13 May Top 7 Cyber Attacks Threatening SME’s (and how to prevent them)
Small and medium sized enterprises (SME’s) frequently underestimate the need for cyber security protection. This miscalculation could end up being a risky strategy for those not willing to invest in the best preventative measures for their business. Just because an enterprise is small, does not mean it is not at risk from the top cyber attacks circulating the web.
In fact, SME’s could have an even greater level of risk against them, as they often will not have sufficient cyber protection. Criminals know this and will take advantage of more vulnerable systems. SME’s can also work with larger corporations too, and hackers will try to get into these large organisations via a vulnerability in the smaller businesses network.
Smaller enterprises may not have the large budgets, the knowledge/ expertise or the time and resources to commit to a decent cyber security plan. This could end up being a deadly mistake. According to the National Cyber Security Alliance small businesses will go bust after 6 months of a cyber breach. Many SME’s simply underestimate the chance of a cyber attack, as well as how a serious data breach could effect the company.
The key? Awareness, knowledge, and prevention. The best way to stay in tune with the current top cyber attacks is to be in the know about what type of attacks are out there. Once you know what to look for, the easier they will be to spot. Ensuring you have a decent cyber security protection is also vital. So, what are the top cyber attacks companies are facing right now?
Phishing attacks
The age-old phishing attack. This one has been around since the beginning and, unfortuanlty, it is not going away anytime soon. In fact, phishing attacks are becoming even more sophisticated with the advance in technology. So, what are phishing attacks?
Cyber criminals will send an email, text message, or message via social media, often imitating a well known company, and request that you click on a link, update payment or login details, or sign-up to something, inadvertently giving away your private details or money.
The messages or emails sent are usually very convincing and create a sense of urgency such as ‘your subscription is almost up, enter your card details to keep this service’, etc. They will use similar wording, colours, logos, and email address as the real site, making it easy for someone to be convinced.
Phishing attacks are the biggest threat to most businesses, with 90% of all data breaches being caused by such attacks. SME’s also need to watch out for spear phishing attacks, similar, but instead of a generic email that is sent out to hundreds of users at a time, a spear phishing email will be sent to a specific person. The attackers will have researched the person they want to imitate (often CEO’s or other executives higher up in the company) and will pretend to send an email from that person.
They may send an email to employees of the company, pretending to be the CEO and saying a payment needs to be sent urgently to such and such. Because the name, logo, wording, everything is in the same style as the real person, users can be easily misled.
Good cyber awareness is crucial to help employees recognise a phishing attack. Installing a next-generation firewall can help to filter out malicious websites and traffic.
Lack of knowledge
You can have all the best security protection you want, but this means little if staff members lack any knowledge of cyber security. As we have seen from the previous paragraphs, phishing attacks are the most common cyber attack out there. Now, if staff members have no awareness of phishing attacks, how much more likely are they to click on a malicious link or send an ‘urgent’ payment? The more employees know about the most common attacks, the easier it will be to spot them before it is too late.
Even the smallest of businesses can still hold a good deal of customer information and financial data, and for this reason, organisations of every size should at least have a basic knowledge of cyber security. Staff members should have training in cyber security practices, attack simulation and be aware of common cyber attacks to watch out for. This training should be ongoing and revised as new attacks emerge.
DDoS Cyber Attack
DDoS stands for ‘Distributed Denial of Service’. These attacks will disrupt a website, server, or network with a huge amount of web traffic, so users are refused access to it. DDoS attacks can be complicated, and the cyber criminal will often start and stop them, to confuse businesses or to hide the fact that an attack is even happening.
Websites may be forced to go offline, which will disrupt online sales, leading to huge losses, particularly as these cyber attacks can last from 6 to 24 hours. Using a good DDoS mitigation service and having a plan of action for this type of attack is a great way to eliminate some of the traffic overloading the site.
Malware
Malware attacks are another common threat facing small and medium enterprises. It is often used alongside other type of attacks, for example a malicious code embedded into a phishing email. Malware can be injected into your system via a malicious website or download, or by connecting to an infected device.
Customer and company data can be easily extracted in malware attacks and it can even damage devices, with expensive repairs to match. With customer data at risk, businesses need to ensure they are complying with relevant government data regulations, or you could be at risk from a costly fine.
Endpoint protection is advised for all devices, including personal devices. This will help protect every access point and stop data being encrypted.
BYOD
Bring your own device (BYOD) is becoming increasing common during the pandemic. With more employees working from home on their own devices, the risk of a malware or virus attack is only increased. Personal devices do not often have the right amount of protection as a company device. This can be seen as an easy way in for hackers.
Personal devices that are not properly protected are prone to cyber attacks, which can lead to the hacker gaining access to your company’s entire network and files.
Setting up a good cyber policy for what employees can work on/ send over the internet is a great start. For sensitive data, ensure staff members are not using public Wi-Fi and are using a VPN (virtual private network) to send those files. This will make sure IP address remain hidden and company data is encrypted.
Inside threats
Rouge employees, contactors, business associates or disgruntled former staff members can actually be a huge threat to a business. They have the means to get into company networks and may have access to sensitive data. Through this access, an insider threat can cause real harm to a business.
Keeping employees trained in cyber awareness will prevent any attacks from ignorance and only allowing access to the most sensitive data to trusted staff members. You should stop any accounts of former employees that may still be active and monitor active accounts for malicious activity.
Ransomware
Ransomware are common cyber attacks that have been around for years. Cyber criminals will hack into a network or device, gain access to private information and then encrypt that data. The only way the business can get the data back is by paying a ransom, after which they will be given an encryption key to secure the files back. A development of the ransomware attack is hackers may now threaten to publish sensitive data online to ensure the ransom money is paid.
This can be a real threat for businesses, particularly if private customer information is released on the dark web and sold. The company will then be liable for a possible breach of data protection laws, and an incoming large fine.
This is why backing up your data is absolutely crucial. If you have a backup of your data, then you can rest assured you still have access to it (it being published online is a different matter however). Regular backups should be completed and systematic checks that your backup system is working, are also necessary.
Advanced endpoint protection is also recommended. This will provide protection for devices and help to stop criminals encrypting data.
Conclusion
As said at the beginning of this post, awareness, knowledge, and prevention are the best measures to protect your business from a cyber attack. Having a good all-round security policy, as well as active cyber protection is the best way to ensure your business is protected as it should be.
For more information on how we can help your business, please talk to an expert at Cube Cyber today. We can help evaluate the specific needs for your business.
