Yes – in reality, small to medium businesses are targeted by cyber criminals more so than larger companies.

Why do hackers attack small businesses?

There are a few reasons why specifically target smaller businesses, but usually hackers assume small businesses are easier targets and have weaker security systems. In addition, some smaller businesses can house information for larger corporations and provide a gateway to vital information leading to a hacker’s unauthorized entry into a larger corporation.

Hackers also prey on smaller and medium-sized businesses for ransom attacks. These attacks will result in the attacker stealing information from the company and more often encrypting their locally stored data and information. These attacks can result in the company being unable to access its data. Then the hacker will ransom the data back to the company for a price, making smaller businesses a target for acquiring illegitimate monetary gain.

How often do SME’s get hacked?

43% of cyber-attacks target small businesses, according to a recent Verizon report. The number of cyber attacks are forecast to increase due to more and more companies operating remotely, allowing for a significant reflux of new attacks and hacking techniques to circumvent existing or pre-existing security protocols and methods. These latest hacks are why it is crucial for all businesses, small to large, to maintain up to date security and excellent security protocols and techniques.

In light of the recent pandemic, small businesses could be an even bigger target, as several small companies have shifted to conduct business online. This migration to digital has opened a new gateway for cyber criminals to access valuable data, especially for those companies unaware of the potential risks when moving to a purely online environment. According to Shepherd, from 2019 to 2020, there was a “424% increase in breaches within small companies in the last year.”

Types of cyber crime that affect SME’s

“88% of organisations worldwide experienced spear-phishing attempts in 2019.”

Phishing attempts are just one of many areas in which companies are targeted. Other types of attacks can include, but are not limited to:

Weak passwords, resulting in compromised passwords
‘Drive by’ infections
Scanning networks for vulnerabilities and exploitation
Malware attacks
Ransomware attacks
Brute force attacks

These attacks can come from anywhere at any time and can affect anyone. Some of these attacks are hidden in plain sight, whilst others adopt a more direct approach.

Some attacks prey on human error and will specifically target employees inciting them to click on an infected file or document. This action can unknowingly download malicious software to their device, giving the attackers free roam of their device and potentially their whole network.

Other attacks are live attacks that happen in real-time, including DDOS (Distributed Denial of Service Attack), which interrupts communications between the host server and the end user, exposing an open doorway for would-be attackers to enter the network’s servers. This access gives the attacker the means to steal and/or destroy data and information at their whim.

Do small businesses need cyber security?

Yes – to put this into context, imagine your house having no doors, windows, or any means to stop intruders from entering your home. It’s unheard of and poses not just a risk to the contents of your house but also your physical safety! The same applies to business security.

Businesses hold valuable information on all of their stakeholders and customers. This information should be kept secure and well protected, and in some countries, it is mandatory and can cause significant repercussions for the company should their ‘secure’ data be leaked.

How much does a small business spend on cyber security?

According to Shepherd, “83% of small businesses have not put funding aside for dealing with a cyber-attack”, and “60% of small businesses that are victims of a cyber-attack go out of business within six months”. The monetary damage can come in various forms, including costs from downtime and lost reputation. To fully understand the implication that an attack can have on your business, Shepherd states that “cyber-crime costs small and medium businesses more than $2.2 million a year” with a projection to “cause $6 trillion in damage by 2021”. With these figures, the real question is how much should small businesses be spending on cyber security?

According to industry experts, businesses are advised to invest at least 3% of their total spending into cyber security. Planning and investing in cyber security should not be overlooked. Failure to properly secure your data can result in some very costly repercussions, both in courts of law and potentially to the attacker as well.

How can ISO 27001 help small businesses?

By no, you are aware of the sever implications of not adequately protecting your business, with the possibility of fines, data leaks, lawsuits, damage to reputation, and even loss of trade secrets and intellectual property. ISO 27001 proves that you are taking information security seriously. Every business needs an information security management system (ISMS) to understand and manage corporate risks and comply with data security regulations. Small businesses looking to invest in their information security, look to ISO 27001 for multiple additional benefits.

The main benefits of ISO 27001 for small businesses are:

Protects information and improves security
Establishes trust and can give you a competitive advantage
Assists in compliance with legal regulations, such as GDPR
Creates new systems and processes
Reduces the need for customer security audits because you have an independently certified ISO

The benefits of ISO 27001 can vary depending on your unique business. However, the advantage of having an information security management system is evident, especially for small businesses.

If you’d like to discuss your business needs and find out if ISO 27001 could work for your company, our experts are here to answer all of your questions.