Why Ransomware Hits Smaller Organizations Harder

/in , , , /by and

Ransomware and other cyberattacks seem to be more prevalent than in previous years. While the news has mostly focused on the large attacks (WannaCry, Petya, Netflix hack, etc), small businesses are not immune to these dangers. In fact, in a recent study performed by Symantec, it was discovered that phishing campaigns targeted small businesses 43% of the time, up 9% over 2014 and a dramatic increase from the 18% of attacks in 2011.1 While larger organizations are able to rebound, roughly 60% of small businesses that experience a cyberattack are closed within six months.2

The cost of a data breach

  • Lost Revenue. According to a report conducted in June by Osterman Research, roughly 22% of businesses with fewer than 1,000 employees experienced a ransomware attack in the last year and were forced to stop business operations immediately, resulting in 15% of those surveyed losing revenue.3
  • Downtime. When a ransomware attack occurs, many organizations are forced to shut down to stop the spread of the attack. As a result, they incur downtime. Of the organizations surveyed by Osterman Research, one in six organizations incurred 25 or more hours of downtime as a result of a cyberattack.3
  • Loss of Confidence. When a company admits to a data breach or customer data that was leaked, it causes many consumers to be wary of conducting business with the organization.

What causes a Small Organization to be a target?

The difference between larger vs. smaller organizations is that oftentimes the smaller organizations don’t always have the budget to be able to afford their own IT department.

“A survey published by Manta last month shows that 87 percent of small-business owners don’t feel that they’re at risk of a cybersecurity attack, and 1 in 3 small businesses don’t have the tools in place — firewalls, antivirus software, spam filters or data-encryption tools — to protect themselves.

“The general majority of small-business owners don’t have an IT person. It’s not the first place they spend their money,” said John Swanciger, CEO of Manta. “They’re really relying on themselves to update their software and check for security patches.”4

How can Small business owners limit their risk of an attack?

  • Perform software updates/patches. Their intended purpose is to quickly push out fixes to bugs that may be occurring and create a safe computer environment. When you browse the internet, your computer is at the mercy of its current protective measures. Viruses, malware and rootkits are always on the search for security holes to exploit and gain entry to your personal data. While the best antivirus software would prevent this from ever happening, in order to accomplish such a goal you need to perform recommended updates. These updates serve numerous functions:
    • Fix security holes
    • Optimize the utilization of resources on the operating system
    • Add newer and more secure features
    • Remove old and unprotected features
    • Update drivers to increase software efficiency
  • Regularly backup your data. To reduce downtime, make sure you perform regular backups that are easily retrievable in the event of a breach or data loss, providing a sense of security. Both offsite storage and external drive storage are potential necessities. Data backup and data recovery work basically the same way. Offsite servers are useful for data recovery as they provide massive amounts of storage for nominal prices especially when comparing the hassle it saves in the event of an information disaster. Having a safe place to put information off of the main business server can prove to be more proactive in the long run. Using an offsite server to protect your business data is one of the more effective methods to keep information safe.
  • Create strong passwords. Strong passwords reduce the likelihood that a criminal will be able to easily gain access to your data. But remember to change the password regularly. Passwords are undoubtedly essential to security, but they are not the only method that can or should be used to protect one’s computers and devices. In addition to creating a good password, people should learn how to safeguard it and use it wisely. This means never sharing it and, if unable to remember it, keeping the written copy in a secure location.
  • Protect your Wi-Fi. Wi-Fi can be an easy access point for potential cyber hackers. If you use a Wi-Fi network access in the office, make sure it’s invisible to outsiders, encrypted and secure. Set up your router to require a password for access, and set your wireless access point so it does not broadcast the network name. It is always wise to make a separate network available for guests and to check rogue access points which may have been brought in by employees or visitors.
  • Use a Firewall. Firewalls are like home security systems for your computers. They control the data coming in and out to prevent unauthorized access to your network. A Firewall is a software or hardware device that protects your computer from being attacked over the internet by hackers, viruses, and worms. Having a firewall in each company’s internet connection allows the business to setup online rules for the users. Here are the different ways of how a firewall controls online activities:
    • Packet filtering: small amount of data is analyzed and distributed according to the filter’s standards.
    • Proxy service: online Information is saved by the firewall and then sent to the requesting system.
    • Stateful inspection: matches specific details of a data packet to a database of reliable information.

Firewalls allow you to either add or remove filters based on certain circumstances such as:

    • IP addresses – If a certain IP address, not belonging to the company’s network is accessing too many files from the server, this IP can get blocked by the firewall.
    • Domain names – with a firewall, a company is able to block or allow access to certain domains.
    • Specific words and phrases – A firewall will scan each packet of information to match the filter content. You may select any word or sentence to be blocked.
  • Install antivirus software. Antivirus software helps protect against viruses or malicious software programs, which can also be damaging to your business operations. The software is designed to block damaging messages before it reaches the user. Antivirus software is the “guard” at the gate of a computer system. It protects the computer from incoming threats and seeks out, destroys and warns of possible threats to the system. New viruses are coming out all the time. It is the job of the antivirus software to keep up with the latest threats. This is achieved by daily updates of the antivirus database definitions, which counteract the latest threats to provide constant protection.
  • Educate and train employees. Establish a written policy about data security and clearly communicate it to all of your employees. Train your employees on security basics and best practices when it comes to web browsing and email. Many data breaches aren’t the result of a hacker, but by negligence or human error. If employees are trained on proper ways to handle data, it will significantly reduce the chances of a mistake being made.

Working with a managed IT service provider can remove a lot of the burden and take away the mystery of proactive measures to protect your business.

Protecting your company’s data and infrastructure should be a top priority, but you do not need to do it alone.  Let the Bryley experts help protect your company’s data and infrastructure. Please contact us at 844.449.8770 or by email at ITExperts@Bryley.com. We’re here for you.

 

1 43 Percent of Cyber Attacks Target Small Business. Sophy, Joshua. 28 April 2016.
2 CYBER SECURITY STATISTICS – Numbers Small Businesses Need to Know. Mansfield, Matt. 3 Jan 2017.
3 Why ransomware costs small businesses big money. CNN Tech. Larson, Selena. 27 July 2017.
4 Congress addresses cyberwar on small business: 14 million hacked over last 12 months. CNBC. Zaleski, Andrew. 5 Apr 2017.