Photo by Anete Lusina / Pexels
If you’ve watched or read the news, you’ve probably seen stories about companies who have reported data breaches and ransomware attacks. Sony, Home Depot, Colonial Pipeline, JPS Foods, Equifax and several other large companies have all reported some form of cyberattack in which either customer data was stolen, or the companies were hit with ransomware attacks.
It seems that only large businesses are being targeted by cybercriminals because the large corporations are the ones that make the news headlines. But, that’s not necessarily true.
Types of Cyberattacks
Cyber criminals target both small and large businesses everyday using phishing techniques that involve ransomware, trojan horses and viruses to attempt to trick employees into clicking a link that looks legitimate—only to find out after clicking the link that it was not a good idea.
Computer worms are also an issue for businesses because worms can replicate themselves. Computer worms are often used to target particular software systems like public water systems, power and other utility companies. Companies can also face distributed denial of service (DDoS) attacks and cyberattacks that involve the takeover of the company’s website. In a DDoS attack, a website is unresponsive or slow to respond because of the amount of traffic being directed at the website. In a website takeover attack, the website is often defaced with promoting products and services unrelated to the business or the website is replaced with a message from the cyberattack.
Ransomware Attack
The biggest threat to businesses these days are ransomware attacks. In a ransomware attack, cybercriminals will copy system files and documents before the ransomware software locks and encrypts the business’ computer systems, subsequently requesting a ransom payment in Bitcoin or another type of cryptocurrency. Cybercriminals will request bitcoin or another form of cryptocurrency as payment for a ransomware attack because it’s more difficult to trace cryptocurrencies once the ransomware payment has been made. It is more difficult to trace a cryptocurrency or Bitcoin transaction because the transaction detail does not contain the user or account information that shows who the parties were in the transaction.
The FBI has reported in the past few months that they have had some success in tracking and recovering Bitcoins after Colonial Pipeline was hit with ransomware attack and paid the ransom to receive the encryption key to restore their system.
Cyberattack Insurance
Businesses have turned to purchasing cyberattack insurance, which can lead to a belief that if the business pays a cybercriminal, they can get their system back online and request a refund from the insurance company by filing a claim. However, if you pay the ransomware, there is a probability that the key the cybercriminal provides in exchange may not work and all the files may not be completely restored or accessible.
Additionally, if you pay the ransomware, you become a target for the cybercriminal or the cybercriminals to use ransomware against your business multiple times. Before purchasing the cyberattack insurance, business owners need to read the policy details. Some insurance companies have made it difficult to file a cyberattack claim while other carriers require companies to keep their systems up to date on security updates and software patches.
Keeping System Software and Security Software Up to Date
It’s important for business owners to keep their system updated with security patches and software upgrades. Hackers look for known vulnerabilities to infiltrate business systems and servers. While most businesses are moving to the cloud for software services, it’s important to know that businesses still face the possibilities of cyberattacks even on the cloud. It’s important for businesses to require strong passwords to access cloud software services.
Small businesses often don’t have the employee and financial resources to keep their software and security systems fully up to date. Even with limited resources, it’s still important for the small businesses to have some type of virus detection, internet security, and malware detection software, and to regularly update the computer’s operation system software with software updates.
Before clicking on a link in an email, hover your mouse over the link to see if the link is associated with a website that you are familiar with.
Some targeted companies have tried to restore their computers and systems from backups. But unless you update your computer’s operation system software and applications, you are still vulnerable to another cyberattack.
If your business is a victim of a cyberattack involving a data breach or ransomware attack, the law requires you to report the attack to the FBI by contacting the local FBI field office or by filing a criminal complaint through Internet Crime Complaint Center at ic3.gov.
