Cybersecurity Best Practices for Small Businesses

Cyberattacks are becoming more frequent and complex, and businesses of all sizes and industries are potential targets. In fact, cybercriminals increasingly go after small businesses since they contain much of the same types of sensitive information as larger enterprises but often have weaker cybersecurity defenses. Verizon’s 2023 Data Breach Investigations Report found that 43% of all cyberattacks target small businesses, and 60% of those victims go out of business within six months of the attack.

Common Cyber Threats

Even if a small business survives a cyberattack, there can still be devastating consequences, such as high costs, reputational damage and unanticipated downtime. To best combat these risks, small business owners need to be aware of common cyber threats they may face, including:

Phishing

Phishing is a cyberattack that utilizes deceptive emails or other electronic communication to manipulate recipients into sharing sensitive information, clicking on malicious links or opening harmful attachments. Emails are the most common delivery method for phishing attempts, but cybercriminals may also use text messages, social media messages, fake or misleading websites, voicemails or even live phone calls.

Business Email Compromise (BEC)

A BEC scam entails a cybercriminal impersonating a seemingly legitimate source—such as a senior-level employee, supplier, vendor, business partner or other organization—via email. The cybercriminal uses these emails to gain the trust of their target and trick them into wiring money, sharing sensitive information or engaging in other compromising activities.

Malware

Malware is a general term that describes viruses, worms, Trojan horses, spyware, adware, rootkits and other unwanted software or programs. Once a malware program has gained access to a device, it can disrupt normal computing operations, collect information and control system resources.

Insider Threats

Workers who have access to sensitive information, including contractors with access to the company’s network, may be aware of existing security weaknesses and can exploit them more easily than outsiders.

Password Attacks

Using weak or easily guessed passwords or using the same password for multiple accounts can result in compromised data.

Cybersecurity Best Practices for Small Businesses

To limit the risk of cyberattacks, small business owners should implement the following cybersecurity best practices:

Employee Education

Workforce cybersecurity education is essential to teach employees to identify phishing attacks, social engineering and other cyber threats.

Cybersecurity Software

A network firewall can prevent unauthorized users from accessing company websites, email servers and other sources of information accessed through the internet.

Multifactor authentication (MFA)

Important accounts, including email, social media and banking apps, should require MFA to limit the opportunity for cybercriminals to steal data.

Data backups

Essential files should be backed up in a separate location, such as on an external hard drive or in the cloud.

As cyber threats become more severe, small businesses should take protective measures to secure all company, personal and financial information.

Related Reading: Small Business Insights—The Importance of Business Interruption Insurance

The above information does not constitute advice. Always contact your insurance broker or trusted advisor for insurance-related questions.