Big companies usually have IT departments to help them select technology, install and maintain it, and protect it from outside threats such as cybercrime. If you are a small business, you probably don’t have an IT department, at least not a very big one. In many small businesses, the proprietor is the IT person, as well as the CEO, treasurer, head of marketing and all the rest, writes Richard Smith.
It’s little wonder that strategy to deal with complicated technology issues such as potential cyberattacks often gets put on the backburner. However, the rapid rise we are seeing in cybercrime at the moment is making the threat difficult to ignore.
There were 47,000 reported cyber security incidents in Australia in 2016–17, up 15% from the previous year, according to the Federal Government’s Australian Cyber Security Centre.
The outlook is even more grim. Cybercrime will continue rising and is predicted to cost businesses globally more than US$6 trillion annually by 2021, according to research from Cybersecurity Ventures.
This year, the greatest number of cyber-attacks on SMEs is expected to be in the form of ransomware. Ransomware is the most prevalent cybercrime threat in Australia and occurs when a person, often an inexperienced employee, opens an email and clicks on a link that then infects the business’s technology. This can freeze all online operations, except emails from the cyber-criminal, until a ransom is paid.
In one recent instance, the owner and manager of a small group of pharmacies in Western Sydney was away on holidays when an employee opened an email and clicked on an innocent looking link. That single mouse click was disastrous for the business. The pharmacies’ computers froze. Employees couldn’t access information on customers’ medical and pharmaceutical needs, nor enter prescription details. Nor could they access details on various drugs that they often had to look up and tell their customers about. Electronic payments were stopped.
The vacationing pharmacist returned soon after to chaos. All that was working was email—and there was a dreaded email requesting payment of thousands of dollars in Bitcoin to restore all the data and systems. He called his reliable IT support service, who was unable to do anything with this malware attack. Their advice: “pay up”.
Ransomware attacks can cause severe financial and reputational damage to businesses.
Cybersecurity Ventures expects ransomware damage costs globally will rise to US$11.5 billion in 2019 and that a business will fall victim to a ransomware attack every 14 seconds by that time.
Here are some things you can do to help protect your business from ransomware attacks:
Update your software
After the WannaCry ransomware attack of May 2017 crippled computer systems in 150 countries, came the sobering realisation that there had been a fix available before the attack. Microsoft had released a patch for the WannaCry vulnerability weeks earlier.
The upshot is that if people had been diligent with their software updates, their machines may not have been infected. Businesses can keep on top of this by configuring their computers to automatically install software updates as they become available.
Install antivirus software
Antivirus software is essential for protecting your business’s computers from ransomware attacks. It can prevent malware from infecting your computers, but again, only if you keep it up-to-date.
Also, don’t fall into the trap of thinking antivirus software can protect you from everything! It can’t always keep ahead of every new type of malware out there, so a multi-pronged approach to security is important.
Back up your files
Ransomware attacks work because most computer users don’t back up their data. The reason that victims agree to pay ransoms is to regain access to data that they haven’t backed up elsewhere.
If you’ve backed up your data, cybercriminals won’t be able to hold it hostage. Consider backing up your files on a drive separate to your main business network or in the cloud. It’s best to have backups in multiple places for maximum safety.
Prepare your reporting process
Under new laws that came into effect in February, the Australian government requires all businesses with a turnover of more than $3 million to report any data breach that would seriously harm people.
The Notifiable Data Breaches (NDB) legislation includes millions of dollars of fines if businesses fail to report hacking attacks or breaches of personal data. It’s important to read up on the legislationand have a reporting plan in place to follow in the event of an attack.
Be wary of unsolicited emails
Be ultra-cautious with any unsolicited emails, pop-ups and dubious websites, which can often carry malware.
Don’t open anything you are unsure of, or click on any links that don’t look right, and train your employees to do the same.
Keep up-to-date with cyber security threats
Keep an eye on news about cyber security threats so that you can be on guard to spot the latest techniques of cybercriminals and make sure your computer system is best equipped to deal with the current virus or other malware threat.
Consider cyber insurance
While it is better to avoid a ransomware attack where possible, even well-prepared companies can fall prey as cybercriminals develop new and innovative methods. In the event an attack does occur, a current cyber insurance policy can help to mitigate the impact on your business.
Cyber insurance can cover the loss of business profit due to a cyber event and costs associated with mitigating the loss. Not only can it reimburse you for the payment of a ransom or costs associated with negotiating with those making an extortion threat – it can also cover the financial consequences of losing a customer, employee or commercially sensitive data (such as that required to be reported under the Federal Government’s new NDB scheme).
While it’s important to check the details of the cover in any particular policy, other costs that cyber insurance can cover include computer forensic costs, notification expenses, legal fees, replacement of damaged IT systems, and the cost of repairing or restoring systems and data. It can even cover public relations and crisis management, and the unintentional transmission of Malware causing harm to a third party.
Richard Smith is Director of Edmund, established to make cyber insurance accessible for small to medium enterprises and Australia’s first online cyber insurer.
