Small Businesses Are the Weakest Link; 38% Targeted by Phishers

Your business might be small. That doesn’t mean you are immune to phishing attacks. In fact, small and medium sized businesses are being targeted more often than ever. In 2015, the National Cybersecurity Institute found that small organizations of 250 employees or less were targeted in phishing attacks 38% of the time. This is mainly due to the fact that they typically don’t have or don’t spend the resources on cyber security like large organizations. So here are a few ways you can keep your small business more protected against phishing.

You are the weakest link.  

Remember that people are your weakest link and your first line of defense against phishing. Social engineering, of which phishing is a part, works more often than anyone would like. People are naturally curious, caring, fearful, and always in a rush. Phishers try to take advantage of all of these as well as many others. Training is key. Anyone that has access to browse the Internet from your network or has any connection to your network should be trained on how to be responsible internet users.  Training on phishing should be done regularly. Security experts recommend “regular” training be completed at least quarterly, as phishing attacks change constantly and new ways of tricking users come up all the time. It’s best to make everyone aware of them frequently.

Big phish may come in small packages.

Phishing lures can come in many ways including text or SMS. Short messages with a link from an unknown sender can be very dangerous. Even if the sender is known, but the link is not expected, one click and malware runs wild in your network. It also spreads quickly via email and through social media. Emphasize to employees that it’s important to take time and think before clicking links or opening attachments of any type. It is becoming more common for criminals to take the time to masquerade as co-workers or known vendors when sending out a phishing attack. The results are far greater when this is done.

Watch where you type.

Everyone should understand to enter sensitive information about themselves or the company into browser windows that show a secured connection. This means there is a lock icon somewhere on the browser or there is an “https://” before the web address. This indicates the information is encrypted as it passes through the Web. In some cases, part of the URL may turn green indicating it is safe. Define clearly what is sensitive information and make sure it is understood by everyone, especially those with access to financial accounts and who perform financial transactions. Business email compromise is on the rise and phishers are targeting those who have this authorization often. They will pose as executives and email a request to someone in accounting, for example asking for a large wire transfer to be performed. Simply putting policies in place and training, as well as enforcement of policies can prevent a large loss.

One more way to get in those 10K steps per day.

A basic tip for preventing phishing from consuming your organization is to ensure that everyone understands the importance of confirming with the requestor or sender before opening unexpected links or attachments, or before performing a financial transaction. Getting up and walking to a colleague’s desk to get a “yes, I did ask for that wire transfer” response will go a long way and really doesn’t take a lot of extra time. In lieu of that, a phone call or a reply from a brand new email will also work.

If you don’t have a cyber security training program in place for your small business, it’s time to take it seriously. There are many companies who can help you put a good one together or provide you with materials and information to provide it on your own. Spend the time to do this now, rather than need cyber-security investigators later because malware gets downloaded on your company’s network.