Protect Your Small Business with These Cybersecurity Tips
This is a guest post from True North Accounting, a trusted partner of Goodlawyer. With knowledgeable CPAs and bookkeepers in Calgary and Okotoks, True North helps make life easier for small business owners with bookkeeping, accounting and tax advice. Their streamlined process and clear, all-in pricing helps business owners save time and money.
Small business owners know that cybersecurity is a big deal, but many might be surprised to know that their own team is their biggest security threat. Besides installing malware, spyware and antivirus software, you also need to educate your team to protect your business and your client's data.
Learn about possible risks, the tactics hackers use to breach your systems, and tips to keep you and your people safe.
Risks of a Cybersecurity breach
Most hackers want to steal your data and sell it to a third party. This third party may piece it together with other data and formulate an attack. Another common tactic is to lock down your network and hold it ransom. Once they get access to your computer, hackers can:
- Steal confidential information
- Take over your webcam
- Get usernames and passwords for email and other logins
- Install malware
- Install spyware, which allows hackers to harvest data on you and surveil your every move
- Connect you to a botnet: your details are sold online and you’re added to a network of devices that work in unison to infiltrate an organization
- Download malicious apps to your device
Breaches could release information that hackers could use to steal identities. This is serious and could take months or even years to remedy.
Social Engineering
The most common cybersecurity threats involve some kind of social engineering. This means luring people into taking some kind of action. A threat could come by email, text, voice message or calendar invitation. Hackers are savvy. They might dig up some useful info on you by browsing your social media profiles, then send you a message, dropping a friend’s name to get your trust. They may approach you on social media with a flattering comment, and then ask questions about your company or the people that work there. They can use the info you provide to create a message that looks relevant and urgent and send it to someone with access to funds at your company. A common tactic is to send a message from the CEO to a payables clerk or treasurer, requesting funds to be sent ASAP. Creating a sense of urgency compels people to make bad decisions.
Small Business Cybersecurity Tips
Whether or not you formally train your people, your employees should have some awareness of how these threats work. In addition to briefing your team on common threats, here are a few basic things everyone can do to keep your networks safe:
- Clean desk policy: Don’t write Post-it notes with any username or password information and leave them on your desk. Hackers have been known to physically follow people into their building to try and get information. Be aware of anyone looking over your shoulder.
- Social media: Don’t post travel plans or other personal information. Hackers use social media to get to know you.
- Watch for the unexpected: A random flash drive hanging around with an intriguing label? A phone call, email, text, calendar invite that you weren’t expecting? Think twice before engaging.
- Never use public WIFI with a work device unless you’re using a VPN.
- Don’t let your team be tricked into giving away sensitive information or taking a dangerous action (such as clicking a link or opening an attachment). These phishing emails can look very legitimate (like it came from someone internal). Here are some red flags to look out for:
- Subject line: If it seems irrelevant, doesn’t match the message content or is about something you never requested, it’s a red flag.
- To line: If you were included in an email and don’t know the other people it was sent to.
- From line: If it comes from an unknown address, obvious red flag. But it might come from someone you know, but seem out of character or unexpected, or use words or phrases that aren’t quite fitting.
- Date: If it’s an email you would normally receive during business hours, but it came at 3 AM, red flag.
- Attachments: Any attachment that isn’t expected is a red flag.
- Content of the email: Being asked to click on a link or open an attachment to avoid a negative consequence is a favourite trick of hackers. It may ask you to look at a compromising or embarrassing photo of yourself. Anything that gives you a bad feeling, seems illogical, or makes you feel uncomfortable is a red flag.
- Hyperlinks: Look for spelling mistakes in links. If you hover over the link and that link is different from the one displayed, this is a big red flag.
If you’re overwhelmed by the topic of cybersecurity, you’re not alone. Proactis is our trusted cybersecurity partner. They specialize in small- to medium-sized managed IT solutions. They also led a comprehensive cybersecurity training for our team. Get in touch with them if you think you need help protecting your business.
