CYBERSECURITY FOR SMALL BUSINESSES

“Wahala be like bicycle, e dey easy to start; Wahala be like cyberattack, anyone fit get am.”

This popular twitter phrase is used to describe how problems can develop quickly, even when untriggered.

Bringing this home, the internet is the new market square, and every day is a market day. Many of us use the internet for advertising, selling, finding new markets, to source new clients, recruit people, carry out financial transactions and communicate with customers/clients. Cyberattacks have become an everyday occurrence in our world today, and they exploit the slightest vulnerabilities to create problems for the victim.

Oh, wait!

You didn’t really think only the big companies like Google, Twitter, and shell are targets to cybercriminals, did you?

Many small businesses labour under the grave misconception that because they are small, they are totally safe from cyber threats and attacks. In a study by Sidmach Technologies, a cybersecurity firm, in 2018 alone, 60% of business organisations in the country suffered cyberattacks, and 43% of cyberattacks were targeted at small and medium enterprises. In reality, everyone is a potential victim of a cyberattack. Cybercriminals have realized that small businesses tend to have poorer security practices, making them more vulnerable. While there is no 100% foolproof cybersecurity plan, understanding basic cybersecurity functions and taking necessary precautions go a long way to reduce the risks of a breach. In this article, I’ll make an attempt to demystify cybersecurity for small business owners. Shall we begin?

WHAT FORM COULD THE THREAT TAKE?

Cyberattacks masquerade as familiar and legitimate links. As a small business, you deal with several security risks like social engineering, phishing, spoofing, malware and ransomware attacks.

1. Social Engineering:

Hello Sir, my name is Mr. Boniface calling from your bank. Please tell me your BVN, CVV number, expiry date and pin to verify your account.

We have all gotten calls like this. Some, more times than others. This is called a social engineering attack.

Social Engineering Attacks occur when an attacker tries to trick you into giving up confidential information over the phone or in person. Attackers claim to be a representative from a government agency, bank or IT company. They ask for sensitive information that they can use for criminal purposes.

When next you get a call from your “account manager” telling you to update your account information through a phone call or mail, that’s a massive red flag.

2. Spoofing:

In spoofing attacks, the attackers disguise communication from an unknown source in the clothes of a known and trusted source (weyrey dey disguise). The attacker first spoofs the identity of another user and then contacts the target making it an identity theft. They try to secure the confidence of the target in order to obtain personal information, steal money or spread malware. Attacks range from persons posing as your boss, colleague or business partners.

3. Email Phishing:

Closely related to spoofing is a phishing attack. Phishing schemes often use spoofing schemes to get you to take the bait. Phishing is a type of social engineering where the phishing mail provides a link to a website where the target enters sensitive personal information. Spoofing tricks the user into clicking on a malicious link, which automatically deploys malware into the operating system of the device. While phishing employs spoofing, a spoofing attack does not involve phishing.

How to Identify a Phishing Attack

The tell-tale signs to flag malicious content includes:

• A request to be contacted via a link or only one method of contact
• A request for sensitive information
• Fonts, colors or a different writing style than the sender typically uses

Steps to Prevent Phishing Attacks

• Use an email provider with strong anti­ spam filtering capability
• Invest in robust antivirus software that can scan emails and attachments for malicious content
• Use separate emails for work and home.
• Soro soke, my friend! You can’t be too careful when it comes to cybersecurity. If you get an email from a co-worker or institution that you are unsure of, give them a call to confirm the legitimacy of the message
• Don’t open emails that you aren’t sure are legitimate.

4. Ransomware:

Recently, a friend told me about a ransomware attack that he suffered. He was trying to illegally download a Corel draw crack from the internet, and once he launched it, every file on his system became encrypted. He got a message that he had to pay $900 to unlock his files. This is a typical ransomware attack. This is Data kidnapping for ransom. The tricky part is that even after payment, there is no assurance that the data will be kept safe and protected, or it will be accessible by you.

Steps to Prevent Ransomware

• Do not open emails or the attachments in emails from addresses you do not recognize.
• Avoid clicking on links to websites that you do not recognize.
• Always verify the URLs of websites even when they seem legitimate.
• Mummy, calm down! Avoid clicking on links or opening attachments when in a hurry.
• Update antivirus, operating system, and programs.
• Backup all files and save all important data on network drives or in Cloud storage.
• Train all employees on data security. Cybersecurity is not a one-man show, and the security of any business is as weak as its weakest link.

5. Tech support Scam:

Imagine getting an email from Microsoft telling you of a problem with your computer; sounds serious, right? or those pop-ups on your browsers indicating a detected virus on your system and you should “click to fix”. Clicking on these links may make those imaginary problems with your computer become a reality. You may be opening the floodgates of malware into your device. Verify every tech support call to your business and avoid clicking on links in pop-up messages that you cannot verify.

6. Human error:

A lot of times, humans are the weak link. About 35% of security incidents are a result of human error rather than deliberate attacks. Many security incidents can be avoided if people become more security conscious. Therefore, while we are concerned about the outside threats, we should not overlook the threats within; human error. This is where staff training and a robust security culture comes to play.

WHAT IMPACT COULD AN INCIDENT HAVE?

Cybersecurity incidents have far-reaching impacts on businesses. These effects range from data breaches to financial losses and loss of customer trust. Some specific effects of cyber-attacks include:

• Information theft.
• Disruption of business resulting in financial losses.
• Costs from cleaning up affected systems and getting them up and running.
• Regulatory sanctions and fines if personal data is lost or compromised.
• Loss of business due to reputation damage.
• The domino effect, which leads to damage to other businesses that are connected to you.

HOW SHOULD I REACT TO A SECURITY INCIDENT?

As earlier stated, there is no precautionary measure that gives 100% protection from cyberattacks. While it is important to take precautionary measures, it is just as important to have a response and recovery plan. We live in an age where security incidents are a question of when not if. Those few hours after a breach is discovered are so vital to mitigate the level of damage a business will suffer. Every business owner has to determine what their response plan to a breach will be. Below is a list of things that you can do to reduce damage:

• Disconnect the affected device from the central-network.
• Do not shut off the machine as it may contain vital information. Keep it running till the cavalry arrives.
• Put your incident response plan into action.
• Report the incident to the appropriate authorities.
• Hire a lawyer.
• Notify all affected parties.
• Don’t forget to fix the problem.
• Revisit and review your security practices.

CYBER INSURANCE

When putting together your security budget, do not forget to include Cyber Insurance. Cyber Insurance provides the necessary cover for losses, lawsuits and ease of recovery after a security incident. There are broadly two types of Cyber Insurance. The first-party cyber coverage covers the organisation, customer information, legal counsel, recovery and replacement of lost data, lost income, breach investigation costs, fines and penalties related to the incident, among others. The third-party cyber coverage covers the cost of litigation, claims and settlements, payment to customers etc. It protects the business from liability as a result of third party claims. An insurance cover is not a substitute for implementing robust security protocols within any organisation; it just helps to mitigate the damage a business may suffer in the event of a security incident.

PAYMENT CARDS AND POINT OF SERVICE SYSTEMS

One common feature of small and medium scale enterprises in Nigeria is the use of Point of Service terminals. POS terminals are high-risk targets because money is involved. The retail chain giant, Target, had to deal with a data breach when its POS system was infected with Trojan malware. Securing your POS terminals is an important part of any small business. If any kind of card payment is accepted in your business, it is important to take certain precautions to protect customer’s personal information and card details. Some of these steps are:

• Process and store the data on secure tools and platforms.
• Determine who has access to your payment systems and control and limit access to your payment systems to only necessary persons.
• Limit data collected and stored to only those necessary for the transaction carried out.
• Do not retain customer data for longer than necessary
• Develop an in-house policy for processing data.

INCIDENT RESPONSE PLAN

An incident response plan is a step by step breakdown of what should be done when faced with a security incident. Incidents range from data breaches, hacks and malware attacks. A good plan should contain the following:

• Identify and isolating the attack
• Determining the nature of the attack
• Discovery the extent to which the system is compromised
• Attacking and eliminating the threat
• Reviewing the attack
• Notifying the necessary authorities
• Evaluating the attack and putting in place new and better security measures.

BEST CYBERSECURITY PRACTICES FOR SMALL BUSINESSES

1. BUILD A CYBERSECURITY PLAN

As a small business, this plan has to be adequate and suited to your business model. When creating a plan, don’t hesitate to seek help from IT professionals.

2. DEVELOP A SECURITY CULTURE

As a small business, take positive steps to make information security a culture in your organisation. Make it a normal part of your risk management system. Identify your risk level, identify the laws on data protection, payment services regulations and Cybersecurity regulations that have to be complied with and infuse it into all day to day operations.

3. GET AN IT GUY

While it is important for every member of your organisation to be involved in security matters, it is equally necessary to have someone within or outside their company who regularly checks the adequacy of the information security and formally takes responsibility for information security.

4. GET A LAWYER

It is great to have a good cybersecurity lawyer on your team to deal with the legal and regulatory issues that may arise.

5. STAFF TRAINING

An integral part of a security culture is staff training. Cybersecurity is not a one-man affair. As earlier stated, the security of your business is as weak as the weakest link. A simple click by an employee on a malicious link can introduce malware into the system of the business. Train and retrain members at regular intervals.

6. HAVE A CYBERSECURITY BUDGET

More expenses? No please, I’m just a small business.

Well, it is more expensive to pay regulatory fines, settle laws and lose customer trust than it is for you to have a decent cybersecurity budget. At the beginning of your organisation’s fiscal year, take cybersecurity into consideration when preparing your budget.

7. PROTECT PASSWORDS

• Use Passwords for all devices used by your business.
• Change your passwords often.
• Avoid using the same password(s) for multiple accounts. When this is done, the attacker only has to figure out one password to access all your accounts.
• Use strong, complex passwords with a mix of letters, numbers and special characters.
• Avoid using personal details in your password.
• Store your passwords on a secure password manager.
• Avoid sharing your passwords with anybody.
• Always say no to the “remember password” pop up.
• Change any default username or password on any of your devices.

8. TAKE LOGIN PRECAUTIONS

• Use multifactor authentication.
• Don’t enter your password on an unsecured/public WiFi network.
• Put a cap on incorrect login attempts on devices used by your business.

9. ALWAYS HAVE A BACKUP

• Regularly back up all your data offline in a way that makes it easy to restore.
• Backup all your data to cloud networks.

10. TAKE EMAIL PRECAUTIONS

• Create a separate email address for your business.
• Don’t open emails or the attachments in emails from addresses you don’t recognize.
• Hover over email links before you click on them.
• Don’t click on links directly from your mail; search for the website of the sender of the email on your browser instead.

11. SECURE MOBILE DEVICES

• Always keep your antivirus, operating system and programs up to date
• Install malware detection programs on your systems; those free antivirus programs you randomly download do not count.
• Avoid plugging in unknown USB devices into your system.
• Run malware detection programs on your systems regularly.
• Resist the urge to use public, free and open WiFi networks.
• Use Cellular networks to connect to the internet on your devices instead of wireless networks.
• Secure firewalls with 24/7 software updates and annual hardware replacements.
• Encrypt all portable mobile devices, thumb drives, portable media and any sensitive information you may be sending out.
• Keep your devices locked when not in use.
• Use secure browsers.

FINAL WORDS

Reading this article to gain knowledge about being cyber secure is a step in the right direction. Every business model has its peculiarities. It is important you sit with a security professional to develop the security plan that best suits your business.

---

AUTHORS

Victoria Oloni is a result-driven student at the Nigerian Law School with a growing interest in Data Protection, Cybersecurity and general intersections of Technology and Law. She aspires to be a thought leader in Data Protection and Information Security. This has driven her towards making several publications on topical issues in their field including her distinction rated undergraduate thesis. She is a member of the International Association of Privacy Professionals (IAPP), the world’s largest and most prestigious information privacy community.

Edidiong is a penultimate year law student of Obafemi Awolowo University with a growing interest in Cybersecurity, data protection and all areas concerning legal-tech. This has driven her to get internships at many reputable law firms in the country. She aims to be a reputable professional in this field. She is also a researcher and lover of books. In her spare time, she enjoys reading about tech, writing and watching sports.