News coverage of cybersecurity focuses on large breaches and exotic attacks. Small businesses are mostly hurt by something much more ordinary. The attacks below are common because they are cheap to run and they work on businesses that have not closed the basics.
The good news is that the defenses are not exotic either.
1. Phishing that steals a password
An email looks like it came from Microsoft, your bank, or a vendor. It sends someone to a page that looks right and asks them to sign in. Now the attacker has that person’s email login.
What helps:
- Turn on multi-factor authentication for email first, then everything else. A stolen password alone then stops being enough.
- Teach people one habit: if a message creates urgency around money or logins, check it through a second channel.
- Use a password manager, so people are not typing passwords into pages they reached from an email.
2. Fake invoices and changed bank details
This one needs no malware at all. Someone gets into an email account, or imitates one closely, and sends a real-looking message: “Our bank details changed, please use the new account for this invoice.” Money goes to the wrong place, and it is very hard to get back.
What helps:
- A simple rule: any change to payment details is confirmed by phone, using a number you already had, never one from the email.
- Multi-factor authentication on every mailbox, especially the owner’s and whoever handles payments.
- Alerts on new mail forwarding rules, which attackers often create to watch your email quietly.
3. Ransomware through an exposed or unpatched system
Ransomware locks your files and demands payment. It commonly gets in through a remote access service left open to the internet, a system that has not been updated in a long time, or a login stolen through phishing.
What helps:
- Keep systems and software updated, and retire anything the vendor no longer supports.
- Do not leave remote access open to the whole internet. Put it behind a VPN or a managed gateway with multi-factor authentication.
- Keep backups that ransomware cannot reach (see number 6).
4. Reused passwords
When one website is breached, the stolen email and password pairs get tried on other sites. If someone used the same password for a vendor portal and your accounting system, the first breach becomes the second.
What helps:
- A password manager that generates a different password for every account.
- Multi-factor authentication on anything that holds money, customer data, or email.
5. Accounts that should have been closed
A former employee still has email access. A contractor’s login still works two years later. A shared account has been passed around so long nobody knows who has the password. None of this is an attack until somebody uses it, and then it looks like a normal login.
What helps:
- A short offboarding checklist: email, software accounts, shared passwords, building and phone access.
- Individual logins for everyone instead of shared accounts, so access can be removed one person at a time.
- Once or twice a year, a review of who has access to what, especially admin rights.
6. Backups nobody has tested
Many businesses have backups. Fewer have ever restored from one. A backup that has quietly failed, or that sits on the same network as the files it protects, can be encrypted along with everything else.
What helps:
- Keep at least one copy off-site or offline, separate from your main network.
- Test a restore on a schedule. Pick a file, restore it, and confirm it opens.
- Write down how long a full recovery would take, so a bad day is not the first time you find out.
Where to start
If you do only three things this month: turn on multi-factor authentication for email, set up a password manager, and test one backup restore. Those cover the largest share of the attacks above.
A cybersecurity audit goes through all six of these for your business and gives you a written list of what to fix first. If you would like to talk it through, tell us what is going on.