Understanding Cyber Security 101 for the Non-CISO Crowd

Running a business shouldn’t mean that you have to be a cybersecurity expert. But you do, at least, need to understand the cybersecurity fundamentals. As a business owner, you probably know the basics of personal cybersecurity and the threats that we face today. As a business owner, all these threats are amplified, and you are far more likely to become a target.

Why Do Business Owners Need to Understand Cybersecurity?

Today, small business owners are the most frequent targets for cybercriminals. Cybercriminals are aware that most small businesses aren’t well-protected, and they are eager to take action against small business owners because these small business owners usually have caches of information to protect. Cyber attackers are trying to get personally identifiable information, credit card numbers, financial information, and even intellectual property. They may even try to hold data for ransom.

Most businesses today run on technology, from their point-of-sale systems to their website. And that means that they are exposed to threat. Anything that is connected to the internet could become the victim of cybercrime.

Understanding Cybersecurity: Cybersecurity 101

When we talk about cybersecurity, we talk about the act of proactively protecting yourself from the biggest business cybersecurity threats. There are many types of cybersecurity threats, the most common of which are:

• Phishing attacks. In phishing attacks, cyber attackers will send emails or instant messages (or even text messages) in an effort to collect privileged information. An attacker might send one of your employees an email asking for their login information and claiming to be from IT. If the employee sends that information, the attacker uses it, and is now in your system.
• Ransomware attacks. Cyber attackers send a program that encrypts all the data in your system. You can’t get that data back until you pay a ransom, which can be tens of thousands of dollars. (And even then, getting your data back is far from assured). Ransomware often occurs through careless employees, who may download something that they shouldn’t, or click a link they shouldn’t.

While there are many viruses, IoT exploits, and other malware, ransomware attacks and phishing attacks do constitute the vast majority of cyber security issues. It’s important to note that phishing attacks are one type of social engineering attack, which is a broader discipline, and which is difficult to defend against. Under social engineering, attackers simply ask for information – and employees often give it.

Employees and Cyber Security Fundamentals

Unfortunately, as a business owner, you should be aware that your employees are most likely to be your biggest threat. That’s not because they’re malicious; employees are human and frequently make mistakes that can lead to a cybersecurity breach.

Employees may leave their accounts signed in and then forget their phone somewhere, exposing sensitive information. They may share their account information with other employees, which means that their own login information is vulnerable. And they may accidentally fall for phishing attempts and social engineering.

Better training and better controls are necessary to reduce employee risk.

Best Practices for Cyber Security

Businesses are able to reduce their risk by following best practices. Best practices are strategies that are known to reduce the risk for a business. A few common ones include:

• Adding two-factor authentication. When employees are required to have two-factor authentication, they can’t share accounts, and other people can’t break into their accounts, even if the employees make mistakes.
• Restricting permissions. Employees should always have the least amount of permissions they need to do their job properly. Even if their account is breached, it may not be a major security breach.

Best practices have the goal of reducing risk, but they can’t entirely eliminate the chances of a threat. The truth is that most companies are going to experience at least one cyber security event, and these cyber security events also need to be addressed as quickly as possible to reduce the amount of damage.

Is your organization concerned about its cyber security? A managed service provider can help. Managed service providers are able to train employees and supervisors on the best practices for the business, and are able to follow up on and mitigate threats as they occur. Contact Red River today for more information.