Cybercrime is no longer limited to lone hackers operating from their basements. It has evolved into full-fledged enterprises with CFOs, HR teams, and research and development budgets. This “professionalization” of cybercrime poses a growing risk for small businesses, according to Microsoft Canada’s National Security Officer, John Hewie.
A study by the Insurance Bureau of Canada revealed that 41 percent of small businesses that fell victim to a cyber attack suffered losses exceeding $100,000. Hewie warns that smaller organizations are increasingly becoming targets for cybercriminals.
“In recent years, we have witnessed the emergence of a new ecosystem of criminal players in this space,” says Hewie. “Attacking small businesses has become easier and more cost-effective for cybercriminals.”
Leaving the loot unguarded
Hewie points out that many small businesses turned to digital solutions during the Covid pandemic to survive, but they may not have prioritized security measures.
“Smaller organizations are primarily focused on their core business, which is their passion,” explains Hewie. “They are busy brewing beer, running retail stores, practicing law, or providing dental services. Traditionally, they haven’t had to worry about cybersecurity or invest much time in securing their accounts or implementing backup strategies.”
However, ensuring safety doesn’t necessarily require hiring expensive in-house IT experts. Hewie, in collaboration with the Canadian Chamber of Commerce, authored the Canadian Small Business Cybersecurity Survival Guide, which highlights that implementing some best practices can protect businesses against 98 percent of cyber attacks.
“There are numerous steps that smaller organizations can take,” assures Hewie.
Thieves don’t break in, they log in
“The crucial thing to understand,” emphasizes Hewie, “is that attackers usually don’t need to break into systems—they can simply log in.”
Hewie explains that most cybercriminals exploit common vulnerabilities such as weak passwords or deceptive phishing emails to obtain legitimate login credentials from employees. Once they gain access to a business’s network, they employ various extortion tactics.
Ransomware scams, where thieves hold a company’s data hostage until a large sum of money is paid, are becoming increasingly prevalent. “Criminals have developed different patterns to motivate victims to pay. This includes encrypting data and demanding a ransom for the decryption key, as well as threatening to leak or sell sensitive information,” reveals Hewie.
Another common scam is business email compromise. “This occurs when someone within the organization falls victim to a phishing attack and unintentionally discloses their login credentials, compromising their account. The adversary then exploits this account to target other employees. For example, they may send an email from the compromised user’s account to the finance team, requesting a change in banking information for a legitimate supplier. As a result, the next invoice payment goes to the criminal’s bank account. Business Email Compromise is one of the most financially impactful scams affecting small and medium businesses,” warns Hewie.
Security by default
The good news is that it is becoming easier for small businesses to protect themselves without making significant security investments. Hewie recommends implementing multi-factor authentication (MFA) as a starting point to make it much more challenging for criminals to gain access to accounts using only usernames and passwords.
“That’s the number one recommendation,” asserts Hewie. “Protecting important accounts with strong and unique passwords, along with MFA, prevents most account compromises.”
Microsoft is continuously investing in making security more intuitive by incorporating best practices into the native settings of its solutions. “We strive to ensure the most secure configurations are applied by default. For instance, using Windows Hello for facial recognition to log in to your laptop is an example of improved security with a simpler user experience. Our cloud solutions are also designed to guide users towards secure configurations,” explains Hewie. While he acknowledges that cybercrime will persist, he believes that “when small businesses adopt the best practices outlined in the Canadian Small Business Cybersecurity Survival Guide, they significantly increase their chances of staying safe.”