The increase in sophisticated and well-disguised cyber threats has become a concern for small to medium sized business owners.
Analysts predict by 2025; cybercrime will cost the world economy around $10.5 trillion annually. If it were measured as a country, cybercrime would be the world’s third largest economy after the U.S. and China.
Cyber attacks, email and text phishing scams, malware, and distributed denial of service (DDoS), an attack designed to force a website, computer, or online service offline, cost Australians $3.1 billion in 2022.
The Australian Cyber Security Centre (ACSC) found the average cost per cybercrime was $49,600 for small business, $62,800 for medium business and $63,600 for large business in 2023-24.
Why cybercriminals target SMEs
Just like large organisations, your small business collects customer data and sensitive information such as first and last names, home and email addresses, and phone numbers. Depending on your business you may also have financial or medical information about your customers, clients, or patients.
This business-critical information is just as valuable to cybercriminals as it is to you. Keeping information about your business and customers secure is not just essential, it’s a legal requirement.**
While many people believe cybercriminals focus mainly on large organisations such as banks and telecommunication companies – as they’re the ones that make the news when a breach happens – the truth is, they see SME as easier targets.
Unlike large businesses with dedicated cyber security teams and leading-edge security systems, small and medium sized enterprises often do not have the IT infrastructure to prevent an attack. They also rarely implement stringent cybersecurity protocols or have the internal resources to properly train employees to understand the risks of cybercrime.
Protecting your business
ACSC offers some simple and cost-effective ways you can improve your security. These include:
- Turning on multi-factor authentication (MFA) wherever possible.
- Use a password manager to create and store unique passwords or passphrases.
- Ensure employees or contractors can access only what they need for their role. Sometimes referred to as Zero Trust Network Access (ZTNA).
- Educate employees on protocols when opening attachments or sending sensitive information. Include this in your onboarding process for new employees.
To protect your devices and information:
- Turn on automatic updates for your devices and software so any lost information can be recovered quickly.
- Set up security software to complete regular scans on your devices.
- Speak to an IT professional about ways to secure your network. This could include penetration testing to find and fix network vulnerabilities.
- Perform a factory reset before selling or disposing of business devices.
- Configure devices to automatically lock after a short time of inactivity.
- Understand the data your business holds and your responsibilities to protect it.
Understanding the main causes of a data breach:
A data breach can usually be divided into three categories:
Cyber Attack
- Phishing scam - email and text scam messages.
- Ransomware / Malware – demanding payment for the release or return of data.
- Online Identity Fraud – impersonating someone in your organisation or associates (also known as a bad actor) to obtain Personal Identifiable Information (PII).
- Distributed Denial-of-Service (DDoS) - this floods your website with traffic to prevent users from accessing online services and sites.
Human Error
- Failure to configure devices correctly - especially devices used by remote or hybrid employees.
- Opening a scam email or website.
- An intentional data breach by a disgruntled or ex-employee.
- Not correctly following or updating security protocols.
Physical Attack
- Theft of documents or devices.
- Incorrect wiping of data before correctly disposing of older devices.
- Skimming card or device.
In addition to potential data loss, the cost of lost productivity and revenue due to downtime, there’s the reputational damage to your business.
More than money
But even more important than the financial cost is the toll a cyber attack can take on the mental health and wellbeing of a business owner and employees.
Scams can have a long-lasting and traumatic impact on people’s mental health. People that are victims of online scams feel stressed, embarrassed, and ashamed, often blaming themselves, which can impact their confidence using technology.
A cyber breach can severely affect personal and professional relationships, increase stress with the fear it may happen again, and elevate workloads as business owners and employees work additional hours in an attempt to recover lost sales and income.
Providing support to your employees can alleviate their concerns and enhance morale.
Cyberattacks are common among small businesses and can be devastating. By having a recovery plan in place and reinforcing your security protocols, you can minimise the damage to your business, employees, and yourself. For advice on how you can help the mental health of your employees contact the team at peninsula.