Top Threats to Small Businesses in 2016 and Beyond

Small businesses are the new hot target for those in cybercrime. In 2015, according to Symantec, 43% of cyber-attacks were against small to medium sized businesses. Experts don’t expect that figure to decrease in 2016 with the cybercrime industry growing to $600 billion a year.

Small companies generally don’t have the financial or human resources to devote to a strong cyber security strategy. In addition, the clients of these businesses are attractive to cybercriminals; often these smaller organizations have direct links into the networks of government and larger corporations. There are five threats to watch in the remainder of 2016 and into 2017. They are listed in no particular order because they pose essentially equal threats to these organizations.

1. Data Aggregation

This has been happening more often lately. While the data from one location of a restaurant chain, for example, may not be that valuable on the black market, aggregating information from various attacks increases that value. This happened in the P.F. Chang breach back in 2014. Attacks have hit Trump Hotels, Omni, Starwood, and more recently, HEI Hotels & Resorts, which manages Marriott and Hyatt properties among others. All of these were hit at the point-of-sale (POS) systems, which need to be updated like other equipment.

2. Unpatched Known Vulnerabilities

Often, smaller companies utilize open-source software because it’s less expensive. Unfortunately, hackers take advantage of known vulnerabilities in the code and can bypass security measures that are in place. In addition, most IT personnel are stretched beyond limits, so patching systems often gets put lower on the priority list. However, by leaving these holes open, it can cause a lot more damage later. The heartbleed bug found in OpenSSL is an example of this and caught out tens of thousands of organizations worldwide by allowing attackers to monitor information that was passed between web services and users. Having a patch program in place is important. When a critical or security-related patch or update is released, it should be applied right away to all systems.

3. Phishing = Malware

It’s everywhere and can wreak a lot of havoc. It can get installed without a user even knowing and lurk in the background for years stealing information off the network. Most often malware is unleashed by a user who falls victim to phishing. It can be a costly mistake. Ransomware is becoming more common as well.  To avoid this, put a good training program in place teaching anyone who is on the company network how to identify phishing. In addition, keep good backups of all important files. Depending on the sensitivity, this may mean every night or in the case of a hospital, perhaps hourly is appropriate. Hollywood Presbyterian Medical Center paid to get the decryption key when it’s network was held ransom. In April, a non-profit that runs 10 hospitals in the Baltimore-Washington area paid about $18,500 to get its files back.  A good backup would likely have allowed both these organizations to avoid paying at all.

4. Cloud Computing

Cloud locations are becoming a hit by the cyber crime community. That is because many companies are storing their data on these servers. This is a lot of information in a single place that can net a cyber thief a good chunk of change. It’s important when making decisions related to cloud computing that they are well thought-out. Doing good research into the best options for your organization may be the difference between safe and sorry.

5. Mobile Security

Nearly everyone has some type of mobile device by now. Because of this, the threats to them are on the rise. Last year, researchers found a flaw in Samsung Galaxy phones predictive text functionality that hackers were exploiting using public WiFi and spying on users. It has since been fixed, but it demonstrates how vulnerable these devices can be. It’s always important to apply updates to mobile devices as soon as they are released and use care when using them on public WiFi. If you connect at your favorite café, avoid performing tasks such as banking transactions until you can get to a place where you know the connection is safe.

These trends are likely to continue on an upward trajectory. According to security company Blue Coat, a single data breach can cost a company $5.4 million. Taking a little bit of time to talk to security experts to determine what is best for your environment and putting good practices in place will go a long way in ensuring your small business is not the next victim of any of these types of cybercrime.