Moving Past Common Small Business Security Myths

Moving Past Common Small Business Security Myths

Tips from Cybersecurity Authority, Dr. Christine Izuakor

‍

Over 30 million SMBs operate within the U.S., many of which rely on a variety of technologies and data to deliver their services. No matter how small or how new on the business scene, these growing companies often face the same cyber risks that large and well-established companies face.

‍

Yet many owners and operators of SMBs adhere to the dangerous myth that cybersecurity only applies to big business. unfortunately this belief can not only sideline a business, it can put small businesses out of operations indefinitely, and even permanently.

‍

The truth is that failing to integrate cybersecurity throughout all stages of your business, can result in ransomware and other attacks that can cost more than you have to resolve, breaches of customer data that breaks their trust and often interest in working with you, and result in non-compliance for regulated industries which can result in revocation of business licences. Just one of these events can take most small businesses down.

‍

Another truth is that small businesses are the number one target for hackers because so many are not protected and thus easy targets.

Christine Izuakor, a renowned cybersecurity expert and authority for SMBs, and founder of Cyber Pop-Up, outlines common myths and reality checks below. For more information about any of these issues, or where to start with your own cybersecurity plan, please email kimberly.clavin@cyberpopup.com, or complete our Contact Us form.

‍

Limited resources, unlimited consequences

‍

Myth: I don’t have the resources to build a cybersecurity program.

‍

A common reason SMBs operators procrastinate securing their businesses is because they think they have to staff up and hire expensive IT experts to be a part of their team, and consequently their overhead. Like other technology services, there are many SaaS businesses you can partner with and freelancers you can hire. These often take a lot of time to research to find the right partner that can support your specific budget, and with a SaaS program, you may have to pay for services you will never use with even the most basic of options. My vision in starting Cyber Pop-Up is to create a business that vets out the best freelancers, and make them available to SMBs based on skills and expertise needed, allowing operators to choose only the services they need vs. a subscription to services that don’t fit their specific situations.

‍

False sense of security from tech providers

‍

Myth: My Managed Service Provider(MSP) already makes sure I’m secure.

‍

As we hear from SMBs, another common and quite concerning revelation is “I already subscribe to a tech provider or MSP that manages my security”. Often, when we assess the scope of security covered by the MSP it covers less than 10% of what is necessary to build a good security posture. For example, just because an MSP ensures that you have anti-virus and up-to-date patches on your system, doesn’t mean that all of your security issues are taken care of. This false sense of security can be the downfall of a company, and attackers love this.

‍

Cybersecurity is more than anti-virus protection. It involves phishing hacks that are more and more sophisticated with time, and even the most witting person can fall for many of these. It just takes one employee opening one email one time and your system can be compromised. Relying on a limited set of services by a MSP is like purchasing auto insurance that only covers dents and dings but nothing else like liability and more.

‍

SMBs are attractive low-hanging fruit

‍

Myth: Attackers don’t care about my company, I don’t have anything they want.

‍

Attackers usually view their targets in one of two ways. 1.) Cast a wide net on easy targets and see who falls 2.) Go after very big targets with elaborate strategies.

‍

In either case, SMBs play a role in their success. In option one, the logic is that instead of spending the time trying to break into one large enterprise with security controls that may rival Fort Knox, a hacker might target 1,000 SMBs that have little to no security set up and see what sticks. It’s an economical business model. Let’s take ransomware for example. An attacker can target one large company and get a $1M payout (low chance of success, high reward) or target 1000 SMBs and get several $100k payouts (higher chance of success, higher reward).

‍

When large enterprises experience a breach, they take a brand reputation hit, incur fines and penalties, and sometimes pay millions of dollars in damages and repairs. While this is a lot of money, it’s usually just a small ding to the organization which will very likely bounce back. However, the same cannot be said for SMBs.

‍

60% of SMBs that are breached end up shutting down due to the cost to recover. SMBs are operating in the same arena as large businesses and facing the same threat actors. However, their punch is a debilitating knockout vs. a small blow large enterprises can eat with ease.

‍

Regulators have little mercy on SMBs

‍

Myth: I can rely on my technology vendors for compliance with regulations.

‍

Because the potential impact of insecure SMBs on companies large and small is so concerning, when regulators pass requirements SMBs are included in the scope. Though regulators also have requirements for technology vendors, there are separate and sometimes unique requirements that apply to SMBs. We’ve seen many cases where it doesn’t matter if you are a one-person company or have 10,000 employees, you are held to the same standard. This puts SMBs in the tough spot of trying to comply with the same hefty regulations Fortune 500 companies face, without the same Fortune 500 cyber teams in-house or resources to ensure compliance.

For more insights from Dr. Christine, visit our Resources Page often, or email us at hello@cyberpopup.com. You can learn more about our process to trusted protection here.