Why Security Matters for Small Businesses

Most attacks are automated

We all know the stereotypical hacker, usually wearing a black hoodie sitting in a badly lit room in front of multiple screens with tons of windows trying to enter the system of their chosen target. While this works well in Hollywood, most attacks are conducted in a fully automated fashion.

Just like the emails that – hopefully end in your spam folder – most attacks are fully automated by software that gathers random targets and performs the same type of attack over and over again.

This means that these attacks don’t care if they’re sending phishing emails to the CEO of a publicly traded company or a freelance web designer who just started their business.

Attacks are cheap

Cyber-Criminals often don’t require expensive tools to perform their attqacks. Most attacks can be performed with simple and cheap tools that attackers can purchase on the so-called dark web. There’s also a large number of tools that are for free and can be used with limited technical skills.

Millions of attacks per hour and lower risk of getting caught

Unlike criminals looking for unlocked car on a residential street, cyber-criminals are not bound by the same limiting factors wo how many potential victims they can target.

Unlike the criminals mentioned the risk of getting caught is also significantly smaller for cyber-criminals.

All of these factors make it more economically viable for people to conduct cyber-crimes and scale up their operations

More than 50% of Internet users (Consumer and Business) have been affected by a cybercrime incident – where 1/3 of them took place in the past 12 months (Research by Norton)

Financial consequences

Falling victim of a successful cyber-attack can cause significantly more costs than the prevention would’ve cost. From potential loss of business to spending money for experts to recover lost accounts/data, the time and money likely ramps up very fast.

Loss of productivity

Each cyber-incident is going to be at least a distraction from your ability to focus on the business. The time it will take for you to deal with the consequences from an attempted or successful cyber-attack could be better spent. Especially if your team is growing you want your people to focus on their work rather on cleaning up the fallout from having their e-mail or other tools compromised.

Loss of data

Losing access to one or multiple accounts or having your businesses data deleted as a consequence of a cyber-incident is likely to be disruptive to your business.

Your e-mails and documents are the foundation of your business processes like invoicing, accounting, and more. Attackers often take advantage of this and delete data or block people from their accounts to maximise the damage they cause.

Damage to your reputation

Your customers and partners trust you with their business and often with their data. Any type of issue like a hacked website, unavailable service, etc. can negatively impact this trust relationship.

Especially for public facing ressources like your website or social media channel, a hack can damage the reputation you and your team have worked really hard to build.

Potential legal consequences

Even in industries that traditionally have not been regulated, increased regulation mean to hold companies accountable for the data they hold about their employees and customers has been put in place in most regions.

Regulatory frameworks such as GDPR (General Data Protection Regulation) or NIS2 (Network and Information Security Directive) put pressure on more companies to take the protection of their systems holding employee and customer data more serious.

Some attacks can be fatal for a business

73% of small businesses are expected no to be able to recover from a ransomeware-attack, where most or all of their data has been made unavailable.

While it’s likely that recovering from a data-loss can be managed by working extra hours, sometimes the consequences are more significant. Imagine an accountant loosing all of their customers data they have prepared during tax-season. Or a web-designer having all their customers websites wiped out.

In 2021, victims of compromised personal and business email account experienced a loss of $1.86 Billion (Source: FBI)

Targeted Attacks

These are the attacks we mostly read about in the News. Attacks that are performed to compromise a specific individual or organisation. While these attacks happen and need to be taken seriously, they make up a small percentage of the criminal efforts online.

Targeted Attacks don’t necessarily have to be technically more sophisticated. One of their main traits is that they are aimed at a more clearly defined (group of) victims. For the attacker this means that they can use an approach that is more tailored to the victim they have laid eyes on. This often leads to a higher success rate for an attack to be successful.

The measures of protection provided in our program lay a strong foundation to make targeted attacks less likely to succeed. However if you feel that someone is specifically targeting you or your company, please get in touch and we can provide some more specific ressources. Especially if the suspected attacker is in physical proximity of their target, the mitigation methods might change in some ways.

Non-Targeted attacks

More than 99% of activity performed by cyber-criminals can be considered as non-targeted. Sometimes they’re also called “spray-and-pray-attacks” indicating the attackers opportunistic approach of attempting large numbers of repetitive attacks onto a large set of potential victims.

This type of attacks is why everyone is at risk of being impacted by a cyber-security incident. They are cheap to perform on a broad number of accounts or systems.

For the attacker the economic viability comes from reaching a large enough set of targets and come out with a percentage of these attacks being successful. The cheaper the attack is, the smaller said percentage can be.

It’s important not to underestimate the sophistication of these attacks. These attackers count on the generally low utilisation of commonly available protection mechanisms such as Two-Factor Authentication.

Phishing

Phishing attacks are simultaneously the most known and underrated type of Online-Attacks. A phishing attack describes the attempt of an attacker to gain access to information required to access someone else’s account.

Most of us have seen these types of attacks in the form of an email impersonating a person or company we know and linking us to a malicious page where we’re expected to enter username and password and other information.

While this attack method has a bad reputation of using e-mails with spelling mistakes and other easy to spot signals, it is still one of the most effective tools attackers use. It is assumed that more than 80% of successful cyber-attack include some element of phishing.