Skip to main contentSkip to navigationSkip to navigation
hacking
In an experiment, even a 7-year-old could hack into some networks. Photograph: Nigel Davies/HideMyAss.com/PA
In an experiment, even a 7-year-old could hack into some networks. Photograph: Nigel Davies/HideMyAss.com/PA

Cybercrime and hacking are even bigger worries for small business owners

This article is more than 9 years old

Hacks cost the American economy $100bn a year, and it’s not just the Sonys and Targets of the world. Some experts offer advice on how small businesses can fight the wave of cybercrime

Cybercrime. It was the talk of Washington at President Obama’s 2015 State of the Union, adding one more city to the world tour of technological fear: London, New York, Los Angeles, Paris. Even though the Charlie Hebdo attacks on the French capital were physical in nature, serious cases of cybercrime were reported soon after. In an effort to stymie these attacks, President Obama and Britain’s Prime Minister Cameron recently announced a joint cybergames war test.

And while much of focus has been on attacks on Target, JPMorgan Chase and Sony, small businesses are far from immune.

Hackers targeted 19,000 French websites soon after the terror attacks. According to Arbor Networks, France was the target of 1,070 denial of service attacks. (In 2011, hackers breached the PlayStation network, resulting in a shutdown for several weeks. The cost to Sony was $170m.)

A report from McAfee found almost 90% of small- and medium-sized business in the US do not use data protection for company and customer information, and less than half secured company email to prevent phishing scams.

This is an expensive mistake. Cybercrime and cyberspying cost the US economy $100bn a year and the global economy about $300bn annually, according to the Center for Strategic and International Studies.

According to PwC, the average cost of a firm’s worst security breach is rising significantly. For small businesses, the worst breaches cost between £65,000 and £115,000 on average; for large firms, the damage is between £600,000 and £1.15m.

President Obama and the UK prime minister, David Cameron, have sworn to start a cybergames war test. Small-business owners shouldn’t wait that long. Photograph: Xinhua /Landov / Barcroft Media

What small business owners can do

According to a study by PwC for the UK Department for Business, Innovation and Skills, the number of security breaches has decreased even as the scale and cost has nearly doubled.

However, there has been a marked increase in spending on information security in small businesses.

A survey by accounting firm EisnerAmper showed 62% of company directors cited cybersecurity and IT risks as an important concern, up from 53%.

But where should an entrepreneur start?

First, make sure employees aren’t accessing the wrong kind of websites.

Cyrus Walker, CEO of Chicago-based Data Defenders says research shows approximately 80% of security-related incidents occur as a result of employee behavior.

Log-aggregation software known as Security Event Information Management gives a clear picture of transactions occurring internally and externally from the company’s network.

But not everything an employee does will come through a work computer. Much of the ire of law enforcement is directed at firms such as Apple and Google for software updates that make it impossible to gain access to the content of devices that use their mobile operating systems.

Manhattan district attorney Cyrus Vance Jr, speaking at a recent Crain’s New York breakfast, said cybercrime will thrive as long as major consumer-technology companies create privacy locks against employers and law enforcement. “I don’t know anybody in the cyberworld who thinks we are winning. We’re not going in like the NSA. I think Apple and Google should reverse themselves.”

“There is some irony is the debate,” said Scott Vernick, a partner at Philadelphia-based Fox Rothschild. “Tech firms are very pro-privacy when it comes to protecting their consumers; less so with how they themselves use it. Vance might be right when it comes to counter-terrorism. You want to have an efficient way to get at this data.”

Small-business owners should also scrutinize their vendors, explains John Fodera, a partner at EisnerAmper.

“You have to start by doing a cyber-risk assessment and analyze the data from your employees and customers, and how you’re protecting that information”, Fodera advises. “Some breaches, such as Target, came in through a third party. So analyze your vendors to make sure are they complying with your privacy and security policies.”

The final piece is cybersecurity insurance.

Lloyd’s of London and firms in the United States offer cyber-liability coverage. Coverage depends on what industry you are in. Retail and finance are in the higher-risk bracket.

Scott V Lockman, director of commercial insurance for insurance provider Clements Worldwide said: “Cyber-liability protection has been around for about a decade, but insurance companies have become better at identifying risks and are able to underwrite against those risks.”

In smaller firms, it is usually the chief financial officer who is responsible for the insurance.

Lockman said that person should ask the following questions: How much does the firm utilize the internet? How much information is being stored on it? How are they communicating with their clients? What does that risk mean to them in terms of potential loss? Companies can purchase insurance or train staff internally.

Said Mark Clancy, CEO of Soltra: “I use Richard Clarke’s [former national coordinator for security, infrastructure protection and counter-terrorism] definition. You have criminals, hacktivists who are politically motivated, espionage actors and destructive actors. Criminals were those involved with the Target breach.”

The Obama administration is proposing a federal system of cyberbreach reporting with a 30-day window. That initiative has been around for many years. “I’m in favor a national standard [at present, each state has its own rules] and I believe 30 days is the right amount of time to report a breach,” said Vernick. “After the Target breach, Minnesota required reporting in five days. I don’t know what you can tell people after five days.”

“Criminals are attacking companies, and the firms are responding without any coordination. If you share information, you can change the proverbial locks on the door so they aren’t pickable,” explained Clancy. “Every criminal on the planet lives on your street. You can invest proactively and be ahead of the curve, or invest in response to incidents.”

More on this story

More on this story

  • Hackers accused of targeting US and Yahoo arrested in major UK crackdown

  • US offers highest-ever cybercrime reward for arrest of Russian hacker

  • How you could become a victim of cybercrime in 2015

  • Kenya arrests 77 Chinese nationals in cybercrime raids

  • Cybercrime now becoming a serious problem for many Britons

  • Legal and General calls on stock market giants to fight cybercrime

  • Crimtrac Acorn system could enable cybercrime reporting by mouse click

Comments (…)

Sign in or create your Guardian account to join the discussion

Most viewed

Most viewed