Many small and medium-sized businesses think they are safe from cyber threats. Unfortunately, this has not been true for a while. 48% of all small businesses have experienced a cyberattack, but 43% still struggle with even understanding how to protect themselves.
Cyber criminals are going after smaller businesses more and more because they generally don’t have as high a standard of protection, while still (especially in healthcare) having valuable data to steal. This trend is only likely to increase, especially as things like ransomware-as-a-service make it even cheaper to launch an attack.
Why SMBs Are Becoming Prime Targets
So, why are cyber criminals attacking SMBs more? There are three main reasons why smaller businesses are obvious targets for criminals.
Lack of Resources
Many small businesses lack dedicated IT staff and most think they can handle their own security issues. This means they often don’t have the resources needed to fight off an attack. They may also lack the resources to provide training to employees on how to avoid breaches.
Assumption of Being “Too Small to Target”
Because they think their size means they won’t be targeted, many SMB owners don’t devote the resources they do have to cybersecurity. It’s not a priority for them, and they think they aren’t at risk.
Access to Enterprise Partners
Many small businesses partner with much larger enterprises in the supply chain. They might be vendors selling a specialized part, they might be outsourcing shipping to a larger company, etc. This makes them a weak leak in the chain; criminals who want to get to the larger company might try to use the SMB as a back door.
Top Cybersecurity Threats Facing SMBs Today
A key part of protecting your business is understanding the threat it faces. As common threats increase, identifying them becomes key to defending yourself., Here are some of the most important:
- Phishing and social engineering attacks. The weakest link in the cybersecurity chain is always human beings. Standard email phishing remains common, but social engineering attacks are happening more and more through other channels. Smishing (social media phishing) is becoming very common, with criminals cloning accounts and contacting their connections, impersonating businesses, or simply using social media messages to transmit malware.
- Ransomware and extortion tactics. Ransomware-as-a-service makes it easy for criminals to deploy ransomware onto your network. Smart buildings may become victim to siegeware, usually also connected to some form of extortion.
- Business Email Compromise (BEC). A BEC attack happens when the criminal impersonates somebody in the organization, engages in communication, and then asks you to send them information, or to send money to a “vendor.”
- Insider Threats. These might be accidental (an employee gets careless and hands over their password) or malicious (a disgruntled employee decides to do damage).
- Third-Party and Supply Chain Risks. Just as you might be attacked to get to somebody else, so a vendor or customer might be attacked to get to you.
- Cloud Misconfigurations and Shadow IT. Simple errors configuring cloud services can open them up to man-in-the-middle attacks where data is intercepted. Shadow IT is common in smaller companies; when the tools provided by IT don’t do the job, people turn to other applications.
How the Threat Landscape is Evolving
These threats have been around, in some shape or form, for years. However, as technology changes, the threat landscape continues to evolve.
AI and automation is a big thing right now. Phone phishing has come back in with AI deepfakes being used to duplicate somebody’s voice. Most of these attacks are being made against individuals rather than businesses. However, they may target your employees or, even more likely, their elderly relatives. ChatGPT is being used to make better phishing emails. One difference this has made is that phishing emails tend to now have perfect grammar and spelling. Errors used to be a good way to spot people. AI can also be used to make BEC more likely to work by combining deepfakes with email, to the point where companies may have to confirm certain transactions with face-to-face meetings.
AI can also be used to change malware code more rapidly and allow it to self-adapt to get past defenses leading to potential AI “wars” with both sides using AI.
This is part of what makes phishing campaigns more sophisticated. The increased use of social media allows criminals to have longer conversations before moving in “for the kill.”
Additionally, cyber criminals are focusing their effort on the most lucrative verticals. Healthcare, with its wealth of personal information, tops the list, but legal and financial firms are also being targeted.
Governments are responding by increasing regulatory pressure and setting higher standards that some companies must meet through HIPAA and other privacy laws.
The Cost of Inaction for SMBs
All of this says something simple: You can’t afford not to act. The cost of inaction includes:
- Risk of data breaches and associated financial losses. Mitigating a breach can also cost a lot of money.
- Reputation damage and loss of customer trust. Some companies may lose customers if they feel that they can’t look after their data.
- Regulatory fines and legal consequences. Class action lawsuits over breaches have become more common.
- Business interruption and operational downtime. Ransomware can lock out your entire system. Fixing a breach can take employees away from their regular jobs.
Practical Steps SMBs Can Take to Strengthen Cybersecurity
Fortunately, there are simple, practical things you can do to improve your cybersecurity posture. These include:
- Implement basic cybersecurity hygiene. Require strong passwords or, better yet, passphrases for all systems. Set up multi-factor authentication. Keep all software up-to-date and install security patches immediately.
- Invest in employee training. Most cyber breaches start when an employee messes up. Teaching employees how to recognize phishing attempts, etc, not only protects your company but protects them from scammers.
- Hire a security service provider. If you lack in-house expertise, use a managed security service provider like Yobihouse. We can provide a security assessment and help you stay up to date with your cybersecurity.
- Develop an incident response and recovery plan. Don’t assume it will never happen to you, because it probably will.
Looking Ahead: Building a Resilient Cybersecurity Posture
Cyber resilience starts with those basic steps, but it goes beyond that. The most important thing to realize is that improving cybersecurity is never done. Instead, you need to monitor your tactics continuously and pay attention to updated threat intelligence.
Invest in cybersecurity solutions that are scalable and flexible. Stop thinking about it as a cost center. Good cybersecurity is a business enabler and while it may be hard to see the ROI, given that it exists primarily in preventing costs rather than generating money, trust that it is there.
SMBs need to be proactive and ready to adapt to an evolving threat landscape in which they are, more and more, prime targets for criminal activity.
If you aren’t sure how to best protect your company from growing cyber threats, contact Yobihouse today. Talk to us about a cybersecurity risk assessment or consultation so you know where you stand, where to start, and where you should go from here.
