When it comes to security, businesses can be at a loss when the crime occurs online. No robber hides around the corner; no corner store gets held up. In fact, cybercrime can happen in broad daylight with just a few lines of text in an email. 

We spoke with Ed Blackman, Reckon’s CTO, to get him to weigh in on Cybersecurity Month. One of Blackman’s many duties is reviewing and implementing Reckon’s cybersecurity policy, which keeps Reckon staff and customers safe from online attacks.

So, what is cybersecurity? And what can small businesses do to stay safe?

Defining Cybersecurity

The industry behind cybersecurity is huge. More and more businesses and individuals are affected, amounting to eye-watering damages that have crippled businesses big and small. The need to protect yourself on an ongoing basis is becoming more evident.

According to a report from the Minister of Defence, Richard Marles, and the Australian Signals Directorate, average losses by size of business due to cybercrime are up by 14% from 2021 to 2022.

Averaging $71,600 for large-sized businesses
Averaging $97,200 for medium-sized businesses
Averaging $46,000 for small-sized businesses

Now, more than ever, small businesses must consider their security. Blackman defines cybersecurity simply for small business owners.

Well, it’s basically just protecting yourself, personally, and your business against threats in the cyber world that could harm or cause you and your business loses.

Investing in your security

Understanding how much you need to invest in your small business’s security is important. But it’s not as simple as it seems.

It really depends on the size of the business and its risk. So, there is certainly not a one-size-fits-all answer for all types of businesses.

Your cybersecurity policy and protections need to be scalable to your means and realistic in response to your risk exposure.

Your policy should address the common threats cybercriminals pose to you and your small business.

The two most common threats are financial loss and data breach. They’re probably the two biggest things businesses need to consider protecting themselves against. 

Cybercriminals, tools, and tactics

When cybercriminals try to access your data, your cybersecurity plan should consider several things.

Turn on multi-factor authentication for all your accounts that contain valuable data, even those that don’t, because people can attack those to access more valuable accounts. 

Another policy to implement is passphrases instead of regular passwords.

A passphrase helps you think of a couple of completely unrelated words to create a long password that is difficult for an attacker to crack.

When cybercriminals try to crack a password, using a particular passphrase can be the difference between needing a couple of days to break the password or 36 years.

Passwords and passphrases are a fact of life now. You need to protect yourself and your business. Having trouble remembering the never-ending list of passwords? No worries, Blackman has a solution.

The best place to start is with a password manager. This tool allows you to have unique passwords without constant individual maintenance. All it requires is for you to come up with your original password/passphrase to get access, and you can let the service do the rest.

Are cybercriminals looking for more than just data?

Cybercriminals are after more than raw data. As we’ve seen recently, attacks involve cybercriminals gaining access to personal information and important accounts related to either bank accounts or business systems.

They’re trying to get PII (personally identifiable information) about you or your customers so that they can proceed with further attacks. 

They will also want to access your account and look at things like invoices. Cybercriminals will draft new copies using your invoices and the design and resend them with your spoofed email address. This is an everyday fraudulent financial activity that businesses experience.

Opportunity vs. targeted cyber attacks

Cybercrime, while occurring virtually, resembles how theft is carried out physically. There are opportunistic attacks, where an attacker has, by chance, noticed a vulnerability and will exploit it, versus targeted attacks, which are pre-meditated. Think of a targeted attack like a thief casing a bank to plan their next heist.

Knowing the difference is key to a sound cybersecurity strategy, and a policy that mitigates these types of attacks is vital. 

The critical difference is that you basically need to put the key mitigations in place to prevent all threats.

The key difference between an opportunistic and a targeted attack is the level of the person they’re going after or the type of person. A more targeted attack will be aimed at a senior leader in a business. 

Ultimately, it comes down to people. Cybercriminals exploit knowledge gaps to gain access to sensitive information. By educating yourself and your staff, you can learn to spot phishing attempts or scams and mitigate or prevent critical losses.

Another key defence you must implement is regular training for yourself and your staff on recognising attacks. Ensure your staff, especially those in key positions, know basic fraudulent attacks, such as phishing and spear phishing tactics.

Cyber-breach aftermath 

Small businesses can be confused about where to turn after a breach or an attempted breach. When a breach occurs, you can’t just call 000. That’s where the Australian Signals Directorate (ASD) comes in.

If you don’t think you’re sufficiently skilled, the first thing to do is get help. The government has an excellent resource called cyber.gov.au. That is my advice; the first place you should go is there. 

There’s a whole section on what to do when you’ve been breached; work through the advice and the steps that they suggest. If you have any breaches, attempted breaches, or are unsure, go there.

Whether you are creating a new policy or reviewing your current one, it is important to remember that your security is ongoing. Make sure to go through our cybersecurity checklist to inspire your own policy. Stay vigilant, and make the most of Cybersecurity Month.