Small businesses can be particularly vulnerable to cyber attacks as they are less likely to implement cyber security measures that help prevent and recover from these threats. At the same time, there is more to cybersecurity than just having the latest IT solutions. Protecting your business and stakeholders means strictly implementing good IT security practices.
In celebration of Cybersecurity Awareness month, let’s talk about the most common security threats small businesses encounter, so you understand, take action, and increase your cyber security resilience against ever-evolving cybersecurity threats.
Cyber Threats
Malicious Software (Malware)
Malware is a term for any malicious software, including viruses, spyware, trojans and worms. They provide criminals access to critical information such as bank or credit card numbers and passwords. In addition, they can also take control of or spy on a user’s computer. The data criminals have gathered used for fraud, identity theft, disrupting businesses, stealing sensitive data or intellectual property, and siphoning computer resources for broader criminal activity.
Scam Emails (Phishing)
These emails are designed to trick recipients out of money and data. Aside from emails, criminals also use social media, phone calls or text messages to try and scam Australian businesses. Victims are tricked into performing specific actions such as paying fraudulent invoices, revealing bank account details, giving remote access and purchasing gift cards. Be cautious when you receive urgent requests for money, changes to bank accounts, unexpected attachments, and requests to check or confirm login details.
Ransomware
Ransomware works by locking you out or encrypting your files so you can’t use or access them. It can also stop your devices from working. Ransomware can infect your devices the same way as other malware, like by visiting unsafe or suspicious websites, opening emails, files or links from unknown sources and having poor security on your network or devices (including servers). In case you become a victim, never pay a ransom. It does not guarantee your files will be restored, nor does it prevent the publication of any stolen data. It also only increases the likelihood of you being targeted again.
Best Practices
Patch early; patch often
In 2021, the exploitation of unpatched vulnerabilities was the root cause for almost half of all cybercrimes investigated. This tells us that the earlier you patch, the fewer holes there are that cyber attackers can exploit.
Back up regularly and keep the latest copy off-line and off-site
If your system and data have been compromised, your IT manager can restore them quickly using backups. So make sure that you practice regularly backing up your data and keep it off-line and off-site.
Enable file extensions
By default, file extensions in Windows are hidden. When you enable them, you make it easier for your members to spot file types that don’t usually get sent to you and your stakeholders, such as JavaScript files.
Open JavaScript (.JS) files in Notepad
If you receive JavaScript files, you can safely examine the file contents by opening them in Notepad. Notepad blocks it from running and lets you check whether it’s a legitimate file or not.
Don’t enable macros in attachments received via email
Microsoft deliberately turned off the auto-execution of macros by default many years ago as a security measure. Cyber attackers will persuade you to turn macros back on to infect your system, so don’t do it!
Be cautious of unsolicited attachments
If in doubt about whether a file is safe or not, leave it out. Cybercriminals often rely on an ages-old dilemma of knowing that you shouldn’t open a document until you are sure it’s legitimate but not knowing whether they’re harmless until you open them.
Monitor administrator rights
Review local and domain admin rights constantly to ensure you know who has them and remove those who don’t need them. It’s also a good practice not to stay logged in as an administrator longer than necessary.
Regulate internal and external network access
Lock down your organization’s remote desktop protocol access and other remote management protocols to make sure you’re not leaving any ports exposed. For more robust security, use two-factor authentication and ensure remote users authenticate against a VPN.
Use strong passwords
Hackers can access your entire network if you have a weak and predictable password. To make them stronger, make them impersonal, at least 12 characters long, using a mix of upper and lower case and adding random symbols Ju5t.LiKETh1s!
Employee training
Teach yourself and your members how to prevent, recognize and report cybercrime. Train them in cybersecurity basics, including updating their devices, securing their accounts, and identifying scam messages. They are your first and last time of defence against cybersecurity threats, and training can change their habits and behaviours and create shared accountability in keeping your business safe.
Also, consider implementing a cybersecurity incident response plan to guide your team in case of a cyber incident. This will help you understand the critical devices and processes, and key contacts you can use to respond and recover.
Cybersecurity is continuously evolving, and keeping everybody updated on security threats could be the difference between criminals gaining access to your accounts, data or money or being protected.
Qamba can help you learn about the different cyber threats, develop a solid plan to keep your data safe and train your employees. Join our Work From Anywhere business forum, and let’s celebrate Cybersecurity Awareness month with a safe and secure workplace.
