Based on the nature of our work at CSID, we get the opportunity to see a lot of security trends as they are taking shape, including types of malware and breaches - all often in real time. The trend we've been seeing as of late is cyber criminals targeting small businesses (SMBs). This renewed focus does not surprise me. SMBs tend to have limited time and resources to devote to security, especially compared to enterprise businesses. Yet SMBs have a lot of the same valuable information that larger businesses have -- customer credit card numbers and employee email addresses and passwords to name a few. There is also a growing perception of SMBs as the "weak link" in the security of larger companies. Last year's massive Target breach is a great example of this. Cyber criminals were able to access Target's Point of Sale system through a series of maneuvers starting with a small HVAC company with which the enterprise business contracted. Not only do SMBs need to be more aware of how to stay secure, but enterprise companies should also pay close attention to the security of their SMB partners.
What SMB owners need to take away from these observations is that cyber threats are not going anywhere. As a matter of fact, they are escalating. Symantec's most recent Internet Threat Intelligence Report found that SMBs saw the largest increase in targeted attacks in 2013. SMBs accounted for 30 percent of all targeted attacks last year.
As a SMB, there are a few main basics you need to focus on to protect your business:
-Educate your employees. Let them know what data needs to be protected and teach them best practices for keeping this data safe and avoiding accidental exposure. Educate them on the basics like smart password habits, how to identify a potential phishing scheme and how to secure sensitive company data saved on personal devices.
-Know what data needs protection and then protect it. Look at where this sensitive information is being stored and used and protect these areas accordingly. Always remember to encrypt sensitive data. Also, look beyond your internal systems to the third-party vendors you use. Only use vendors that make security a priority. This ensures your data is protected from all angles.
-Let software and services help. Explore technologies that can protect against or mitigate the risk of data breach exposure such as anti-virus software or identity and data monitoring services. These services can help avoid breaches or help business owners react quickly in the event of a breach.
One data breach could mean financial ruin for a SMB, so it is important to react quickly in case of a breach. If your business has been breached, here's what to do:
-Quickly and clearly communicate breach details to affected parties. Provide details of what you have done to mitigate further exposure of data, as well as future exposures in general. Do not cover or hide any details about the breach. This may harm your business' reputation and irritate affected parties.
-Consider providing complimentary identity protection services to those impacted by your breach. This will show customers that you are taking the breach seriously and protecting them from additional data loss due to the business' breach. Depending on what state you live in and the nature of the breach, providing an identity protection service may be mandatory.
-Revisit your business' security practices. Figure out the source of the breach and make sure you address the security issues that allowed it to happen. Check all security software to make sure it is up to date and revisit employee education programs to ensure they understand security best practices.
It is difficult to address the full scope of SMB security in a short article, so we are hosting a webinar with Symantec and The Securitists' Byron Acohido on June 10 to dig deeper into this topic. It will be an interesting conversation that addresses the security risks and solutions for all stages of SMB growth. For more information or to attend the webinar, visit the webinar registration page.