Small business cybersecurity must be taken seriously. The days of hackers focusing on major businesses have given way to a new era. Small businesses are the new target. The Verizon 2019 Data Breach Investigations Report found that 43% of data breaches hit small businesses. The next most common industry for breaches - the public sector - was hit by just 16% of security events. Small businesses are a high-priority target for attackers, and a Ponemon Institute study found that 67% of small businesses were hit by a cyber attack in the year prior to its study, which was released in late 2018.
These are tough statistics for small business owners. The problem doesn't stop here. Small businesses aren't just targets; they are also less likely to be able to handle the costs of a data breach. A study from IBM Security and the Ponemon Institute found the average total cost of a data breach was $3.9 million in 2018. That figure has been rising over the past few years.
Small business cybersecurity is a mission-critical situation. It's something that poses real challenges for small business owners who lack the resources to invest in robust IT systems.
Understanding the Scope of the Cybersecurity Threat
The high costs of a data breach are influenced by major security incidents affecting large corporations. You may not think you have almost $4 million to lose in a cyberattack because you simply don't have that kind of money in the first place. But that's the problem. You may not be hit by a hacker trying to steal highly regulated data, leading to the kinds of fines that cause huge costs. But how much cash do you have lying around? If you're hit by a ransomware attack - a security event in which a hacker uses malware to encrypt your data so you can't access it and demands a ransom - do you have the funds to respond? Even a $50,000 ransom can have a huge impact on a small business.
See also: Hidden Dangers for Cybersecurity
Dealing with the Costs of Attacks
The costs that come with a data breach stem from a variety of sources. If you're lucky, you won't lose any information, or have it stolen. For example, two types of common attacks don't steal data; they just kill productivity.
The first of those is ransomware. The cost here comes from lost productivity while data is inaccessible, and the price of paying the ransom to recover your data. The second is distributed denial of service (DDoS), an attack in which servers are overloaded by constant attempts to access your website. This makes it impossible for legitimate customers to interact with you.
When data is stolen, the costs escalate, particularly if customer information is lost. In this case, you often have to:
- Cover the costs of credit tracking for those affected by the breach.
- Deal with regulatory fines if it's found that you weren't in compliance with an industry standard.
- Face lost trust from customers, something that often hurts the bottom line.
- Scramble to deal with the source of the attack and fix any IT problems that existed.
- Phishing schemes that use legit-looking emails to trick users into downloading malware.
- Account takeovers in which criminals use stolen login details to access user accounts and steal private data.
- Social engineering efforts that allow hackers to pose as an account-holder to gain access to sensitive data.
