Cyber security is incredibly important for small businesses. Cyber breaches are often caused by employees inadvertently creating an entry-point into systems and networks, leaving confidential information vulnerable to hackers. A cyber-security breach could be detrimental to the future of your organisation due to potentially devastating fines for data protection breaches introduced by the GDPR in 2018, not to mention the knock-on effect that lax cyber-security could have on your organisation’s reputation and its standing within the business community.
Important to remember is that maintaining strong cyber security involves the creation of a compliance culture; where behaviours aligned with your regulatory obligations are not only encouraged, but nurtured and regularly reinforced. Investing in cyber-security awareness training means your staff will be empowered to spot and report suspicious activity, and your organisation can build on its strong reputation as a trustworthy business that invests in its customers’ right to privacy.
Far from just an issue for large corporations (although the media does tend to sensationalise these large scale data breaches), there’s around a 50% chance that a UK SME will experience a cyber-security breach of some kind. In fact, due to the likelihood of start-ups and SMEs not investing enough in cyber security training or top-of-the-range security software, these types of organisations make for easy targets. That’s right, hackers are aware that smaller businesses are less likely to have an up-to-date cyber-security training programme in place and, as the weakest link in the chain, this means that your staff are more vulnerable to common security threats.
Common Security Threats for Small Businesses:
Keeping your systems safe doesn’t need to be confusing or even extensively costly. With a few simple steps, you can increase your cyber-security efforts and help mitigate the risk of your business falling foul to common types of cyber-crime.
Using email and the Internet Securely
It may seem obvious to you, but basic internet/email awareness training shouldn’t be ignored or accepted as ‘common knowledge’ – something everyone automatically already knows prior to employment. Remember, most Malware is introduced to its host computer by the user clicking on a download link, email attachment, or by visiting an insecure website.
Malware may take many forms, e.g. ransomware, viruses, Trojan horses, spyware, and so on, but it almost always finds its way onto business networks due to gaps in employee knowledge when it comes to safe use of email and/or the internet. When it comes to computer literacy and its effect upon cyber-security, regular refresher training should never be underestimated
Social Media
There are reports that, on average, people use eight different social media accounts at any one time! Given this information, it’s highly likely that most of your employees will access at least one form of social media on a daily basis, and that’s why it’s so important for small businesses to define their terms of acceptable social media use early on, and to highlight (and therefore mitigate) cyber-security risks on these platforms.
Social Hackers exploit both the proliferation of social media in recent years, and the ease of access to new victims afforded by these sites (e.g. through users’ friends-lists). Because we don’t generally see the information we post on social media as ‘valuable’, or even as confidential, users tend to let their guard down whilst accessing these platforms, and this makes them easy prey for hackers. You are, e.g., far more likely to click on a Malware download disguised as a fun link, or fall for a Phishing attempt asking for confidential information, whilst using social media.
Remember, it only takes one unsuspecting employee to unwittingly click on a Malware download for your entire network to be infected. Social media awareness training has never been so important.
Software Updates:
Ignoring software updates puts your business at risk. Although it seems convenient to keep clicking the ‘remind me later’ option, out of date or unpatched software doesn’t just slow down your operating system, it invites known threats to infiltrate your system. As well as removing outdated features and fixing bugs, software updates fill-in any newly-discovered holes in security, blocking hackers’ chances to infiltrate the gaps and plant, for example, Spyware, onto your machine.
Remember, updates are important for all digital media devices, not just network PCs and laptops in the office. So, if your team uses or shares mobile internet devices, e.g. tablets and mobile phones, it is the responsibility of everyone to ensure updates are installed. This kind of accountability and responsibility for cyber-security is known as:
A Compliance Culture
If you expect your employees to take cyber-security seriously, it’s important for small businesses to embed compliance firmly within the organisation’s culture, as part of its core business model, and led firmly (and positively) from the top.
By fostering a culture wherein employees are regularly trained, updated, and reminded about compliance procedures in an empowering, uplifting way (i.e. not just as a box-ticking exercise), small business owners can set foundations, lay out their expectations, and even influence employee behaviours in ways that ensures their cyber security training goes way beyond what is simply mandated by law.
