5 Cybersecurity Tips for Small Businesses

The digital landscape is increasingly treacherous, with online cybersecurity threats posing significant risks to businesses of all sizes. 

From hacks and scams to malware attacks, viruses, and ransomware, these digital assaults have become alarmingly frequent. While estimates vary, some studies indicate that there’s a cyberattack every 39 seconds or over 2200 a day. Statista.com projects that these attacks will cause losses exceeding $639 billion for U.S. companies in 2025.

The same computer systems that facilitate remote work and enhance productivity expose companies to security risks. Cyber threats can be a particular problem for small businesses with limited resources or technical skills. Hackers are quick to exploit these weaknesses, making small enterprises a prime target.

Oregon Small Businesses Are in the Crosshairs of Cybercrime

Several factors make Oregon’s small businesses vulnerable to cyber threats. Unlike large corporations with dedicated security teams, small businesses often operate with tight budgets. This makes comprehensive security measures seem like a luxury rather than a necessity.

Without specialized knowledge in cybersecurity, small business owners and employees struggle to detect and respond to potential threats. Older hardware and software also contribute to small businesses’ security risks since outdated equipment is more susceptible.

Some Oregon small businesses operate with a false sense of security. They assume that online criminals target larger companies with significant budgets. 

Small businesses hold valuable data

Despite their size, small businesses often hold valuable customer data, financial information, and intellectual property, making them attractive targets for online criminals. Criminals use this data for identity theft or other scams.

Business owners have a responsibility to protect the personally identifiable information (PII) of their stakeholders, whether they’re patients, customers, or employees. This sensitive data includes things like names, Social Security numbers, and credit card information.

Even if your business doesn’t handle customer PII, you likely possess intellectual property that requires protection. Examples include trade secrets, patents, copyrights, and trademarks. Robust security solutions will also safeguard your employees from falling victim to online predators.

The ripple effect of cyberattacks

The consequences of a cyberattack on a small business can be far-reaching. Potential impacts include:

• Financial losses, including direct costs from theft, system repairs, loss of business, and potential ransom payments.
• Damage to your business reputation, since successful attacks can erode customer trust.
• Failure to protect sensitive data can lead to lawsuits or regulatory fines.
• Cyberattacks interrupt business operations, leading to lost productivity and revenue.

Technology is a vital tool for businesses of all sizes. No business is immune from hackers’ efforts to steal sensitive information for financial gain. Oregon business owners and their IT leaders need to respond to threats. They must consider their risk management and cybersecurity strategies strategically.

What Are Common Threats to Critical Information?

The first step in protecting your small business against cyberattacks is understanding the threat. Here are some of the common threats to your critical information.

Phishing attacks

Phishing remains one of the most prevalent and dangerous threats to critical information. These attacks typically involve a deceptive email that appears to be from a known and legitimate source. 

If you follow the link inside the email, the criminals can access all personal and financial data you enter. Other links may download malware onto your computer that can see and transmit your passwords.

Other phishing attacks include fake websites made to look like trusted platforms. Examples include popular platforms like Adobe, PayPal, and Google. Successful attacks often serve as a gateway for more severe cybercrimes.

Malware

Malware is malicious software that is often disguised as legitimate. They include:

• Viruses that damage systems and data
• Trojans or spyware that allow criminals to gather your information secretly
• Ransomware

Ransomware encrypts your data. The criminals then control your data and demand payment to release it. 

Weak or stolen credentials

You’ve probably heard about the vital importance of strong keywords. Keeping track of complex and hard-to-remember passwords requires an extra step. However, weak or repeated passwords make your computer systems easier to hack. 

Unpatched software

Outdated software can leave your systems exposed. If your work computer has been reminding you for several days to install updates, you’re giving cybercriminals an opportunity to create a data breach. They can use that period of time to take advantage of security flaws.

Text-based cyber threats

Smishing refers to the same strategy as phishing, but using text messages instead of emails.

One example is the “toll road smishing” scam. Users receive a text that looks like it’s from a legitimate agency. The text says they owe a small amount in toll fees. When they click the link and pay, their personal and financial information is stolen.

Pretexting is another text-based scam. Someone posing as a supplier may text an employee requesting information. If the employee is not on guard to look for scams, they may hand over sensitive information. 

How Can Your Small Business Protect Itself from Cyberattacks?

With limited resources and fewer dedicated IT personnel, your small business might seem like an easy target for hackers. Fortunately, company size doesn’t have to dictate your level of information security.

Protecting your small business from cyberattacks doesn’t require a fortune or a team of security experts. It does demand awareness, vigilance, and a proactive approach. By implementing some fundamental strategies and best practices, you can significantly reduce your day-to-day risk.

Here are five practical, cost-effective measures you can take to fortify your small business against cyber threats. In the world of cybersecurity, prevention is always better and less costly than cure.

Tip 1: Make cybersecurity everyone’s job.

Build a strong defense by integrating cybersecurity job duties into every role. The FCC recommends establishing basic security practices and policies to reinforce that cybersecurity is a collective effort. By making cybersecurity a priority in your employee training, you create a human firewall that can help protect against threats. 

To build a culture of cybersecurity awareness, cover these essential topics in your training programs:

1. Password security: Teach employees to create strong, unique passwords for each account and encourage the use of password managers.
2. Phishing and social engineering awareness: Train staff to recognize and report suspicious emails, messages, and phone calls. Encourage employees to share news updates of scams on the rise.
3. Safe internet usage: Establish clear guidelines for appropriate internet use on company connections, devices, and networks.
4. Social media best practices: Educate employees on the risks of oversharing personal or company information on social platforms.
5. Data backup procedures: Implement and enforce regular data backup routines, including version control.
6. Software updates and patch management: Highlight the importance of keeping all software and operating systems up to date.
7. Antivirus and anti-malware use: Install trusted security software on all devices.
8. Website security: Train employees to look for the “s” in “https” and other signs of secure websites.
9. Handling confidential information: Provide clear protocols for managing sensitive data, including PII and HR data.
10. Mobile device security: If employees are using personal devices at work, include guidelines for securing them.

The detection and response to a security breach can be expensive. Small businesses have to recover from the loss of personal and financial data, as well as customer trust and confidence.

You can protect yourself by ensuring that all new employees take an initial cybersecurity training class. Provide frequent updates via in-person or online training, along with reading materials.

Tip 2: Develop a strong password protocol that everyone follows.

Passwords are your first line of defense against unauthorized access to your small business accounts and devices. A robust password protocol is not just about creating complex passwords; it’s about fostering a culture of security consciousness throughout your organization.

Here are some ways to incorporate strong cybersecurity into your password strategies:

• Require strong passwords that are long and complex, using numbers, letters, and symbols. Discourage the use of easily guessable information like birthdays, names, or common words.
• Emphasize the importance of creating unique passwords and never using the same password twice.
• Work to implement two-factor authentication. 2FA requires two distinct forms of identification to access a device: an account, a mobile app, or a system.
• Use a password management system like Dashlane, LastPass, or 1Password to help your team keep complex passwords secure, especially when allowing sharing across users.
• Change your passwords periodically, especially for critical accounts.
• Implement systems that alert users or IT staff about multiple failed login attempts.
• Consider using passphrases, which are long strings of random words. They are secure and easier to remember than complex strings of characters.

Stay consistent, practicing what you preach to your small business employees. Ensure that all internal and external employees understand and follow your cybersecurity protocols, and do so yourself!

Tip 3: Use firewall security for your internet connection.

A firewall is a network security system designed to monitor and control incoming and outgoing network traffic. It acts as a gatekeeper between your trusted internal network and the potentially hostile external environment of the internet.

There are hardware, software, and cloud-based firewall security technologies. Firewall security prevents potential intruders from accessing your network, safeguarding customer information and preventing malicious software from entering.

Any firewall can work within your small business’s physical location. A cloud-based firewall or endpoint security software can protect devices used remotely. If you implement firewall security for your small business, you want a system that matches your business size and needs. Keep your firewall software or firmware up to date. 

Your Wi-Fi network can be a weak point in your security if not properly protected. Here are ways to keep your Wi-Fi network secure:

• To protect data transmitted over your network, use WPA3 encryption (or at least WPA2 if WPA3 is not available).
• Configure your router not to broadcast its Service Set Identifier (SSID). This makes it harder for potential attackers to find your network.
• Use a strong, unique password for your Wi-Fi network and change it periodically.
• Consider setting up a separate Wi-Fi network for guests to keep them isolated from your main business network.

Tip 4: Implement a data backup system in case of emergency.

Preparation is your best defense. User error, natural disaster, or a sophisticated cybersecurity attack can all render your data irretrievable.

A data backup system is a safety net. It ensures that, no matter what happens, you can minimize the stress and downtime caused by data loss. With a reliable backup in place, you’re not just protecting data; you’re protecting the future of your small business.

Data backups have the added advantage of preserving a historical record of documents. If you ever need to review an earlier version of a project, you can retrieve it.

Schedule your backups to happen automatically. Here is the data you want to ensure is regularly backed up:

• Word processing files, spreadsheets, presentations, and PDFs
• Customer information, inventory data, and other structured data sets
• Accounting files, tax documents, and financial statements
• Employee records, payroll information, and benefits data
• Customer contact details, purchase history, and any personally identifiable information (PII)
• Emails and important written communication and attachments
• Project files, designs, and related documents
• System configurations and settings for essential software and systems
• Website files and databases if you host your own website

Best practices for a robust backup system follow the 3-2-1 rule. Store at least three copies of your data. Have a minimum of two copies on different storage media, like the cloud and an external hard drive. Keep at least one backup copy off-site.

A key part of a strong backup strategy is encrypting your data. This is especially important for data stored off-site or in the cloud. In the digital age, your data is one of your most valuable assets, and protecting it should be a top priority.

Tip 5: Get support and training.

Education is key to maintaining strong cybersecurity. While online courses and workshops can provide valuable knowledge, the most effective approach often involves personalized guidance. For businesses handling sensitive data, roles like IT security analysts or data protection officers can be crucial. However, for many small businesses, hiring full-time cybersecurity staff isn’t realistic.

Managed security service providers (MSSPs) can offer expert support. However, their services don’t always align with the specific needs and budget constraints of small businesses. You want a solution that provides customized guidance without breaking the bank.

Cybersecurity is an ongoing commitment, not a one-time effort. Investing in the right support and training today can protect your business from potentially devastating losses. Fortunately, there’s a resource that combines expert knowledge with personalized, cost-effective support.

Oregon SBDCs Are Here to Help

The Oregon SBDC Network offers free cybersecurity resources! This includes no-cost, one-on-one cybersecurity advising sessions for businesses in different stages of development and growth. Do you have questions about how we can help your Oregon small business defend against cyber threats? Get in touch with your local Oregon SBDC at OregonSBDC.org.