5 common cyber threats to small businesses

5 common cyber threats to small businesses

Here are the top five cyber security threats to small businesses, and how to avoid them.

1. Ransomware & malware attacks

Ransomware and malware attacks combined make up more than half of cyber incidents reported to the Office of the Australian Information Commissioner (OAIC). Ransomware impacts thousands of businesses each year, most recently and notably Optus and Medicare. However, small businesses are typically more at risk from these types of attacks due to their lack of cyber security acumen and because they’re more likely to pay a ransom to recover their data that’s often not backed up.

Ransomware attacks render your business data and information unusable, either by blocking access to vital business information or by encrypting your data or files so that you can no longer use or access them. Hackers typically demand a ransom in exchange for the decryption keys and recovering your business information. Ransomware is a form of malware that encompasses other cyber threats like trojans, viruses, worms, botnets, etc. These attacks are particularly damaging for small businesses because they can cripple devices, which require expensive repairs or replacements. They can also give attackers a back door to access data and put customers and employees at risk.

• How to avoid it: You can prevent most malware attacks with strong endpoint protection, web filtering to prevent users from accessing websites with malicious content/links, and by having an ironclad data backup plan in place to mitigate data loss, like in the event of a ransomware attack.

---

Read more: What is ransomware? How to protect your business

---

2. Phishing

Phishing attacks are one of the most widespread threats facing small businesses. It’s one of the top sources of cyber incidents after ransomware. Phishing is a type of social engineering attack that typically involves tricking users into opening an email that appears to come from a legitimate source, like a contractor, or external stakeholder, or clicking a malicious link. A phishing attack aims to trick the recipient(s) of the email or correspondence into handing over sensitive information or clicking a link that contains some type of malware. Phishing can also mislead users to visit scam websites or use a fake payment gateway.

• How to avoid it: Undertake regular phishing tests within all levels of your business, and continuously educate teams on the signs and dangers of phishing attacks. Use spam filters to block deceptive emails from reaching your employees.

---

Read more: Running phishing tests for businesses – best practices & tips

---

3. Insider threats

An insider threat, as the name suggests, comes from within your organisation ─ caused by either current employees, former employees, contractors, or associates. An insider threat can originate from anyone with inside knowledge or access to your business’ security practices, data, and computer systems. Insider threats can be malicious activity designed to specially target your organisation or simply be the case of human error. Over a third of data breaches reported to the OAIC were the result of human error (33%), while 13% were from a rogue employee. Insider threats are a growing problem within small businesses since employees now have remote access to multiple accounts that hold more data.

• How to avoid it: One of the best ways to prevent insider threats is to ensure your business has robust security procedures in place to prevent and detect misuse before an incident occurs. It’s also important to foster a strong culture of security awareness within each department of your business.

4. Web exploit attacks

Web exploit attacks use vulnerabilities and security holes in your web-based applications or software to gain access to sensitive data, systems, and networks. Common web application vulnerabilities include incorrect code, application design flaws, misconfigured or unpatched web servers, broken authentication, etc.

• How to avoid it: Use application vulnerability scanners to identify software vulnerabilities and unsound configurations of your network or web applications, as well as a firewall to block malicious traffic. Vulnerability scanning should help identify, analyse, and mitigate web-based vulnerabilities and misconfigurations before they’re exploited.

---

Read more: Vulnerability assessments for businesses

---

5. Poor password protection

Weak password protection is another big threat facing small businesses ─ this is when employees and teams use weak, default, or easily guessed passwords, or use the same passwords for multiple accounts. Most small businesses outsource some of their operations and use various cloud-based services that require different accounts and passwords. These services often can contain sensitive data and financial information. Having a robust and secure password is the first line of defence to protect those data sets, personal and commercial information, files, applications, software, and devices from being hacked or lost.

• How to avoid it: Consider using a password manager that automatically generates complex and unique passwords for all your employees. A password manager should help employees to manage passwords for all their accounts. You should also consider implementing multi-factor authentication (MFA) which requires users to provide two or more verification factors to gain access to business applications, online accounts like emails and customer relationship management (CRM) tools, or a VPN.

---

Read more: Your complete guide to password protection

---

A final word

Small businesses face an increasing range of internal and external cyber threats which put their small operations, employees, IT systems, and customers at risk. They often lack the cyber security precautions and budgets of larger organisations, but small businesses can still have a comprehensive set of security tools and policies in place to protect their organisation without breaking the bank. For more information on how to reduce your exposure to cyber attacks as a small business, contact us via email: enquiries@xiphcyber.com.