S

• SMBs are more susceptible to cyberattacks due to the lack of adequate cyber personnel, and the budget required to establish and maintain a cyber program. While most SMBs don’t consider themselves prime targets for attack, a new report by Barracuda shows that SMBs are 3 times more likely to be targeted by bad actors. According to the National Cybersecurity Alliance, 60% of SMBs go out of business within 6 months of sustaining a cyber-attack. SMBs must make cybersecurity a top business priority to protect themselves and their customers. More than 80% of SMBs report that they lack a cyber security strategy, and 70% have no plan in the event of a breach. The time is now for leaders in SMBs to get educated about what the risks are a one-off activity, but should adapt to changes in the business, threat landscape, market positioning etc.

Below are the top 3 cyber-attacks affecting SMBs:

1. Ransomware is by far the most common kind of cyberattack faced by organizations worldwide. Ransomware is a type of malware that once activated encrypts a company’s systems and/or data rendering it inaccessible for business purposes. Once a company has been hit by ransomware the attacker demands a substantial payment (typically in Bitcoin) to decrypt the company’s data for business to continue. To protect themselves SMBs should identify and work with a cybersecurity provider, invest in cyber awareness training and phishing exercises, require strong passwords and preferably Multifactor Authentication (MFA) where appropriate, keep systems updated, and ensure all backup data is encrypted.
2. Business Email Compromise (BEC) attacks. A BEC scam aims to get the victim to wire money to an account controlled by the scammers. The FBI’s Internet Crime Complaint Center (IC3) reports that $43 billion has been stolen through BEC scams since 2016. Secure Email Gateways (SEGs) are developed to prevent malware, ransomware, and emails displaying classic symptoms of corruption; however, they are not always as effective with numerous BEC emails escaping detection. Attackers are also getting smarter by bypassing conventional safeguards, starting with text-only communications that don’t contain links or attachments. To protect themselves SMBs should identify and work with a cybersecurity provider to select and implement the right solutions and invest in educating their employees on what to look out for.
3.  Phishing attacks are the most common cyber risks an SMB faces, phishing emails are reasonably easy to produce, & deploy. They aim to launch malware and steal information and are usually how attackers gain a foothold in an SMBs network. Phishing campaigns are very effective and readily scalable, allowing phishers to launch attacks with the click of a button. A phishing email or text is successful when a user clicks on a malicious link, opens an attachment, or submits their credentials. To protect themselves companies should invest in cyber awareness training exercises.

SMBs can reduce their overall cyber risk exposure by identifying and working with a cybersecurity provider prior to a breach. For those on a tighter budget, there are a number of free resources that are available online:

https://www.cisa.gov/publication/stopthinkconnect-small-business-resources

https://www.fcc.gov/communications-business-opportunities/cybersecurity-small-businesses

https://www.cisa.gov/uscert/home-and-business

https://staysafeonline.org/