<div><em><strong>Tarun Kaura</strong> on what SMBs should look into this Information Security Day</em><br><br><br>Last year saw a record number of headlines made by data breaches and targeted attacks, driving home the impact cyber-attacks have on enterprises today. We witnessed some of the biggest names in the industry, including financial institutions, retail chains and large media companies at the receiving end of large-scale data breaches - indicating that with the growing digitization, there are now more avenues for cybercriminals to attack critical data. While the big names continue to grab headlines, when thinking about small and medium-sized businesses, what cybercrime threats are they facing?</div><div> </div><div>A recent report from Nasscom revealed that increasingly the small and medium businesses in India are using newer technologies. While, small businesses benefit greatly by using the latest technologies that aim to improve operational efficiency and innovation, in the process they could end up opening doors to a host of unsolicited activities resulting in loss of data, identities and intellectual property and in some cases pawns in larger plot to target large enterprises. According to Symantec’s Internet Security Threat Report (ISTR) Vol. 20 - Small- and medium-sized businesses in India also saw an uptick in attacks, with 34 percent of targeted attacks in 2014 aimed at them. These businesses also received twice as many phishing and virus-bearing mails compared to large corporations reiterating that almost no company, whether large or small, is immune from cyber attacks. </div><div> </div><div>One of the most common threats that are faced by organisations today are targeted attacks. These include spear-phishing emails, exploit of unpatched systems or software and crypto-ransomware attacks. This World Information Security Day 2015, let us specifically focus on security challenges faced by small and medium-sized businesses (SMBs) who often lack awareness and have fewer resources to invest in security. This opens up big avenues for cybercriminals, putting businesses and their partners at higher risk. </div><div> </div><div><strong>Sophisticated Attack Methods</strong></div><div>The SMB business owners need to be aware of spear-phishing, or an email spoofing fraud attempt that will target a specific organisation. It is one of the most lethal ways that a hacker can compromise a small business, or any business for that matter. In addition to spear-phishing, another common incursion method is to exploit unpatched systems and software. Unpatched systems provide a popular means for hackers to penetrate businesses’ networks and then potentially expose sensitive customer information. The outcomes of an attack, particularly the exposure of vendor and customer information can have serious impacts on a businesses’ reputation.<br> </div><div>Another growing trend is ransomware. In 2014, India ranked third highest in the Asia Pacific region for ransomware attacks with over 60,000 attacks received per year or about 7 attacks per hour. Of these, 86 percent were crypto-ransomware. These attacks are a type of digital extortion that encrypt data and demand a ransom in return. Not only does this put huge strain on small businesses operations, but it increases the risk of data and file loss. Smaller companies that do not invest in to back-up solutions are forced to pay the ransom to restore operations. The ransom instructions usually include the purchase of non-traceable currency like Bitcoin or MoneyPak and, in many cases, payment of the ransom does not result in the return of data.<br> </div><div><strong>How business owners can determine their vulnerability to cybercrime threats</strong><br>Firstly, business owners need to recognize that it isn’t just the large organisations that are targeted. In most cases, large organisations have dedicated resources for cybersecurity, making them much harder and more complicated targets. But in determining vulnerabilities, small businesses should assess the security measures they already have in place. For example, by conducting an audit, business owners can determine what information they host, what points of weakness exist and where they need to invest more security support. Items that are on this security checklist should include employee device use behavior, information storage locations and online payment practices. Once aware of current security practices, business owners should then develop a plan with a security consultant or vendor to fortify their security and better protect their business, their staff and their customers.<br> </div><div><strong>Best suited approach for SMBs: </strong></div><div><span style="color:#ff0000;">Multilayered security:</span> Today’s advanced threats call for multi-layered protection that goes beyond just basic anti-virus.</div><div>Keep it updated: Small business owners should take the time to update operating systems on an ongoing basis. This will protect against recently discovered vulnerabilities, as well as unexpected attacks. Businesses should also keep an eye on who has access to sensitive data and update authorisations to reflect staffing changes.<br> </div><div><span style="color:#ff0000;">Embrace mobility: </span>Mobile devices are becoming a cornerstone of the enterprise, and securing mobile devices such as tablets and smartphones to secure corporate data should be a priority. Consider limiting unnecessary mobile access to customer information and keep an eye on who has permission to access data.<br> </div><div><span style="color:#ff0000;">Train your staff: </span>Many owners underestimate the damage a single, untrained employee can do to a business. So, business owners should clearly define expectations for how employees will handle customer data, from requiring password use to maintaining up-to-date security software on all devices. Additionally, train employees to recognise phishing schemes and understand the dangers of downloading software and apps from unknown sources.<br> </div><div><span style="color:#ff0000;">Talk to third-party vendors</span>: Business owners should ask about how vendors are protecting their information and look for ways to limit unnecessary vendor access to sensitive information. Norton Small Business is specifically designed to make it easy for business owners to provide quality protection to a contractor or vendor while they work on a project and then revoke that protection when the job is done.</div><div>The biggest mistakes small and medium-sized businesses make in this area, and how they can avoid them- Awareness. They may not think about the implications of hosting sensitive customer data when they purchase a product or service online, or when they create profiles online to use a website. Similarly, they often have to cut certain items from their business plan due to restrictive budgets, and sometimes the owner may let cybersecurity fall by the wayside. Protecting your business from data breaches is not free, but falling victim to an attack is far more expensive than proactive protection.</div><div> </div><div>Also, while the right security can offer a high degree of protection, one mistake many businesses make is choosing a security software package or hardware device without first performing a gap analysis to identify the threats they need to mitigate. A thorough analysis can help businesses get the protection they need along with the best return on their cybersecurity investment.</div><div> </div><div><strong>The author, Tarun Kaura, is Director, Technology Sales, India, Symantec</strong></div>
