Cyber attacks on small businesses are very common – this much you probably know. But knowing that and having the right security and protocols in place can often be mutually exclusive things for business owners who are handling, well, everything else. What attackers are after, of course, is obvious. ‘All of this is motivated by money – they're either trying to extort you or get money out of you in a softer way,’ says Nathaniel Fried, co-founder of digital risk protection company TurgenSec. To mitigate the risks, you'll need to get up to speed on the basics and put some fundamental procedures in place to both protect and prepare you in case of the worst.  

A refresher on the common types 

Phishing

A broad term that covers all the times when an attacker contacts you (via email, text or phone) pretending to be a trusted contact or reputable source. They then entice you to click a malicious link, download something or give them access to sensitive info. Spear phishing is when a cyber attacker impersonates a trusted sender, like a business contact. That's increasingly as a result of pretexting – where an attacker has some info that lowers your guard.  

How to prevent it

There are businesses that provide basic training on how to spot phishing scams. Beyond that, there are a few software options to help. Secure email gateway software blocks spam, viruses and malware from reaching your inbox; post‑delivery protection platforms shield users from threats from within the inbox; and website filtering software uses anti-virus systems to scan pages for threats.  

Malware 

This is any software with malicious intentions, designed to damage your computer, server, network or data (for example, viruses). It often comes as malicious downloads or spam emails, and it can be particularly common if you let employees use their own devices. The main danger of malware is that it tends to snowball into worse and worse things if left unaddressed. 

How to prevent it

Endpoint protection software (eg, anti-virus software) gives admins a central panel to manage company devices, making sure all users' security is up to date. 

Ransomware 

Ransomware is an increasingly common type of malware that encrypts company data, websites or social media accounts so that they can't be accessed and forces you to pay a fee to unlock them. Attackers can also threaten to leak data for leverage. It can be a very lucrative form of attack. 

How to prevent it

Beyond the aforementioned steps, have your data periodically backed up on the cloud. 

Insider threats

This refers to the actions of current or former employees or associates where they reveal or modify sensitive data – willingly or not. 

How to prevent it

Be sure to limit employee access to data, and monitor network data, even if this is something you only refer to later with the help of professionals. After that, create clear procedures for onboarding and offboarding: onboarding might include background checks and policies on email, social media and company data; offboarding will include immediately revoking any logins and access.

This article was first published in Courier issue 45, February/March 2022. To purchase the issue or become a subscriber, head to our webshop.