It seemed like just another ordinary day for a small online retailer in the Midwest. Little did they know that the simple click of an e-mail link was about to threaten the entire business. One of the company’s employees received an e-mail with a link to a seemingly benign catalog. One click and the company’s system was infected with Crytowall malware that affected accounting software, customer account files, including credit card numbers, social security numbers, customer names and addresses among other information.
The accounting software and customer files did not live on the employee’s computer; it lived on the company’s network drive, so the malware was able to encrypt 15,000 accounting and customer files. A ransom demand soon followed, demanding $50,000 in exchange for a decryption key. The company’s backup systems had not been working for months, and with the virus proving impossible to remove without the loss of crucial company data, the company had no choice but to pay up.
But the decryption key didn’t work. Business came to a standstill. The owner could not afford to pay to rebuild the network systems. Six months later the company closed its doors, strangled by lack of sales and cashflow.
The U.S’ National Cyber Security Alliance found that 60 percent of small companies are unable to sustain their businesses over six months after a cyber attack. According to the Ponemon Institute, the average price for small businesses to clean up after their businesses have been hacked stands at $690,000; and, for middle market companies, it’s over $1 million.
Recent events have proven that nobody is safe from the threat of cybercrime – not large corporations, small businesses, startups, government agencies or even presidential candidates.
Small and mid-sized businesses are hit by 62 percent of all cyber-attacks, about 4,000 per day, according to IBM. Cybercriminals target small businesses because they are an easy, soft target to penetrate. They steal information to rob bank accounts via wire transfers; steal customers’ personal identity information; file for fraudulent tax refunds; and, commit health insurance or Medicare fraud.
So what can you do besides pray and hope you’re not next?
Remember, most cyber breaches happen because an employee does something that they aren’t supposed to do. Basic training can stop a majority of low-level threats. But, coaching your employees on data protection is not enough. Business owners must establish data security protocols, policies, practices and procedure that every employee takes seriously.
Create a business continuity and incident response plan. This will be put into effect immediately once you know your systems have been compromised.
Keep security software current. Having the latest security software, web browser and operating systems are the best defenses against viruses, malware and other online threats.
When in doubt, delete it. Links in e-mails, tweets, posts and online advertising are often how cybercriminals try to steal information. Even if you know the source, if something looks suspicious, delete it.
Protect all devices that connect to the Internet. Along with computers, smartphones, tablets, and other web-enabled devices need to be protected from viruses and malware.
Plug and scan. USBs and other external devices can be infected by viruses and malware. Use your security software to scan them.
Consider cyber insurance. While premiums continue to rise, the cost of the insurance will look small in comparison to the cost of experts and consultants to restore your systems — or the cost going out of business.
Expand beyond IT. Don’t delegate cyber-crime prevention solely to your IT department and tell them “get on with it.” Embed these practices across all areas of your business.
Encrypt your most sensitive files. Encrypting data is a process of converting data into a form, where it becomes unintelligible to any person without access to a key/password to decrypt the data.
Encryption may be hardware or software based. Hardware encryption and decryption processes are executed by a dedicated processor on the hardware encrypted device. In software encryption, the resources of the device on which the software is installed are used to encrypt and decrypt the data.
Robert Fleming, founder and president of Blacksquare Technologies, a Denver manufacturer of the Enigma hardware encryption device, said hardware encryption is faster. “The cryptographic key is stored in a separate, inaccessible portion of memory storage or stored off site, thus making it more secure than software encryption. Even if a company is hacked, and the bad guys capture your files, they cannot open any files that are encrypted”.
Websites hacked. Corporate data leaked. Identities stolen. The threats are real and growing. Small business owners have to assume they will be victims of cybercriminals since 75 percent of all organizations have experienced a data/cyber security breach in the past 12 months and 82 percent of all Social Security numbers have been hacked more than once. Cybercrime is now the world’s largest business running in the trillions of dollars. So far the “bad guys” are winning.
So business owners need to do more than hope and pray that their businesses won’t be next.
