Cybersecurity for small businesses: How to stay protected in a digital-first world

Do you leave the doors of your business unlocked when you close for the evening? Of course not. But what about your digital doors?

Rapid digitization during the pandemic has been a good thing for small businesses looking to diversify and add more sustainable revenue channels—but it also comes with potential risks. Thankfully, there are simple, powerful strategies that businesses can use to achieve peace of mind in the digital era.

Since the digital side of your business runs 24/7, applying simple cybersecurity strategies to your small business’s online activity is the digital equivalent to locking up shop. Cybercriminals are opportunistic, so as long as you don’t “leave the door open” for them, you’ve vastly reduced any risks from the get-go.

Whether you’re a growing retailer delving into e-commerce for the first time, a small restaurant ramping up online delivery, or something else entirely, the internet can potentially open doors for wrongdoers looking to capitalize on vulnerable small businesses. Don’t be alarmed. Digital transformation makes cybersecurity for small businesses a priority, and there are fool-proof ways to make sure your business stays safe.

An example of a (obvious) phishing email attempt.

Be on the lookout for these typical phishing email characteristics:

• Ambiguous greetings (“Dear Customer,” “Dear Valued Member,” etc.). Legitimate businesses that are worth your time will address you by your name or that of your business specifically.
• Suspicious email domains. If the tail end of the sender's email isn’t the same as the actual business website, beware.
• Upfront requests for personal information. Data protection is huge nowadays, and responsible businesses know this. Don’t provide personal info without due diligence.
  
  

Malware 

The next common type of cyberattack comes in the form of malware—“malicious software” intended to cause data breaches and expose system weaknesses. Malware infections are commonly referred to as “viruses,” but this isn’t exactly correct in that “virus” only applies to the most severe autonomous malware infections. This makes viruses particularly difficult to clean up—but thankfully, more common malware is easier to detect and remove using over-the-counter cybersecurity software.

A business is at risk when files containing malware are downloaded, unbeknownst to the user, that then disrupt internal systems. Extensive malware infections have been widely publicized in the past few decades, with the most recent and notorious being “CovidLock,” which installs itself through files that promise to provide useful information related to the pandemic.

An attempt to play on COVID fears to initiate the download of malware.

Commonly known types of malware are:

• Trojans: Just as the Trojan horse was assumed to be a peace offering and welcomed within the city walls during the Trojan War, Trojan malware disguises itself as something helpful (a virus scan, threat warning, etc.) to get users to run the malicious program. Trojans usually come via email or pop-up and, once executed, can give the hacker control of the computer remotely. 
  
  
• Ransomware: The rise of cryptocurrency and digital payments has seen ransomware become a more common cyber threat. Ransomware essentially holds a system, network or data hostage until certain demands—almost certainly a sizable monetary transfer—are met. Sometimes, cybercriminals will disappear into thin air without releasing the encryption, as was the case with an unlucky small Midwest retailer back in 2016.
  
  
• Spyware: Spyware is used to observe and record actions on a computer, like internet usage data or keystrokes of passwords that can then be used to access private accounts and intellectual property. Spyware is the easiest to detect and remove but is still concerning as it uses the same vulnerabilities as more serious cyber threats use to get inside.
  

Insider attacks

The final common type of cyberattack is one that’s a sad reality for upstanding businesses—an insider attack. As the name suggests, it involves someone on the inside causing exposure to sensitive information and data. 

Insider attacks affect cybersecurity for small businesses and large corporations alike—Tesla, for example, fell victim to an attack in 2018 where an insider caused, as CEO Elon Musk put it, “quite extensive and damaging sabotage ... direct code changes to the Tesla Manufacturing Operating System ... and exporting large amounts of highly sensitive Tesla data to unknown third parties.” 

Insider attacks are best prevented through employee training initiatives and airtight security protocols. More on this later.

We’ve listed some of the most well-known cyber threats, but it’s still worth doing your own research on advanced persistent threats, password attacks, man-in-the-middle attacks, and more to give you more confidence in securing your small business.

There is a lot at stake when it comes to cybersecurity for small businesses. So, understanding the consequences of cyberattacks is equally important as being knowledgeable about the threats themselves.

No small business deserves to have their hard work sabotaged—you want to make sure security is in check, so you can focus on growth. Rest assured, taking action against cyber threats will allow you to avoid these potential negative effects:

• Digital destruction: If the digital aspects of your business are compromised, it can leave your internal software and databases unusable, virtually affecting everything you do.
  
  
• Business disruption: Modern businesses rely on internal networks and computers for every business function, so if they become inaccessible due to a cyberattack, work can come to a halt from “point-of-sale checkout to inventory management to payroll.”
  
  
• Reputation damage: Notifying customers and users of data breaches can be intimidating, but handling it irresponsibly is even worse. Take the Facebook data breach affecting over half a billion users that recently came to light—the global social media platform decided against reporting the breach in 2019 and is now facing scrutiny. 
  
  
• Financial liability: Businesses that remain compliant with cybersecurity regulations are safer, but being unaware of such regulations can leave your business financially liable for breaches.

There are a few absolute necessities to get you started on securing your small business from cyber threats.

Secure your networks.

Wi-Fi is everywhere nowadays, and it’s the first place to look when ensuring your business is cyber secure: “Network security strategies are all about preventing unauthorized use and misuse of your computer network—in other words, the devices and data controlled by your network administrator.”

Make sure to use strong passwords to keep your networks private, and use separate networks for important business activities and other uses (IoT, public access, etc.). In 2017, hackers managed to funnel 10 gigabytes of sensitive data out of an American casino by accessing a network-connected smart fish tank control device. This is a cautionary tale for keeping a lock on private networks and being aware of any devices that could be compromised.

Back up your data constantly.

Data backups are fundamental to cybersecurity for small businesses. Not only will they safeguard your business from malicious demands from ransomware, but you will also be protected in the case of force majeure or events like data corruption or physical damage. 

Keeping multiple backups is ideal. Cloud storage is seamless and convenient but still liable to be breached by cybercriminals. Make sure you’re regularly backing up important data physically—on a separate, offline hard drive—to be 100 percent certain you have that information on hand if something goes wrong.

Keep everything up to date.

Software patches prioritize security improvements, as developers recognize that cyber threats are continuously evolving. Just as biological viruses can mutate and cause problematic infections among humans beings, outdated software won’t have the “immunities” needed to protect from new malicious software or hackers.

Keeping all software up to date is important not only to protect from cyber threats but also to avoid service interruptions and bugs and to keep your business running smoothly.