Biggest Cybersecurity threats to SMBs

Cybersecurity is vital for all business of all sizes; learn more about the types of threats that could affect your business

SMBs are subject to the same security threats as their larger counterparts. However, some SMBs harbor the misconception that they are immune because of their size. In fact, smaller companies are at even more risk because many lack the necessary resources to effectively defend against these attacks.

More worryingly, a recent survey of SMBs by CISCO illustrated that the effect of an attack is proportionately greater to an SMB than a large enterprise. For example, a typical $100B enterprise that experiences a cyber-attack should expect a cost of around $292K, which represents just 0.000003% of annual revenues.¹ On the other hand, a small business that grosses $100K per year will likely lose a quarter of its earnings ($25K) or more.¹

The first step in prevention is understanding the types of attacks that exist. Here is a summary of some of the most prominent types of attacks:

1. Viruses and other malware: These are software designed to cause damage to desktop computers, laptops, mobile devices, networks, servers, and other systems. The damage is caused once the malware is introduced (downloaded) into a target device. Common types of malware include Trojan horses, viruses, worms, adware, and spyware.
2. Ransomware: This is a type of malware that is used specifically to exact a ransom from the victim. It is used to threaten to expose a victim company’s data, shut down systems, or block access to files/information unless the company pays a ransom. These attacks are aimed at all types of companies and are generally done using a Trojan horse disguised as a legitimate file downloaded by a user.
3. Phishing: Here attackers try to gain access to sensitive data such as usernames, passwords, credit card numbers, social security numbers, and other information. They do this by masquerading as trustworthy entities, using emails or instant messages to get information. Often users are instructed to enter personal information at a fake Web site that appears to be legitimate. Other variants include spear phishing, which are attacks aimed at specific individuals or organizations, and whaling, which are attacks directed toward senior executives and high-profile targets.
4. Distributed denial-of-service (DDoS): These types of attacks can be among the most damaging because they can shut down vital servers. They involve an attacker overloading a target system with requests, making it unavailable to users. With such attacks the systems cannot respond to legitimate requests and renders the business’s systems useless. Additionally, because the incoming flood of requests originate from multiple sources, these types of attacks are hard to stop.
5. Botnets: With IoT flourishing, there are a lot of internet-connected devices, with each one running one or more bots. Attackers can use these bots to perform DDoS attacks, steal data, and gain access to devices and their connections.
6. Advanced persistent threat (APT): Here an attacker gains unauthorized access to a company’s network and remains undetected. The goal may be to steal data, cause damage, disrupt systems or perform some other malicious act.
7. Drive-by downloads: This can happen when malware or other unwanted software is downloaded because users visited or opened an insecure website or email attachment. For example, malicious content on a site may be able to exploit vulnerabilities in a user’s browser to run malicious code.
8. Insider threats: These involve malicious threats that come from employees, former employees, contractors, or others working within a company. They generally leverage inside information about security tools and systems to inflict damage or delete or steal data. These types of threats can come from malicious insiders, negligence, or external parties who gain access credentials without authorization.

In addition, to the above threats, SMBs are also vulnerable to data loss from insufficient backups and must be compliant with a variety of regulations to prevent fines. Cybersecurity is not easy or inexpensive – unlike larger enterprises, SMBs have limited resources for protecting their networks, systems, applications, and data. So, they need to make the most out of the resources they have.

Check out a quick 5 step framework or 12 top tips to help you set up your cybersecurity strategy.

At Rogers Business we are here to help - we have partnered with The Toronto Metropolitan University to launch Simply Secure, a free cybersecurity resource for SMB’s. You can also reach out to us, and we can help you determine the right solutions for your business. Contact us today to learn more and see how we can help.

^{Referenced from:}

^{1. Cisco, The 2021 Security Outcomes Study – Small and Midsize Business Edition, 2021}

^{2. Government of Canada, https://cyber.gc.ca/en/guidance/cyber-threat-bulletin-ransomware-threat-2021}

^{3. Cisco, IDG, The Cybersecurity Playbook for Midsize Companies, 2021}

^{4. Cisco, SMB Cybersecurity Report, 2021}

^{5. Cisco, https://blogs.cisco.com/security/big-security-in-a-small-business-world-10-myth-busters-for-smb-cybersecurity, 2020}

^{6. Cisco, https://www.cisco.com/c/en_ca/products/security/common-cyberattacks.html, 2022}