5 steps to greater cyber security

Top 5 cybersecurity mistakes endangering your startup and how to resolve them

Simon Hughes – VP and General Manager for the UK arm of Cowbell, a leading cyber insurance provider for SMEs – runs through the most common cybersecurity mistakes startups make, revealing how to fix them before hackers catch on.

One of the most common misconceptions among small and medium-sized enterprises (SMEs) is that they are less vulnerable to cyberattacks than their larger counterparts. It’s a belief that most likely stems from the perception that cybercriminals primarily target high-profile organisations for larger financial gains or notoriety. However, this is not entirely true.

Granted, the likes of Microsoft, Google and other major tech companies have fallen victim to cyberattacks on multiple occasions. Google’s 2009 “Operation Aurora” cyberattacks and Microsoft’s 2017 “WannaCry” ransomware attack both come to mind. The reason they come to mind however, is not because the effects these attacks caused were any more damaging than those SMEs experience, but because of the extensive media coverage they received.

When an SME is targeted, it’s unlikely to make the news, but that doesn’t make the effects any less damaging. In fact, it’s often quite the reverse; the same events impacting an SME business – financial loss as a result of a cyber event, reputational damage, legal costs, business interruption – are all likely to be felt much more acutely by a small or medium-sized business compared to a larger and more established organisation.

Coupled with this is the likelihood that an SME organisation is spending considerably less on their IT security than a much larger organisation and therefore more likely to fall victim to a malicious cyber event in the first place. Criminal organisations are well aware of these facts too. Therefore, the key for SME businesses is to think not only about their own cyber exposure, but how they can lower the likelihood of an event happening in the first place. If an incident then does happen, it’s about ensuring effective risk transfer and access to the necessary incident response capability.

A recent case study shows that businesses whose risk factors, based on Cowbell’s proprietary risk model, were 8 points higher than the industry average have a 1% chance of suffering a cyber attack or event, while businesses whose risk factors were 7 points lower than the industry aggregate have close to a 16% chance of suffering an event. That means implementing good cyber hygiene can indeed lower the likelihood of cyber events from happening.

So just what are the most common cybersecurity mistakes SMEs make and what can they do to fix them?

Failing to implement Multifactor Authentication (MFA)

One of the biggest mistakes SMEs can make when it comes to cybersecurity is failing to implement Multifactor Authentication (MFA), also called 2-Factor Authentication (2FA).

MFA is an electronic authentication method that only grants users access to websites or software if they present two or more pieces of evidence to an authentication mechanism. This usually involves a password, push notification, and/or authentication code using an authenticator app like Google Authenticator, Okta, or similar. According to Microsoft, implementing MFA can block up to 99.9% of account compromise attacks.

The great news is that implementing MFA is easy and usually free for most commonly used software and Cloud applications (Google Drive, Zoom, payroll software, etc.), and it can usually be enforced company-wide by the software administrator. For payroll software such as QuickBooks or ADP, for example, you’d simply follow these steps:

• Step 1: Log in to your payroll software account.
• Step 2: Look for an option in your account settings or security settings related to two-factor authentication or multi-factor authentication.
• Step 3: Follow the instructions to enable MFA. This typically involves setting up a second verification method, such as receiving a code via text message or email.

Data backup complacency

Once a bad actor (an individual, group, or organisation that engages in malicious or unauthorised activities in the digital realm) gains access to a system, frequent data backups can prevent a lengthy business shutdown or costly ransomware payment; yet, many small companies still don’t back up their data regularly and properly.

To ensure an efficient backup strategy, companies should follow the 3-2-1 rule:

• Ensure that you have three copies of your data (your production data and two backup copies),
• on two different media (disk and tape)
• with one copy off-site and entirely segregated from the rest (meaning offline, using a hard drive or in the cloud) for disaster recovery.

Allowing employees to use public wifi without a virtual private network

Many companies allow at least partial remote work for their employees, which can present an increased risk of exposure if virtual private networks (VPNs) aren’t put into place. A VPN creates a secure connection between a computing device and a network, or two networks, and is necessary when using public Wifi. Without a VPN, bad actors can gain access to your device or network through the shared Wifi.

Public Wifi is any Wifi that a large group of people has access to, for example, in cafes, airports, or hotels. Non-password-protected Wifi is the most dangerous, but even password-protected Wifi should only be accessed using a VPN, if the password is easy to obtain.

Luckily, there are many VPN providers available, and implementation can be done company-wide by an administrator. A couple of examples include:

• ExpressVPN, which offers a high level of security with strong encryption, a strict no-logs policy, and a wide range of server locations. It has user-friendly apps for various platforms, making it easy for employees to install and use, and works on Windows, macOS, iOS, Android, Linux, and even routers. ExpressVPN allows businesses to set up VPN protection for their entire workforce through a business-specific plan.

• NordVPN is another great example. Its advanced security features include Double VPN, Onion Over VPN, and CyberSec, which blocks malicious websites. It boasts a large server network spanning multiple countries, ensuring good connection speeds and like ExpressVPN, offers user-friendly apps for various devices, making it accessible for all employees.

No incident response plan

Due to the misconception that smaller businesses don’t get targeted by bad actors, many do not have a plan in place on how to behave if their company does fall victim to an incident. An Incident Response Plan (IRP) is a detailed plan that goes over all the actions to take when companies experience an incident, and it should be put in place before ever falling victim, as well as revisited and updated at least yearly.

The goal of an IRP is to give businesses peace of mind that they are prepared for an incident. They will know exactly what they need to do if such an event occurs, which will ultimately help to reduce the time and money it takes to get business back up and running. It’s worth noting that a good quality cyber insurance provider will offer assistance in creating an IRP, tailored to your business, along with various other risk management tools and services that can help bolster security and awareness.