Cyber Security Lesson 1 – Close the Front Door
Over the past 6 months, Elemental Concept have been building up its capabilities to provide cybersecurity advice.
We are lucky to have worked with many SMEs who wanted a common-sense approach to understanding their cyber risk and a plan to mitigate it in a prioritised fashion. It makes sense – we take this approach in technical development, and clients want us to provide a similar staged approach that aligns with their business and, of course, their budgets.
Do cyber criminals target small businesses?
As an SME it is easy to think you might not be an obvious target for hackers.
The good news: If you have very little traction, don’t operate in a sensitive industry and don’t store Personally Identifiable Information (PII), you aren’t likely to be the target of a nation-state hacker group. Phew.
But before you get too complacent, that doesn’t mean you won’t get hacked, and the damage could be catastrophic from both a financial, intellectual property and reputational perspective. That’s not good news.
Shut the front door – a common sense cybersecurity approach
When we started doing passive scans for a number of SMEs we were able to explain to them that they were an inadvertent opportunity to a hack.
The analogy we use is that of a homeowner.
Even if you don’t have a mansion filled with treasure, a burglar will not pass up the opportunity to look at what you have if you leave the front door wide open.
What cyber vulnerabilities might small business owners encounter?
We have found numerous vulnerabilities using the same tools that opportunistic criminal hackers use in scanning companies’ web presence. I’ve laid some of them out in layman’s terms (as none of you will want me to try to explain what weak SSL/TLS Cyphers mean, or how someone could engage in Clickjacking… and if you do, get in touch!)
The most common cyber threats we have come across for small businesses are as follows:
- Weak Passwords
- Out of date software
- Lack of Input protection
- Lack of or outdated encryption between the site and server
- Open or unsecured ports
- Missing Content Security Policy
So having listed some of the problems we (or indeed any hacker!) can find, you probably want to know what it means and what damage it can do to your company. Again I’ve tried to summarise this into broad categories.
The most common damages to small businesses, as a result of a cyber attack
Exposed PII – AI
If someone nefarious can get into your website, they can steal the data of your customers and your team. I’m sure you have seen the data leaks, fines, reputational damage and ransom demands in the press.
Intercepting and replacing your communications.
Weak (or no) encryption on your comms means that not only can someone read your messaging, but they can also intercept it and replace it. This means that they can not only steal details, but they can pretend to be you.
Taking control of your website.
Even if you are only a brochure website you don’t want a hacker to take control of its content. Not only can they deface your website and destroy your reputation, but they can also install malicious code to infiltrate whoever visits the site.
Using your site for their own purposes.
You don’t want your site to be the instigator of a Cyber Attack (such as a Distributed Denial of Service) or otherwise. You will get blacklisted and also may face some unexpected costs.
Embedding your site into their own.
Criminal hackers can embed your site on their own, making visitors think they are on your site when, in reality, they are giving their PII to the hacker.
Hijacking your email.
Being able to send correspondence as if coming from your company (think fake invoices to your customers)
This list can go on and on but I think you get the point. Bad housekeeping of your website can cause quite a lot of financial and reputation damage.
What can small businesses do about these cyber threats?
The good news is that the fixes aren’t usually complex – they are the IT equivalent of closing that front door and keeping opportunistic burglars out.
Speak to us.
At Elemental Concept, we have an experienced team that can not only help you identify if your door is open but can also help you shut it. Let us help you keep the opportunistic criminal hacker out. After that we can talk about locking the door and putting the alarm on, should you need to.
If you would like to see if your front door is open, please get in touch.
You can find out more about our common-sense cyber security approach here, including information on our pen-testing services.