Click to learn more about author Ashok Sharma.

Here’s news that may shock you about cyberattacks. No, it’s highly unlikely that your business is being targeted. Your data security is probably just weak.

A Clark School (University of Maryland) study found that, on average, there is a hacker attack every 39 seconds, and these attacks affect one in three Americans annually. This is only for the cyberattacks led by human attackers. For those that involve bots or the spread of malware, the volume is exponentially higher.

Data theft and other cyberattacks have been increasing, even in the midst of a pandemic. Cybercriminals incessantly attempt to compromise security systems, steal data, or access computers and networks whenever they find the opportunity to do so. Worse, they are evolving the sophistication of the attacks they use to circumvent standard security measures.

In August, for example, Canon was reported to have suffered a ransomware attack by the Maze ransomware gang. This resulted in the theft of over 10 terabytes of data, private databases, and other digital assets.

Everyone Is a Target

It’s not you. It’s everyone. If you think your organization has had too many security incidents in a week or a month, it does not necessarily mean that your organization is being singled out. The most likely reason is that your defenses are too weak.

Organizations that are encountering too many data breaches should consider doing a comprehensive security testing and cyber risk assessment. While four out of 10 attacks usually involve small businesses, this does not mean that attackers specifically aim at these entities.

Except for DDoS, most cyberattacks tend to be random or indiscriminate. According to Purplesec’s 2020 Cyber Security Statistics, the top three most common attacks are as follows: web-based attacks, social engineering, and general malware. All of these are considered to be non-targeted attacks.

Non-targeted attacks do not select potential victims based on specific criteria. They do not steal information, spread ransomware and other malware, or intrude into the network of businesses because of sales figures, asset valuation, number of employees, or other considerations. Often, the traps are just laid out in the open, waiting for someone to unwittingly fall for them.

Ransomware, for instance, is usually not sent to specific companies or establishments. In general, they are spread through social engineering, as email attachments, for example, to reach possible victims. Similarly, social engineering attacks are fielded indiscriminately while the perpetrators await possible victims to respond favorably.

Many businesses end up thinking that they are being targeted simply because their security systems are inadequate. Attacks repeatedly penetrate their networks because they do not have the right defenses. Worse, even after detecting that they have been compromised, they fail to implement meaningful deterrents.

One major reason why small businesses comprise a significant chunk of the usual victims of cyberattacks is their lack of reliable cyber defense. According to the Hiscox Cyber Readiness Report, 73 percent of companies are not prepared to handle cyberattacks, and nearly 3 out of 4 small businesses do not have competent and enough personnel to handle IT security.

What Businesses Should Be Doing

The logical thing businesses should do is to invest in a reliable data security system. This means getting the right software tools, setting them up, and having the right people to handle IT needs. It can be costly, but there is a price to pay to ensure dependable data security.

Simply having an IT department does not suffice as a cybersecurity measure. “IT is not cybersecurity” — this is what longtime CISO Eric Kellog asserts in a piece he wrote for CSO Online. “Having IT isn’t enough anymore; businesses need a separate security team also,” Kellog maintains.

In addition to investing in a good cybersecurity system and hiring the right people to take charge, here are other things businesses should do to deal with cyberattacks better.

• Provide Employee Training: Humans are said to be the weakest link in cybersecurity. They can be tricked to do things that defeat security measures. It is only logical to help them overcome their security weakness by providing the right training or orientation. By educating employees about the different threats, they are less likely to ignore warning signs of a possible attack and fall for the social engineering schemes of bad actors.
• Update Your Software: This may sound like a simple and mundane process, but it is one of the most important tips to ensure security. Software updates usually include vital security improvements or patches to address recently discovered vulnerabilities. These are almost always free, so there is no reason not to update the software you use for your business.
• Implement Strict Protocols for Physical Access to Computers: Fighting cyber threats is not just about the software and online side. Attacks can also be made directly to the computers themselves. The movies are not making this up: Spies or special agents can indeed plug directly into the servers or computers to steal information, modify systems, or inject malware. Businesses need to be mindful of the security of both their hardware and software.
• Secure Your Wi-Fi Networks: In addition to ensuring the physical security of your computers or servers, it is also necessary to protect Wi-Fi networks by using strong passwords and hiding the SSID.
• Always Create Backups: There are no perfect security systems. Even the best lines of cyber defense can fall to creative and sophisticated attacks. To avoid data loss, companies should religiously create backups for their important data.
• Use Firewalls: Firewalls sound like old and obsolete technology. Well, some are, but there are also modern ones that afford relevant protection. CSO Roger Grimes of Insider Pro provides an excellent summary of this: “Traditional firewall software no longer provides meaningful security, but the latest generation now offers both client-side and network protection.”
• Require Separate User Accounts for Every Employee: Providing common accounts when accessing computers in the office is bad cybersecurity practice. It negates accountability whenever something untoward happens. Common user accounts are prone to abuse.
• Regulate Employee Access to Digital Assets: Having a healthy dose of skepticism is never bad. It is difficult to trust anyone when it comes to cybersecurity. Employees may be deceived into giving away information that is supposed to be restricted to internal use. Likewise, they may unwittingly dismantle their company’s cybersecurity system after exchanging messages with a crafty cybercriminal. As such, it is important to set limits as to what employees can access. Having a permission-based system for resource and data access is a boon to cybersecurity.
  

Preparing for Cyber Threats

More often than not, business data is more important than other assets that an organization has — even more than cash, for example. Any business should thus presume that it can be a target of such cyber threats and that its business data is at risk of being stolen and utilized for nefarious means. To ensure the security of data, organizations need to establish protocols and measures to prevent such theft. This will require educating users and utilizing platforms that provide continuous assessment of risks and protection against attacks.