digital tools designed to protect small businesses from cyber harm. From end-point protection to cloud backup solutions to password management and multi-factor authentication software, there are plenty of options to choose from when it comes to doing what you can to deter a cyber attack.
But, as the headlines and data make clear as successful attacks continue to occur and attackers grow more brazen, cyber insurance steps become increasingly important.
Remediation: Experts in your corner to repair the damage should the worst happen.
Cyber insurance helps companies mitigate the financial risks and liabilities of having a digital presence.
Regardless of what form an attack takes, it is highly likely to result in compromised data, IT downtime, and administrative headaches — at a minimum, with most malware and ransomware attacks damaging data and devices. If you add the balance sheet impact of six-figure payments to unlock data and how attacks damage reputations, the severe toll of cybercrime becomes crystal clear.
And this is why we recommend small businesses adopt a three-tiered approach to addressing cyber threats: Precaution, Protection, Remediation.
Beyond covering the costs of a wide range of cybercrimes, many cyber insurance policies include additional risk-preventing services such as cybersecurity scans, training sessions for employees, and access to expert security professionals to remedy cyber events.
Remember the 88% of small business owners who suspect their business is vulnerable to a cyber threat? Cyber Insurance was created for them. And for you, if you consider it in your best interest to mitigate your cyber risk.
Get a Cyber Insurance Quote In 60 Seconds - Instant Quotes from 6 Top Insurers