Cybersecurity Risk for Small Businesses: How to Protect Your Data and Customers

Learn about the common cyber threats that target small businesses that handle sensitive information and what you can do to prevent them.

Suppose you run a small business that handles personal health information (PHI), personally identifiable information (PII), or payment card information (PCI). In that case, you need to be aware of the cybersecurity risks that you face. Cybercriminals are constantly looking for ways to steal, compromise, or destroy your data, and they often target small businesses that have fewer resources and security measures than larger organizations.

The cost of a data breach for a small to midsize business (SMB) can be substantial. On average, a data breach costs an SMB around $217,000 per incident per the Garter® Top Trends in Cybersecurity for 2024. This figure includes immediate financial impacts such as legal fees, fines, and remediation costs.

However, the hidden costs can be even more significant. For example, the average cost of lost business due to a data breach is $1.52 million. This loss stems from eroded customer trust and the potential exodus of clients, which can be catastrophic for businesses that rely on a loyal customer base.

Additionally, operational disruptions, productivity losses, and data restoration costs add to the financial burden. For instance, downtime can cost SMBs an average of $8,000 per hour.

Given these high stakes, investing in comprehensive cybersecurity measures is crucial for protecting against the costs and disruptions of a cyberattack.

Common Threats

Some of the most common cyber threats that small businesses face are:

• Phishing: This is a type of social engineering attack in which cybercriminals send fraudulent emails or messages that appear to come from legitimate sources, such as your bank, your vendor, or your customer. The goal is to trick you into clicking on a malicious link, opening an infected attachment, or providing sensitive information, such as your login credentials, credit card number, or tax ID. Phishing can lead to identity theft, account takeover, ransomware infection, or data leakage.
• Ransomware: This type of malware encrypts your files or systems and demands a ransom for their decryption. Ransomware can cripple your business operations, and even if you pay the ransom, there is no guarantee that you will get your data back. Ransomware can be delivered through phishing, drive-by downloads, or unpatched vulnerabilities.
• Data Breach: This term refers to any unauthorized access, disclosure, or theft of your data, whether intentional or accidental. Data breaches can occur due to phishing, ransomware, malware, insider threats, human error, or poor security practices. They can result in financial losses, legal consequences, reputational damage, and customer churn.
  

Best Practices

To reduce the cybersecurity risk for your small business, you should follow these best practices:

1. Train your employees: Your employees are both your first defense line and your weakest link. You should educate them on how to recognize and avoid phishing, use strong and unique passwords, enable multi-factor authentication (MFA), backup and encrypt their data, and report any suspicious activity or incident.
2. Update your software: You should keep your operating systems, applications, and antivirus software updated with the latest security patches and updates. This will help you prevent hackers from exploiting known vulnerabilities in your software.
3. Secure your network: To protect your network from unauthorized access and intrusion, you should use a firewall, a VPN, and a secure Wi-Fi network. You should also limit access to your network and data to only those who need it and use encryption and authentication to secure your data in transit and at rest.
4. Back up your data: You should regularly back up your data and store it in a separate location, such as an external hard drive, a cloud service, or a secure offsite facility. This will help you recover your data in case of a ransomware attack, a natural disaster, or a hardware failure.
5. Have a response plan: You should have a clear and documented plan for responding to a cyber incident, such as a data breach or a ransomware attack. Your plan should include your team's roles and responsibilities, the steps to contain and mitigate the incident, the communication channels to notify your customers and stakeholders, and the resources to restore your operations and data.
   

In today's digital age, the threat of a personal or business cyberattack looms over all of us. Take a proactive stance against cyber threats and learn how to identify phishing attacks and malware schemes so you will be better prepared to safeguard your data with Lee Hovermale this September.

At CANA’s 106th Annual Cremation Innovation Convention, Lee will present on Cybersecurity Awareness: Recognizing a Threat, and Protecting Your Data. This session will empower you with information you can use to navigate the online world securely and protect yourself and your company. See what else we have planned and register to join Lee in Chicago this September: cremationassociation.org/CANA24

Lee Hovermale is the Strategic Advisor to the CEO of KiZAN Technologies.  He has over 30 years of experience in cybersecurity and 15 years in compliance.  Lee is a vCISO for six companies and a vCIO for four, managing budgets, staff meetings, vendors, security policies, vendor/client questionnaires, and security audits. His cybersecurity experience comes from his time in the Navy and in a federal government agency.