Cybersecurity is a threat to all businesses, but small businesses are especially in danger of becoming targets for cyber crimes.
There are a lot of reasons for this, but the most common are a lack of time or budget to dedicate to more robust security practices as well as user error.
In this post, I examine why small businesses are targets for cybersecurity threats, what threats small businesses face and what businesses can do to protect themselves.
Why Cyber Criminals Target Small Businesses
A lot of people assume only big businesses get hit with cybersecurity attacks. After all, that’s where the money is, right?
But think about it from a cyber criminal’s perspective: why spend a lot of time and effort trying to breach a large business’ data when you can breach several smaller business’ systems with much simpler tactics?
This is what it all boils down to. The reason smaller businesses are targets for cyber crimes is because their security practices aren’t as firm, and cyber criminals know this.
These are common reasons why small businesses become targets for cybersecurity threats:
- Weak security practices
- Weak passwords
- Lack of dedicated work devices
- Lack of encryption
- Lack of two-factor authentication
- Security flaws in supply chains
- Unmonitored app allowances
- Incorrect user access settings
- Weak fallout plan
1. Weak Security Practices
Because small businesses work with tight budgets and only have enough time to manage business-related tasks, they often ignore other tasks as a way to save time and money.
Unfortunately, tasks that rely on strong security practices are often ignored.
Business owners get scammed by phishing attempts while trying to get through business emails quickly as a result. They don’t monitor login records or set up alerts for unauthorized actions, so they wind up becoming victims of credit card fraud and account takeovers.
Some might even log into all of their personal and business accounts on one device in order to save money on tech.
By having no protocol for how certain things are handled, a lot of small businesses allow themselves to become targets for common threats that are pretty easy to thwart when proper security practices are used.
Even worse, because their security practices are so weak, business owners likely have no idea a hack is occurring until a lot of damage has been done.
2. Weak Passwords
Have you ever heard someone say “I’ve never had an original experience” as a reaction to a social media post?
As unique as a lot of us think we are, the truth is we all share similar thinking patterns and behave in similar ways, even without talking with one another.
It’s these thinking patterns that make our passwords so easy to crack.
For starters, a lot of internet users use the same insecure passwords, such as “123456789” or “QWERTY”.
In a similar vein, hackers are well aware of the techniques a lot of us use to create memorable passwords. They apply these techniques when they try to crack our passwords.
By doing a bit of internet sleuthing and applying common password techniques to brute force login attempts and programs that use machine-learning to guess passwords automatically, they’re able to crack passwords in little to no time at all.
So, when business owners fail to use strong passwords, they put their accounts at risk of being compromised.
3. Lack of Dedicated Work Devices
A lot of small businesses, especially businesses run by a single person, do not put a lot of investment into technology.
They use their own personal devices to handle everything related to their work and personal lives.
While it’s entirely possible (and quite common) for work devices to be hacked, it’s much more likely to occur when you double the number of accounts that use your devices.
Your personal email and private messaging accounts are much more likely to receive phishing emails. Plus, your personal browsing practices likely involve visiting websites you’d never visit on a work device.
Once again, by not investing into the security of their businesses, small business owners put their entire infrastructure at risk.
This especially includes businesses who allow employees to use their own devices.
4. Lack of Encryption
Another security practice that gets overlooked by small businesses is encryption.
There are a lot of reasons why a small business owner might not worry about encryption outside of budget.
Maybe they think their business is too small to target. That cyber criminals likely wouldn’t find a lot of value in targeting a business that brings in such a small amount of revenue.
Maybe the business owner thinks their files aren’t important enough to encrypt.
Whatever the case may be, by not encrypting your data, you run the risk of having your files become compromised in data breaches, which can lead to unintended consequences for you, your employees and your customers.
Certain files might include your full name, address, payment information and even things like your social security number (such as tax documents).
Certain files may even have your customers’ personal details on them.
5. Lack of Two-Factor Authentication
Using strong passwords is the easiest way to secure your accounts, but it shouldn’t be the only way.
Two-factor authentication (2FA) is the practice of securing your account with a second login protocol, such as a text message sent to your phone number, that must be completed before you’re allowed access to your account.
In this case, if a hacker gains access to your password, they’ll also need to have access to your text messages in order to fully log into your account.
Without 2FA, business owners are at risk of having their accounts become compromised if hackers are able to crack their passwords.
6. Security Flaws in Your Supply Chain
Yet another instance where small businesses are likely to sacrifice security in favor of saving money.
Your supply chain involves any product or service you rely on to run your business.
The businesses that sell products and services to you collect your email address, name, payment information, address and sometimes more.
Any information you give to them is at risk of being compromised if their own security practices aren’t up to par.
7. Unmonitored App Allowances
This is similar to the last point.
When you connect an app to your website or another app you use, you have to give that app permission to access your information.
Secure apps will give you a list of everything they’ll have access to before you authorize the allowance.
This is all fine, so long as you only authorize apps that have decent reputations.
The problem is that small businesses are more likely to forget to monitor the apps they’ve given authorization to, including apps they no longer use.
If a hacker gains control of one of these apps, they’ll have access to any data the app has access to.
8. Incorrect User Access Settings
User access controls and permissions are very useful in an age of business where most things are handled through an app.
They allow you to restrict important account-changing settings to administrative employees, ensuring employees and contractors only have access to the features they need.
Small businesses who don’t know about these types of settings or are careless are at risk of having their entire infrastructure grounded to a halt by a single action, whether the employee or contractor performed that action maliciously or accidentally.
9. Weak Action Plan
If your website went offline within the next hour, how would you react? If you could no longer log into your accounts or your computer was locked down and displayed a ransom message instead, what would you do?
Having bad security practices is bad enough. It’s just as bad to have a weak action plan in the event your business does become compromised.
Related: What to Do When You Get a Notice Your Data was Breached
What Cybersecurity Threats are Harming Small Businesses?
- Phishing attacks
- Ransomware
- Malware
- Data breaches
- SIM swapping and port-out fraud
- AI and deepfake technology
- DDoS attacks
Related: 5 Common Security Threats and How to Avoid Them
How to Protect Your Business from Cybersecurity Threats
Cybersecurity is very important and should be taken seriously, no matter how small your business is.
According to a survey conducted by Mastercard, 46% of small and medium-sized businesses have experienced at least one cybersecurity attack.
The survey went on to report that 1 in 5 of these businesses had to file for bankruptcy as a result of the attack.
80% of businesses that experience a cybersecurity attack wind up spending a lot of time rebuilding trust with customers and business partners.
Here are a few methods you can use to protect your business from these types of attacks:
- Use stronger passwords created with a password generator
- Store passwords in a password manager
- Use two-factor authentication
- Purchase wireless service from a reputable carrier
- Use a dedicated work device
- Keep work devices up to date and malware free
- Lock access to key features to administrative employees
- Improve account monitoring, especially by enabling notifications, such as log in notifications and transaction notifications for credit cards
- Improve third-party access monitoring
- Learn how to recognize phishing attempts
- Invest in partners who use encryption, especially data partners
- Avoid using public Wi-Fi
- Use a VPN if you have to use public Wi-Fi
- Train employees in cybersecurity
- Conduct cybersecurity assessments regularly
- Develop a better action plan
According to Mastercard’s survey, 86% of small and medium-sized businesses have conducted a security assessment, but only 23% are satisfied with their security plan.
Only 23% are confident that they’d be able to recognize threats, and a whopping 73% say they find it difficult to get employees to take cybersecurity seriously.
