The Verizon Data Breach Investigations Report indicates that more than 70% of cyberattacks target small businesses. Hackers are also targeting MSPs more frequently because it gives them access to even more systems with the potential to collect bigger payouts.
Why are hackers targeting SMBs?
Small and midsize businesses (SMBs) are easy targets for hackers for a few reasons. First, they’re less likely it to use a multi-layered defense that you need to protect blind spots. SMBs often think they’re protected with one layer of security, such as a firewall, antivirus or backup. The truth is that no single solution is 100% effective. The key to a robust cyber resilience strategy is to layer all these solutions to protect the business from multiple threat vectors and points of vulnerability.
Another area where businesses tend to fall short is security awareness training. The single greatest cybersecurity weakness is users. Many don’t know how to identify suspicious activity like phishing links or scams because they don’t know what to look for. What’s more, some hackers specialize in breaching specific business types or industries, refining their expertise with each new attack.
What kind of businesses are vulnerable?
Some industries are targeted more frequently than others. Finance and healthcare are especially attractive targets because of the value and sensitive nature of the data they keep. The types of businesses that hackers are increasingly targeting include:
Managed Service Providers
MSPs hold a lot of valuable data for multiple customers across industries, which makes them desirable targets. Hackers use a technique known as “island hopping”, in which they jump from one business to another via stolen login credentials. MSPs and their SMB customers are both potential targets of these attacks.
Healthcare organizations
Hospitals, physical therapy offices, pediatricians, chiropractors, and other healthcare practices are easy targets for cybercrime because they can have such chaotic day-to-day operations, and because they often lack solid security practices. In addition, medical data and research can extremely valuable. Patient records alone can sell for up to $1,000 or more on the dark web.
Government agencies
There are many reasons that cybercriminals, particularly nation-state terrorists, might target local and national governments. Small governments and local agencies generate troves of sensitive information, while large governments can be victims of nationwide disruption, either for financial gain or sheer destruction.
Financial institutions
Banks, credit unions, and other financial institutions have long been targets for hackers due to a wealth of data and money. Only a few years ago in 2018, over 25% of all malware attacks targeted banks – more than any other industry. More recently, automation has further enabled cybercriminals to run advanced attacks on financial institutions at scale.
Celebrities, politicians, and high-profile brands
Hacktivists, who are usually politically, economically or socially motivated, like to seek out politicians, celebrities and other prominent organizations as targets. They may even attempt to embarrass public figures or businesses by stealing and disseminating sensitive, proprietary or classified data to cause public disruption or for private financial gain via blackmail.
Cybersecurity best practices
As long as you have something hackers want, you can be a target. Since business data is especially valuable, hackers are intent on leveraging it for profit. Protecting business data can be straightforward. Here are a few tips that can help prevent a hacker from holding your data hostage.
Think like a hacker
Cybersecurity awareness training with phishing simulations is a vital component of an effective protection strategy. In fact, a recent report from Webroot™ found that user training at frequent intervals – 11 or more courses over a four- to six-month period – reduced clicks on phishing links by 65%. Understanding hacker practices and motivations can help employees identify potential threats and thwart attacks.
Institute consistent policies
With the proliferation of free online storage and file sync services, it’s not unusual for an employee to store sensitive business files unencrypted in the cloud. This is very risky for businesses because there’s no way to verify the security of these free services. In addition, the passwords employees use to access these services are often far less secure than official company password policies. This makes online storage services easy targets for hackers. It’s important for businesses to maintain control over where critical business data is kept. The only way to do this is to have consistent policies for storing company data in a manner that doesn’t expose sensitive information to unnecessary risks.
Prevention, recovery and resilience
Being resilient in the face of cybercrime doesn’t just mean having powerful, automated endpoint threat detection in place. It also means having the ability to recover if an attack circumvents your perimeter security. It’s essential to have a strong disaster recovery strategy in place so you know you can keep systems online when there’s a disruption to your production system. The best defense is preparation. This means preventing attacks and planning your recovery proactively, so you’ll be ready to bounce back right away at the first sign of trouble.
The path to a cyber-resilient business
Hackers are always adapting their methods to catch victims when they least expect it. That’s why it’s necessary to use a multi-layered approach to protecting systems. This includes advanced threat intelligence at the perimeter in the form of antivirus, security awareness training at regular intervals to strengthen your weakest link (users), and cloud backup to ensure you always have access to the data that fuels your business.
With a multi-layered approach, it’s possible to bounce back from adverse events and keep the business moving forward, even under the threat of malicious hackers. We call this cyber-resilience and it’s essential for today’s data-driven businesses.
To get started on the road to cyber resilience, take a free trial here.
