Less than two weeks ago there was a global cyber attack, affecting organisations from FedEx to the NHS. More than 200,000 computers were infected, across over 150 countries. Computers running Windows systems were attacked and users locked out unless they paid a ransom.
While this was the first large scale attack to cause such disruption, it almost certainly won’t be the last, and even far smaller attacks can have a devastating effect.
So what can small businesses do to keep themselves safe when it comes to ransomware? We spoke to our senior information security analyst, Mubarak Dirie.
- 6 of the best CRMs for small businesses in the UK compared
- 7 of the best UK business bank accounts for startups 2017, compared
- Public liability or professional indemnity?
Are small businesses likely to be a target?
“One of the biggest misconceptions is that as a small business, no one would bother to spend the time and resources to hack you.” says Mubarak.
“Unfortunately, few cyberattacks are targeted - hackers tend to throw a wide net and see what they can capture. And they see small businesses as low hanging fruit because you’re less likely to have security as strong as bigger companies”
“SMEs are often the worst hit by cyber attacks because they don’t have this security in place. They’re vulnerable to losing valuable data and suffering both financial and reputational damage.”
What does an attack look like?
Most cyber attacks start with phishing, a technique by which people will try to trick you into giving away sensitive information that will allow them to break into your accounts.
Phishing attacks usually come via email, often disguised as something legitimate. There was a mass phishing attack recently where hackers sent a fake Uber receipt, with a link at the bottom to a bogus complaints website. Though the email looked genuine, when the recipients clicked to complain about the Uber journey they never took, they gave the hackers access to their system.
So how can you tell the fake emails from the real ones? It can be tricky, but these are the top tips from our security team:
Don’t click links blindly. On a desktop you can hover over them with your mouse, which will show you the URL. If that doesn’t match up to the URL you’re expecting, then delete the email.
Emails with attachments should be treated with suspicion. If you receive an attachment that you’re not expecting and you don’t recognise the sender, it could well be a phishing attempt.
Take extra care with Microsoft Office attachments, such as Word and Excel files, particularly if you’re prompted to “enable macros” when you open it.
If you’re in any doubt about the legitimacy of an email, don’t open any attachments from it or click any links. Check with the person who sent you the email whether or not it actually came from them, but make sure not to do so by email - you might be playing right into the phisher’s hands.
What can small businesses do to protect themselves?
However, even with all the caution in the world, you can still sometimes be tricked - and some hackers don’t even need to use phishing to get into your system. But with the right protections in place you can minimise the chance of hackers getting away with your data.
Set up two-factor authentication
Two-factor authentication, or 2FA, is a log-in system many programs offer. It means when you go to log in you not only have to fill in your password, but also a code from elsewhere - usually delivered to your phone.
“We’ve known for years that by themselves, passwords are inadequate,” says Mubarak. “Even the biggest companies - LinkedIn, Yahoo - get breached. There are dumps of passwords over the dark web and criminals will try these on various accounts. If your password isn’t particularly strong, it’s easy for them to break in.”
Dark net, or dark web, refers to a shady part of the internet which can’t be found through search engines and and is only accessible by certain browsers. It’s here where a lot of illegal activity takes place.
You can check if your account has been compromised at haveibeenpwned.com
However, if you have 2FA set up then the hackers will also need access to your phone in order to break into your account, making it all the harder. Most cloud-based software gives you the option to enable 2FA, using apps like Google Authenticator to send the codes to your phone.
Patch your software
‘Remind me again tomorrow’ - it’s a box so many of us tick to ignore the notification that pops up on our screen, but those updates often contain patches that fix holes in the security of our operating systems. If we don’t update then we’re not protected.
This is particularly important for small businesses. Big corporations have IT departments to take care of everything, but it’s down to you to keep yourself protected - the fact that so many don’t is what makes small businesses such appealing targets for hackers.
“There was a patch available for the vulnerable Windows systems that the WannaCry attack affected, but it was because so many systems hadn’t been updated that it was able to take hold.”
Whether it’s your desktop computer, your tablet, or your mobile phone, hackers are looking for vulnerabilities, so always keep your software up to date.
Keep your antivirus up to date
Just as you need to make sure you’re running the latest version of your software and operating system, keeping your antivirus up to date is crucial for protecting your data.
Hackers are constantly coming up with new techniques for breaking into your system, so if you’re not running the latest version of the software then there could be any number of viruses out there that you’re not safeguarded against.
“If you’re not quite sure how to set up the software or want to make sure it’s configured properly then contact the provider of your antivirus,” says Mubarak. “As a small business owner or sole trader, you don’t have a tech or IT support department you can turn to.”
Back everything up
Backing up all your files is a good idea anyway - your computer could well fall victim to a spilt glass of water, even if it avoids the hackers.
The hackers behind the recent WannaCry attack weren’t stealing personal information, but were threatening to delete it if the ransom wasn’t paid. If you have all your information backed up then they have nothing on you.
While a number of computers these days have a secondary hard drive where you can backup your files, some ransomware software will be able to access that too, so you should make sure your backup is kept separate from your computer. If it’s on a USB stick or an external hard drive then you should keep it disconnected from the Internet or it may also be attacked by ransomware.
You can also consider using cloud services to back up your files. Many cloud service providers - such as Dropbox and Google Drive - offer an amount of cloud storage space for free.
Looking for self-employed insurance?
With Simply Business you can build a single self employed insurance policy combining the covers that are relevant to you. Whether it’s public liability insurance, professional indemnity or whatever else you need, we’ll run you a quick quote online, and let you decide if we’re a good fit.