As small business owners grapple with issues like inflation and economic uncertainty, it can be easy to lose sight of another important challenge that could potentially ruin your business: cyberattacks.
Data released from the 2023 Internet Crime Report, the latest figures released by the FBI’s Internet Crime Complaint Center (IC3), reveals that the total number of cyberattack complaints within the U.S. alone reached 880,418 — a 10% increase compared to the previous year.
While business owners and executives may prioritize day-to-day operations and long-term growth plans, it’s also critical to make room on the agenda for cybersecurity given that both the likelihood and severity of attacks has increased in recent years for SMBs.
Why are small businesses at risk?
For many small business owners, the biggest risk factor may be in not realizing the risk they face! Over the last few years, awareness of and concerns for cyber attacks have been increasing. That said, there is still a large number of small businesses that don’t place cyber threats as a top concern, either because they aren’t aware of the threats themselves, or they feel they can resolve an attack themselves.
It is precisely this false sense of security and confidence that cybercriminals have learned to exploit. Companies that do not perceive a risk do not take the necessary steps to protect themselves — and that’s why SMBs are at particular risk of being the victim of a cyberattack.
Many small businesses may still fall into the trap of thinking that their organization isn’t large enough or high-profile enough to be the target for attackers. But the fact of the matter is that they have become an easy mark since many do not have advanced tools to defend the business, but they do have what hackers are after: data.
SMBs need to realize that cyberattacks usually aren’t personal to the hacker. They often don’t differentiate between stealing from small and large companies. At the end of the day, they are looking for data — like payment details, personal data, health information or anything at all that could be sold on the dark web or used to advance a more sophisticated attack.
Because many small organizations do not perceive their risk, they may not have taken critical steps to protect their assets and operations, like using encryption for all transactions or backing up files in a secure database. This makes it easier for cybercriminals to carry out their attack plan and maximize disruption once it is underway.
Further, because many attacks on small businesses do not garner national or global attention — or, in some cases, may not require immediate reporting to relevant agencies or customers — so many attacks fly under the metaphorical radar, allowing hackers to use the same tactics over and over at different companies without detection.
Fast-growing smaller organizations are at particularly high risk, since security can be difficult to maintain or enhance during periods of rapid growth. Further, as the organization adds more employees and customers and expands the network and digital footprint to serve the business, so too does the company’s risk profile grow.
In the end, the organization most at risk is any organization — of any size in any sector — that does not take the necessary steps to protect itself. Thankfully, SMBs have the opportunity to improve their defenses. In today’s market, many reputable and knowledgeable cybersecurity vendors have adapted their product packages and pricing models to meet the needs and budgets of SMBs.
What attacks are most common?
While cybercriminals leverage a variety of attack techniques and methods, some of the most common attacks include:
Malware — short for malicious software — is any program or code that is created with the intent to do harm to a computer, network or server. In malware attacks, hackers can employ phishing techniques to prompt users, including employees and customers, to hand over sensitive information, such as account credentials, which can be used to advance the attack or launch a new one.
Ransomware is a type of malware that denies legitimate users access to their system and requires a payment, or ransom, to regain access. Once a system is infected, the hacker either blocks user access to the device or system, or encrypts files, making them virtually useless to the owner.
Phishing is a type of cyberattack that uses email, SMS, phone or social media to entice a victim to share sensitive information — such as passwords or account numbers — or to download a malicious file that will install malware on their computer or phone.
A man-in-the-middle (MITM) attack is a type of cyberattack in which a malicious actor eavesdrops on a conversation between a network user and a web application. The goal of a MITM attack is to surreptitiously collect information, such as personal data, passwords or banking details, and/or to impersonate one party to solicit additional information or spur action.
A denial-of-service (DoS) attack is a malicious, targeted attack that floods a network with false requests in order to disrupt business operations. In a DoS attack, users are unable to perform routine and necessary tasks, such as accessing email, websites, online accounts or other resources that are operated by a compromised computer or network.
7 Common Types of Cyber Vulnerabilities
When reviewing your company’s cybersecurity posture and approach, it’s important to realize that cybersecurity vulnerabilities are within the control of the organization — not the cybercriminal. This is one aspect of the cybersecurity landscape that enterprises can proactively address and manage by taking the appropriate action and employing the proper tools, processes and procedures.
Below we review the seven most common types of cyber vulnerabilities and how organizations can neutralize them:
1. Misconfigurations: Misconfigurations are the single largest threat to both cloud and app security. Because many application security tools require manual configuration, this process can be rife with errors and take considerable time to manage and update.In recent years, numerous publicly reported breaches started with misconfigured S3 buckets that were used as the entry point. These errors transform cloud workloads into obvious targets that can be easily discovered with a simple web crawler. The absence of perimeter security within the cloud further compounds the risk associated with misconfigurations. To that end, it is important for organizations to adopt security tooling and technologies and automate the configuration process and reduce the risk of human error within the IT environment.
2. Unsecured APIs: Another common security vulnerability is unsecured application programming interfaces (APIs). APIs provide a digital interface that enables applications or components of applications to communicate with each other over the internet or via a private network. APIs are one of the few organizational assets with a public IP address. If not properly and adequately secured, they can become an easy target for attackers to breach. As with misconfigurations, securing APIs is a process prone to human error. While rarely malicious, IT teams may simply be unaware of the unique security risk this asset possesses and rely on standard security controls. Conducting a security awareness training to educate teams on security best practices specific to the cloud — such as how to store secrets, how to rotate keys and how to practice good IT hygiene during software development — is critical in the cloud, just as in a traditional environment.
3. Outdated or Unpatched Software: Software vendors periodically release application updates to either add new features and functionalities or patch known cybersecurity vulnerabilities. Unpatched or outdated software often make for an easy target for advanced cybercriminals. As with system misconfigurations, adversaries are on the prowl for such weaknesses that can be exploited. While software updates may contain valuable and important security measures, it is the responsibility of the organization to update their network and all endpoints. Unfortunately, because updates from different software applications can be released daily and IT teams are typically overburdened, it can be easy to fall behind on updates and patching, or miss a new release entirely. Failing to update even one machine can have potentially disastrous consequences for the organization, providing an attack path for ransomware, malware and a host of other security threats. To help address this issue, organizations should develop and implement a process for prioritizing software updates and patching. To the extent possible, the team should also automate this activity so as to ensure systems and endpoints are as up to date and secure as possible.
4. Zero-day Vulnerabilities: A zero-day vulnerability refers to a security flaw that has been discovered by a threat actor but is unknown to the enterprise and software vendor. The term “zero-day” is used because the software vendor was unaware of their software vulnerability, and they’ve had “0” days to work on a security patch or an update to fix the issue; meanwhile it is a known vulnerability to the attacker. Zero-day attacks are extremely dangerous for companies because they can be very difficult to detect. To effectively detect and mitigate zero-day attacks, a coordinated defense is needed — one that includes both prevention technology and a thorough response plan in the event of a cyberattack. Organizations can prepare for these stealthy and damaging events by deploying a complete endpoint security solution that combines technologies including next-gen antivirus (NGAV), endpoint detection and suppression (EDS) and threat intelligence.
5. Weak or Stolen User Credentials: Many users fail to create unique and strong passwords for each of their accounts. Reusing or recycling passwords and user IDs creates another potential avenue of exploitation for cybercriminals. Weak user credentials are most often exploited in brute force attacks when a threat actor tries to gain unauthorized access to sensitive data and systems by systematically trying as many combinations of usernames and guessed passwords as possible. If successful, the actor can enter the system and masquerade as the legitimate user; the adversary can use this time to move laterally, install back doors, gain knowledge about the system to use in future cyberattacks, and, of course, steal data. To address this particular cybersecurity vulnerability, organizations should set and enforce clear policies that require the use of strong, unique passwords and prompt users to change them regularly. Organizations should also consider implementing a multifactor authentication (MFA) policy, which requires more than one form of identification, such as both a password and a fingerprint or a password and a one-time security token, to authenticate the user.
6. Access Control or Unauthorized Access: Companies often grant employees more access and permissions than needed to perform their job functions. This increases identity-based threats and expands access to adversaries in the event of a data breach. To address this issue, organizations should implement the principle of least privilege (POLP), a computer security concept and practice that gives users limited access rights based on the tasks necessary to their job. POLP ensures only authorized users whose identity has been verified have the necessary permissions to execute jobs within certain systems, applications, data and other assets. POLP is widely considered to be one of the most effective practices for strengthening the organization’s cybersecurity posture, in that it allows organizations to control and monitor network and data access.
7. Misunderstanding the “Shared Responsibility Model” (i.e., Runtime Threats): Cloud networks adhere to what is known as the “shared responsibility model.” This means that much of the underlying infrastructure is secured by the cloud service provider. However, the organization is responsible for everything else, including the operating system, applications and data. Unfortunately, this point can be misunderstood, leading to the assumption that cloud workloads are fully protected by the cloud provider. This results in users unknowingly running workloads in a public cloud that are not fully protected, meaning adversaries can target the operating system and the applications to obtain access. Organizations that are using the cloud or shifting to a cloud or hybrid work environment must update their cybersecurity strategy and tooling to ensure they are protecting all areas of risk across all environments. Traditional security measures do not provide security in a cloud environment and must be supplemented to provide enhanced protection from cloud-based vulnerabilities and threats.
