Cybersecurity Resources for Small Businesses

Large corporations may get all the headlines regarding significant security breaches and hacking attempts, but that doesn’t mean your small business is too small for hackers. Some attackers might see your small business as a path of least resistance for attacking systems and stealing data.

Hackers want the largest payoff with the least amount of work. And while large enterprises are full of valuable information, their security systems are usually far stronger than small-to-medium-sized businesses (SMBs).

This comprehensive guide explains why cybersecurity is key for your small business, common cybersecurity threats to be aware of, tips for best practices, and resources you can use.

Key takeaways: 

• Experiencing a loss of sensitive data due to a security breach can cost your company thousands — or even millions — of dollars.
• Some of the most common security threats include malware, ransomware, network attacks, and even raids on a business’s trash — dumpster diving.
• To avoid becoming a victim, be sure to train your employees on how to spot suspicious emails, require the use of a virtual private network (VPN), and keep software updated with the latest security patches.

Why Cybersecurity Is So Important to Your Small Business

Every business should be concerned about cybersecurity. Small businesses are especially vulnerable to the negative effects of a breach. Suffering a loss of sensitive data, especially personally identifiable information (PII), is very expensive and can cost your business thousands, if not millions, of dollars in fines depending on the number and types of records exposed.

IBM’s 2021 “Cost of a Breach” study found that the average cost per record lost or stolen increased from $141 in 2020 to $161 in 2021. Let’s say you have 1,500 customer records. A breach would cost your business $241,500 in fines alone.

What about ransomware? These attacks have been a hot-button issue for years, especially with debates over the ethics of paying ransom to unlock data and systems.

That same IBM study found the average cost of a ransomware attack totaled around $4.62 million. These costs are nothing to dismiss. This means you have thousands, if not millions, of reasons to prioritize cybersecurity, even as a small business.

Are the potential monetary fines not enough to convince you? Then think what a cyber breach could do to your image.

Customers, clients, and employees all count on you to keep the information they share with you private. Exposing their information to cybercriminals erodes that trust and can easily sink your business.

Look at cybersecurity conglomerate SolarWinds. Their massive breach isn’t only costing them millions in fines and legal proceedings; it’s also costing them enough business to prompt them to hide their high-profile client list.

The bottom line is that cyber breaches are costly, embarrassing, and damaging to future business prospects. While it’s hard to show a return when it comes to bolstering your cybersecurity, it’s one of those investments that you’ll be glad you made if you need it.

What Are the Common Cybersecurity Threats to Be Aware Of?

1. Malware

Malware encompasses malicious software meant to sabotage systems, lock up or extract valuable information, spy on networks, or create backdoor access to security functions. There are many types of malware, including:

• Ransomware: Prevents users from accessing their systems or personal files through encryption and demands money to regain access.
• Spyware: Applications that monitor online behavior without the user’s knowledge or permission.
• Worms: Uses the network to automatically replicate copies of itself to systems or devices.
• Trojans: Any application that masquerades to get past scrutiny and then does something malicious.
• Rootkits: Clandestine computer programs designed to provide continued privileged access while actively hiding their presence.
• Keyloggers: Software programs or hardware devices that track the activities from input devices. Typically stores your keystrokes in a small file, which is either accessed later or automatically emailed to the person monitoring your actions.
• Logic bombs: Any code that is hidden within an application and causes something unexpected to happen.

2. Insider threats

When you think of “insider threats,” you may picture company moles waiting for the right time to steal your most valuable secrets. While this is one example, it’s not the only one. Insider threats can even come in the form of ignorant or well-intentioned employees who act carelessly with company assets.

Employees who log on to public Wi-Fi without a virtual private network (VPN) or leave their company devices unattended are potential threats. So are employees with a grievance against management.

3. Social engineering

Social engineering is the process by which intruders gain access to facilities, networks, databases, and even employees by exploiting the trusting nature of people. Think of social engineering as their cyber equivalent of con artists. Social engineering attacks include:

• Phishing/spear phishing: Phishing is an attack method that fools victims into giving up sensitive information or clicking and downloading malicious materials. Spear phishing campaigns target specific company employees using document files.
• Tailgating: Attackers follow behind employees or use employees as cover to enter secured facilities and offices.
• Dumpster diving: Attackers rummage through business trash to find sensitive information they can use for future attacks.

4. Network/application attacks

This is the cyberattack that gets all of the attention in the news. These attacks are more technical and rely on exploiting vulnerabilities in networks, applications, and website security. The most common attacks of this nature are:

• Man-in-the-middle (MITM): An attacker intercepts traffic between two endpoints to receive and manipulate that information. There are several types of MITM attacks, including address resolution protocol (ARP) poisoning — intercepting traffic within a local area network (LAN) or LAN switch ― and session hijacking — hijacking broadcast traffic.
• Distributed denial of service (DDoS): Denial-of-service attacks occur when someone floods a target with traffic to deny service to servers. DDoS uses botnets to flood victims with traffic, making it harder for victims to stem the flow.
• Structured query language (SQL) injection: An injection attack that makes it possible to execute malicious database alterations on the back end of applications. These types of attacks are used to bypass application security functions.
• Cross-site scripting (XSS): With this, an attacker aims to execute malicious scripts in the victim’s web browser by including malicious code in a legitimate web page or application. This is a method used for session hijacking.

What Are Some Small Business Cybersecurity Tips and Best Practices?

Now that you have a basic understanding of the threats, here are a few best practices and tips to improve your organization’s security. You’d be surprised just how effective they are when implemented correctly.

1. Train your employees on security practices

It turns out that countless cyberattacks have one factor in common: human error. It’s crucial to educate your employees on best practices when handling company technology. Make the training a mandatory yearly requirement necessary to get access to sensitive systems.

2. Keep your software up to date

Software that’s up to date will have all of the latest patches installed. Out-of-date software is prone to security flaws that hackers are more than willing to exploit.

Set up your software to update automatically to prevent machines from falling behind due to oversight or procrastination.

3. Use a VPN

The best VPNs create encrypted tunnels for network traffic so that users can access sensitive material without exposing activities to prying eyes. VPNs are especially valuable with remote work. The last thing you want is for your valuable proprietary information to fall into the hands of network hackers.

4. Avoid suspicious-looking emails

Protect yourself and your organization from phishing scams by avoiding suspicious emails that sound too good to be true, poorly worded, or include abnormal requests.

5. Use a proxy firewall to protect your network

Proxy firewalls are the most secure. They separate internet traffic and your network perimeter, perform a deep-packet inspection of traffic coming in and out of the network, and note the different internet protocol (IP) addresses making contact with your firewall, also known as a stateful firewall capability.

6. Plan for the use of mobile devices

Smartphones in the workplace are here to stay, so it’s crucial that your business plans for them. If left unmanaged, these devices threaten your security infrastructure, whether phishing scams or users accessing sensitive company data on personal devices.

Either adopt a mobile device management (MDM) system that monitors and controls access to personal smartphones used on the job or completely restrict access to sensitive materials and networks with personal devices.

7. Use multifactor authentication

Passwords aren’t enough. Some passwords are easy to guess, while others are used multiple times by your employees for simplicity. Whatever the case, you should adopt a multifactor authentication system to provide an extra layer of login access security to your systems.

This includes one-time codes — such as email and short message service (SMS) — biometric verification, phone authentication, security questions, and application push notifications.

8. Avoid unknown USB drives

Would you pick food up off of the ground and eat it? Probably not. So why would you pick up an unknown USB drive that’s just laying around and plug it into your computer?

Attackers love taking advantage of the curiosities of others by setting out USB drives around and hoping someone will plug them in. This gives attackers the chance to inject malicious processes onto your devices.

Small Business Cybersecurity Resources

There are tons of resources full of information on cybersecurity and new threats. However, if you’re looking for the most prevalent threats and popular fixes, these outlets are best:

• Open Web Application Security Project (OWASP): One of my favorite things about the cybersecurity community is the sense of togetherness when sharing information regarding new threats and solutions to those threats. The OWASP is an example of this community coming together to provide tools, resources, community information, security training, events, and even regular top 10 lists of the biggest threats to web applications at that time.
• US-CERT Twitter Account (@USCERT_gov): Stay updated on the latest threats and breaches with the US-CERT government Twitter account. It provides new information regarding vulnerabilities in software and hardware, new patches that have come out to fix old issues, and educating users on the current cybersecurity landscape.
• Common Vulnerabilities and Exposures (CVE): A comprehensive dictionary of common vulnerabilities and key identifiers. This searchable resource is funded by the U.S. Department of Homeland Security and run by the MITRE Corp.
• Infotec: Get the training and resources you need to stay on top of your business’ security needs. Infotec offers many training options (virtual and in-person) and detailed blog posts covering all kinds of security topics.
• Federal Communications Commission (FCC) Small Biz Cyber Planner: Security threats don’t just target the big fish. Small businesses are also a target. That’s why the FCC created this resource to get your organization on track with a cybersecurity plan that works for you.
• Google Security Blog: A no-frills resource created by the Google security team that offers lists of the most recent web security threats and an archive of old threats to watch out for.
• U.S. Department of Defense Cyber Crime Center (DC3): This resource supplies businesses with forensic tools, information, training, and reporting avenues regarding cybercrimes and vulnerabilities.

Want to Learn More About Cybersecurity?

Cybersecurity is evolving constantly, and considering the breakneck pace people are shifting their processes to the cloud and remote settings, it’s more important than ever to stay on top of current trends, tools, and threats. Digital.com has you covered with all kinds of resources and top security software lists, including:

• The Best Web Hosting Security Practices
• Why Your Business Needs an Effective Digital Security Plan and How To Create One
• Creating Strong Passwords: 5 Tips for Keeping Your Accounts Secure

Frequently Asked Questions About Cybersecurity for Small Businesses