Getting The Best Of The Bad Guys: Cybersecurity For Small Businesses
By JUSTIN DEMPSEY | Manager | Nex-Tech Technology Services
Here’s a seemingly simple question: How many of you would like to make $70,000 tax free for less than a day of work?
Now, how many of you would like to be the one who pays for that half day of work? On the surface, you might think that these questions relate to turning a quick profit.
However, when tied to my recent workplace experience, they have deeper cybersecurity implications.
UNFORTUNATE EXPERIENCE
Last month, I was unfortunate enough to have helped a business that fell victim to a ransomware attack. The small company employed fewer than 10 individuals and had lost seven years’ worth of data.
The attack happened over the weekend and impacted everything at the company, including their accounting system. They had just two days to move payroll and to pay employees. Meanwhile, they juggled conversations with insurance, legal, and forensic teams.
After getting the right people involved, the small business learned that the estimated ransom was $70,000. Forensics showed the attacker spent less than a day in their system before deploying everything automatically and moving on to the next victim.
That’s a great payday for a cybercriminal that comes at an extremely high cost to businesses.
This year alone, I have helped 11 small to medium-sized businesses with cyber events. Events ranged from phishing attempts and credential harvesting to encryption events and bank/billing redirects.
EACH EVENT PROVIDES IMPORTANT LESSONS:
Maintenance is key. Too many small businesses see IT as a buy once and run forever solution. They underestimate that technology requires care and maintenance, just like your car does.
Good Managed Service Providers (MSPs) can help. Companies that partner with a strong MSP are much less likely to have issues. When issues do arise, they are resolved much faster when a good MSP follows industry best practices and steps in with proper processes and the experience to deal with cyber events.
PROTECT YOUR ORGANIZATION
While these lessons are important, it is even more essential that business owners consider ways to protect their organizations from cyber events. Most of it boils down to implementing, documenting, and following consistent processes:
Be aware of your email. Phishing and email compromises are the fastest growing attack vectors. These attacks can let criminals in, giving them access to your customers, or to your billing and bank accounts.
Use multifactor authentication on all accounts. This should be standard for all users in your organization.
Train users on phishing safety. There are great tools out there to help train your team in fun ways. In fact, Nex-Tech offers that as a service.
Protect your email account and passwords.
Change passwords on a regular basis.
Disable and clean up accounts as soon as someone leaves.
Check your backups once a year. Backups are crucial. However, they do no good if they are never checked or only exist on-site. The first thing a cybercriminal will do is find and kill backups locally attached to the network.
If you have a Windows server, take advantage of the Active Directory rules related to account management. Some rules to consider include enforcing complex passwords and locking out accounts after three failed attempts.
Keep your IT up to date. If you cannot be active in this process, engage someone who can. Hint: you might work with a good Managed Service Provider.
Educate your staff. Help them feel comfortable speaking up if something does not feel right. Typically, users know something is wrong but may be uncomfortable sharing.
PRACTICE GOOD CYBER HYGIENE
Perhaps the most important takeaway is that your business can be protected against the potentially devastating impacts of a cyberattack.
I used to think that the bad guys were cyber wizards and that there was no way we could prevent them from harming our networks. Most of the time, however, these attacks are not as highly sophisticated as those in the movies; the bad guys just take advantage of the business’ lack of good IT practices and cyber hygiene. By taking basic steps, most businesses will be able to avoid a cyber event.
TK
