The unfortunate reality is that cybercrime continues to pay, and as such, it continues to grow. This makes cybersecurity for small business an especially important topic for the small business world as most smaller companies have limited budgets—and therefore limited protection. Read more on how you can protect your business from tech threats that plague every business connected online.
Cybercriminals often seek the proverbial “path of least resistance,” targeting organizations they perceive to have the weakest defenses. This makes cybersecurity for small business an especially important topic for the small business world as most smaller companies have limited budgets—and therefore limited protection.
According to a 2022 Security Magazine analysis, 43% of cyberattacks are directed at small businesses. Worse, 60% of small businesses victimized by a cyberattack go out of business within six months.
Given these alarming statistics, cybersecurity should be a major concern for small business owners. But these plans must also focus on maximizing the impact of limited budgets in a way that larger enterprises may ignore. Achieving this balance depends on two key factors: knowledge of common threats and cost-effective strategies for addressing those threats.
The State of Cybersecurity for the Small Business World
Cybercrime poses serious problems. In the public sphere, it endangers public safety, government institutions, and the democratic process. High-stakes risks also extend to the private sector: the National Institute of Standards and Technology (NIST) places the annual value of cybercrime-related losses in the hundreds of billions of dollars.
One 2020 NIST analysis estimated that the negative economic impact of cybercrime in the United States could total up to 4.1% of the GDP.
The shadowy world of cybercriminals includes rogue groups, malicious individual actors, and organized operations sponsored by hostile foreign states. These operatives have varying objectives, including financial gain. Many small businesses—especially those in critical industries—store repositories of valuable data and digital assets.
At the same time, small business cybersecurity measures tend to lag behind the protections employed by larger corporations—mainly due to financial limitations. This combination of appealing data and weaker cybersecurity makes these enterprises highly attractive to cybercriminals.
Common Cybersecurity Threats in the Small Business World
Experts in cybersecurity measures for small business stress that smaller organizations face threats similar to those of their corporate counterparts. In addition, small businesses face unique challenges: “security through obscurity”—the fallacious notion that a low public profile provides a degree of safety—is a key example.
Hackers and cybercriminals possess tools to simultaneously automate their attacks and target hundreds—or even thousands—of organizations. Small companies tend to have lower levels of threat awareness, fewer defenses, and fewer resources to deal with active attacks. These factors combine to make small businesses more attractive than resource-rich, well-defended corporations.
Some common techniques cybercriminals use to target small businesses include:
Cyberattacks Through Email
“Business email compromise is a huge deal that can be [particularly] devastating to a small business,” says Tracy Swaim, VP Fraud Risk Manager at HTLF. A 2022 study released by cybersecurity firm Tessian characterized email systems as one of the largest vulnerability areas. Hackers and cybercriminals know this and routinely target victims via email.
Tessian identified three common email attack vectors:
- Phishing attacks: Phishing scams attempt to lure individuals into sending compromising information under false pretenses. Cybercriminals typically pose as legitimate organizations when conducting email phishing attacks. Malicious actors may also adopt the guise of a trusted sender or recipient when conducting attacks, in a variant practice known as “spear phishing.”
- Impersonation: Scammers use various impersonation strategies. In some cases, they pose as representatives of trusted tech companies and initiate contact under the guise of solving a login issue or other technical problem. In others, they impersonate management or vendors and attempt to trick unwitting employees into completing fraudulent financial transactions.
- Ransomware: In ransomware attacks, cybercriminals take over computers or computing networks, encrypting critical data and demanding payment for its release. Such attacks can leave a business bankrupt, regardless of whether the victim meets the attacker’s demands.
Hacking the People: Social Engineering and Identity Theft
Some cybercrime tools do not involve hacking at all—at least, not in the technical sense. Instead, they target individuals through a practice known as social engineering. In a social engineering scam, malicious actors target specific personnel, using various tools designed to dupe them into unwittingly supplying valuable, confidential, or personal information.
Identity thieves also target small businesses. In such cases, identity theft scams often involve a cybercriminal posing as a company owner or high-level employee to obtain loans or credit or to misappropriate cash. The small business is then left responsible for the resultant liabilities.
Zoom Attacks in the Post-pandemic World
In 2020, during the height of the Covid-19 pandemic, popular teleconferencing platform Zoom was targeted by cybercriminals. Hackers made off with an estimated 500,000 passwords, revealing serious vulnerabilities.
Zoom and similar platforms can be compromised in many ways. Malicious actors can intercept messages sent within the system, conduct phishing attacks via their own messages, and exploit other security weaknesses that leave the personal and private data of individual users exposed.
Online Scams and Other Cyber Threats
Cybercriminals and hackers use many other strategies beyond business email compromise, social engineering, and identity theft. A 2022 Better Business Bureau (BBB) post published on LinkedIn identified other common scams that target small businesses, such as:
- Fake or fraudulent invoices
- Directory scams that dupe businesses into paying for ad space they never receive
- Charity-based scams
- Overpayment scams, in which a “customer” overpays for services using a bogus check, requests a refund for the difference, then leaves the business responsible for the losses when the check cannot be cashed
Cybersecurity in Remote and Hybrid Work Environments
Experts recommend that small businesses engaged in hybrid and remote work operations redouble their cybercrime and fraud prevention efforts. Virtual work settings are inherently vulnerable to malicious acts, especially if employees:
- Connect to online business assets through their home internet networks
- Connect their personal devices to company internet services or VPNs
- Use work computers offsite
Small businesses engaged in hybrid and remote working arrangements require cybersecurity resources and support tools specifically dedicated to their offsite teams.
The Current State of Security for Online and Hybrid Small Businesses
A 2022 editorial by VentureBeat explored cybersecurity for small businesses from the standpoint of hybrid and remote arrangements. It noted that hybrid employees are prone to distraction and mental fatigue caused by constant switches from onsite to offsite work. This can lead to oversights that create security risks.
Furthermore, hybrid and remote work blurs the lines between professional and personal life. Employees may use their work devices for personal communications or personal devices for work communications. Both cases result in increased cyber risk.
Best Practices for Increasing the Resiliency of Your Remote or Hybrid Workforce
In addition to targeting remote and hybrid employees via productivity platforms, insecure networks, and devices, cybercriminals also draw on the aforementioned general strategies. These include social engineering, phishing attacks, business email compromise, ransomware, identity theft, and impersonation scams.
Improving small business resiliency to such attacks means implementing targeted strategies across two key areas:
Employee Behavior
Employees represent a critical first line of defense when it comes to small business cybersecurity. Implement and enforce these behavior-based best practices for hybrid and remote team members to lessen the chance of an attack’s success:
- Create strong passwords and change them regularly
- Only use company-issued devices for work purposes
- Educate employees on fraud prevention strategies, with a special focus on the social engineering scams
Technical Infrastructure
Regarding hardware and technical infrastructure, businesses should ensure that all company-issued devices are protected by PINs and/or strong passwords. From there, small businesses can add further strategies, such as:
- Requiring multi-factor authentication (MFA), especially for access to sensitive systems and data
- Adding endpoint protections capable of detecting threats, taking frontline action to neutralize them, and informing personnel of potential security breaches
- Using firewalls and/or VPNs to create additional layers between employees and potential cyberattackers
Protecting Your Customers Against Cyber Threats
Prioritizing customers' sensitive and personal information is a core element of cybersecurity for small business. Malicious actors often seek out information including Social Security Numbers, credit card details, phone numbers, names, and addresses when targeting small companies. Organizations that deal with and store such data require advanced fraud protections.
Taking proactive steps does not guarantee that a small business will be impenetrable to a cyberattack. However, there are cost-effective ways to immediately improve security and make it more difficult for malicious actors to succeed in their efforts.
Protect Customer Data from Within
Experts in small business cybersecurity recommend a four-point plan for establishing internal protections that reduce the likelihood of a data breach:
- Collect only the data necessary to complete transactions or maintain business relationships
- Limit access to customer data to as few employees as possible
- Implement strong, password-based access controls for sensitive and personal data
- Centralize data storage—and focus resources on protecting that central repository
Ensuring that security tools adhere to established standards will also enhance protection. Two common cybersecurity standards that apply to business-focused tools include ISO 27001 and SOC-2.
Educate Customers About Fraud and Cyber Threats
Customers also have a role to play in small business cybersecurity. When customers also follow best practices, security breaches become less likely, and attackers have fewer vulnerabilities to exploit.
Companies that process and store personal and private information should maintain clear data protection policies that state why the information is collected and how it is used. They should also inform customers about the common strategies cybercriminals use to obtain and misuse data—and how to avoid falling victim to them.
When communicating with customers, do not use technical vocabulary. Instead, use terminology laypeople can readily understand.
Use Secure Payment Processing Technologies and Strategies
Small businesses that process payments over the internet are responsible for using the most secure technology available, such as credit and debit cards, wire transfers, and mobile wallets.
In addition to dealing only with the most secure payment methods, small businesses can also:
- Require customers to use multi-factor authentication when submitting payments
- Outsource the storage of sensitive data to third-party service providers
- Delete payment-related data as soon as the transaction is processed
- Obtain SSL certification for payment websites
Businesses can also require customers to verify their identities using their driver’s licenses or passports when completing major purchases. Framing such policies as a security issue can help address customer concerns over the additional steps involved.
Protecting Your Company at The Operational Level
In addition to the strategies above, businesses must consider whether their operations necessitate additional interventions. Some emerging risks initially arose due to changes made to accommodate business continuity during the Covid-19 pandemic, such as contactless payment and rapid shifts to online ordering.
Most small businesses lack the financial resources to build complete cybersecurity infrastructure. Thus, maximizing the impact and reach of available and affordable tools, technologies, and strategies is critical.
Establish a Cybersecurity Plan
Creating a cybersecurity plan requires close analysis of vulnerabilities, potential attack vectors, and the types of data or assets cybercriminals might target. Small business owners should create a customized plan to reduce threat exposure, respond to security incidents, and protect critical data.
Supplement the plan by investing in affordable, readily available technologies, including antivirus and anti-malware software, secure and password-protected internet service, and regular data backups.
Also, be certain the organizational cybersecurity plan covers all four key response steps—identifying an attack and its scope, containing the threat’s ability to cause harm, removing the threat or the data the threat is targeting, and creating a recovery strategy.
Educate Employees on Cybersecurity Best Practices
Cyber threats constantly change. Malicious actors regularly develop new scams and techniques—and small businesses should not assume that basic, one-time employee education efforts will suffice.
Instead, consider cybersecurity for your small business an ongoing and evolving issue. Remain up-to-date on threat intelligence, share pertinent details with staff members, and adjust cybersecurity and incident response strategies accordingly.
Consider Cybersecurity Insurance
Businesses in certain industries face higher risks than others. For example, cybersecurity is particularly important in banking, given the amount of money flowing through financial institutions. Elevated threat levels can also apply to healthcare, education, government, and other fields that involve large volumes of sensitive data.
Cybersecurity insurance offers an additional safeguard. Small businesses operating in industries known to face elevated cyber threats should prioritize some form of insurance, while other small businesses should also certainly consider it. Consider the value and peace of mind insurance offers: small businesses victimized by cybercrime stand a 60% chance of permanently closing within six months. Insurance acts as a financial safeguard.
Smart Financial Partnerships Can Boost Cybersecurity for Small Business Owners
The unfortunate reality is that cybercrime continues to pay, and as such, it continues to grow. Cybersecurity Ventures projects the annual global cost of cybercrime to reach $10.5 trillion by 2025—which would mark a 350% increase over the 2015-2025 period.
Small business owners may think they cannot afford to improve their cybersecurity. In reality, they cannot afford not to improve their cybersecurity. Threats are ever-present, constantly growing, and constantly changing—and there is no telling when a given business might become ensnared in the sights of a malicious actor.
Building a relationship with a responsive and empathetic financial partner, like New Mexico Bank & Trust, a division of HTLF Bank can help small businesses finance the cybersecurity solutions they need without compromising their profitability. New Mexico Bank & Trust, a division of HTLF Bank specializes in helping small businesses secure the financing they need to fortify their cybersecurity and protect their long-term vitality.
To discuss your unique needs in detail, contact New Mexico Bank & Trust, a division of HTLF Bank today.