In June of 2019, Verizon released its annual Data Breach Investigations report. This report showed that an alarming 43% of cyber-attack victims were small businesses. Perhaps even more alarming was a study done last year by payroll services provider, Paychex, that showed 1 out of 4 small business owners reported they didn’t use any security software to protect their businesses!
How serious is the threat? With the dramatic rise of CryptoJacking and ransomware-type threats, the ability for cybercriminals to monetize these attacks is significant. Every computer and server on your network now has a dollar and cents resale value on the dark Web. Combined with the fact that so many small business owners are not taking these threats seriously, small business networks make for both attractive and lucrative targets. We are no longer the collateral damage from attacks on big businesses and government organizations, we ARE the targets. We will be attacked, and if we are not ready, we will be breached, and we will pay the price. According to insurance carrier Hiscox, the average cost of these breaches is $200,000 and 60% of those businesses go out of business within 6 months of being victimized.
What can we do? Here are 5 steps you can do to protect your business and your future.
- Upgrade Your Servers and Workstations
Windows 7 & Windows Server 2008 went end of life in January of this year, which means Microsoft is no longer fixing discovered security flaws in these systems leaving you vulnerable.
- Upgrade Your Human Firewall
Just like we need to upgrade old systems, we need to make sure we upgrade our personnel’s awareness. Have some direct conversations about the importance of security at all levels of the organization, make sure the leadership and workforce alike are aware of their roles and responsibilities in defending the company, as well as give them training and resources to identify threats. A large number of the threats we are seeing currently are let in through very targeted and sophisticated email phishing attacks.
- Get Eyes on Everything
Monitoring is essential to any security system and strategy. Make sure key events trigger alarms that notify the appropriate individuals and that there is a process to remediate and document the event. What events should you monitor? As a baseline, we recommend failed login attempts on all network devices, configuration changes on switches, routers, and firewalls, anti-virus events, suspicious network activity, and both backup failures and significant size changes. This last one may seem odd, but we have heard consumer testimony of hackers gaining access via a phishing attempt, disabling the backups, then releasing ransomware after the backup retention period, effectively removing our best safety net in the ransomware battle!
- Adopt a Zero Trust Approach
For us, this starts with implementing the concept of least required access, make sure your users only have access to the files and systems they need to do their jobs and no more. While this won’t stop an infection, it certainly goes a long way to slow it down and contain it. Second, is to implement multi-factor authentication (MFA) everywhere. Most breaches are occurring due to passwords being accidentally released via phishing type attempts, MFA gives us a second layer of protection by requiring not only for a password to be entered for access but also for them to respond to a prompt or enter a code sent to a cellular device.
- Get Your IT Evaluated
Most companies have periodic financial reviews done by either a CPA or auditor to ensure the health of their financial systems, but few companies apply the same philosophy to their data. If you have a small number of IT staff either in your organization or in your outsourced provider, over time they can become “blind” to the level of security and general health of your network. Often a second set of eyes and an outside perspective can quickly reveal weak spots in your IT systems that can be turned into action plans to greatly strengthen your security posture.
Have I scared you a little? I hope so! The danger for our companies is real, but fortunately, by taking some simple intentional steps we can do much to increase the fortifications around our businesses, our livelihoods and our futures. If you would like to go deeper and discuss any of these topics, please feel free to reach out to me either via our social media channels (links below) or email me at [email protected]. Be safe!
