Cyber crooks are becoming more daring. They are not deterred by the innovative security designs put in place by information technology (IT) experts. Analysts say a third of small- to medium-sized-businesses (SMBs), are under threat by their activities, reports LUCAS AJANAKU.
The rise of the internet has revolutionized the way businesses are conducted. The ease with which selling of goods and services across long distances and international borders ‘with just a click’ on the keyboard of the PC or a smartphone has created almost endless opportunities for businesses, both large and small.
The liberalisation of the telecoms sector in Nigeria also added a new fillip to this new era of doing business online. With this new vista of opportunity also came the challenge of unscrupulous elements wanting to explore the loopholes in the system to fleece unsuspecting people of their hard earned money.
It is therefore not a surprise that cybercrimes have taken various shapes beginning with the advanced fee fraud or 419 to identity theft and hacking into the servers of key government agencies, business organisations such as banks and others. This has become a cause of global concern to organisations such as the world’s largest anti-fraud organisation and premier provider of anti-fraud education, the Association of Certified Fraud Examiners (ACFE).
Speaking during the 24th Annual ACFE Global Fraud Conference, ACFE founder and Chairman Dr. Joseph T. Wells expressed concern over the rising attacks on small and medium scale enterprises (SMEs) across the world.
“We all know, or should know, that there is really no such thing as a secure computer — one that can’t be eventually hacked. We’ve all read of data thefts of millions upon millions of individual records. Most of these are committed by international gangs, which makes them exceedingly difficult to stop and even more difficult to prosecute.
“But what is not as well known is that small business has been increasingly made a target. As large organisations develop stronger controls over their networks and digital data, attacks on small enterprises have mushroomed. What this means is that anti-fraud experts serving small businesses must educate them of the threat and encourage them to invest in the proper resources to reduce their vulnerabilities,” Wells was quoted to have said on the group’s website.
According to an online platform, PC Pro, the statistics for cybercrime, online fraud and data theft make for disturbing reading. It lamented that the Federation of Small Businesses (FSB) estimated the cost of cyber frauds to businesses in the UK to be £4,000 per year, with around a third of FSB members falling victim to online crimes such as malware infections, hacking attacks or data breaches.
It lamented that for the SMB owner, the impact of such attacks go beyond the immediate financial loss and disruption to the daily work schedule, adding that there’s loss of reputation and customer trust. Despite this, it is SMBs that have the most difficulty finding affordable and applicable security measures because of their scope of operation.
Experts at PC Pro have provided useful tips that will help SMBs overcome the challenge of these cyber crooks. Some of them are:
Data knowledge
Not all data is equal. The starting point for any business must be to understand what data is business-critical or sensitive. How it is used and where it is stored must be identified. The most basic of audits could be accomplished just by considering what might happen if a breach were to occur and data, such as financial data, or employee or customer records, was compromised.
Once the likely effect of data is established on business, there is need for a blueprint for business-impact levels.
“High-risk data needs to be appropriately secured, and you can devote more of your resources to ensuring it is. Just note that your job doesn’t stop there – you can’t ignore data that you’ve classified as less risky; rather, you must prioritise your security efforts accordingly,” the experts averred.
Password management
Passwords are at the core of every security policy yet ensuring that they’re secured and enforced isn’t easy. Consumers have services such as LastPass to help generate and manage their passwords, but should a business use password managers?
LastPass and other such services have enterprise versions available at a low cost per user. These offer all the basic secure-password-generation options that would be expected, with a variety of business-orientated extras: for example, one could set company-wide minimum password standards to meet one’s policy requirements, or apply customised policies to restrict access to specific devices, groups or locations.
“Then there’s Active Directory (AD)/Lightweight Directory Access Protocol (LDAP) integration. This can import existing AD profiles, automate reporting tools to highlight weaknesses in the password security chain, and offers real-time syncing across devices to help with the rise of the Bring Your Own Device (BYOD) culture. It can be protected by a master password, which could be reset or revoked by the administrator,” PC Pro added.
Education/communication
Everyone in business must understand the company’s security policy and know why it is important to strictly adhere to it. It doesn’t need to be expensive: it could be integrated easily into the staff-induction process, and one could consider six-monthly refreshers to bring existing employees up to date with any changes – including threats of which they should be aware.
Only an hour is needed every now and then to sit with an employee to explain how security applies to their particular role and to answer any questions. Education and communication are just as important as tools against cybercrime as the computer technology used to defend the firm’s data.
However, in order to be effective, it has to be implemented from the bottom up and the top down – that is, everyone from the CEO to the summer temp needs to be on board if a security policy is to work. That doesn’t mean the same training should be given to all; the best training is tailored to the specific role of the employee and the threats they may encounter.
Encrypt or not?
Of all the security tips, encryption is probably the most controversial. But it is also the most valuable in terms of data protection. It is controversial because encryption has always been seen as being the realm of the ‘nerd’ and thus beyond the ken of ordinary business owners; plus there’s the small matter of convenience to consider.
Both arguments are becoming weaker as encryption technologies become easier to deploy and work with. If a laptop/storage device is lost or stolen and the data on it is encrypted, then it’s far less likely to pose a security risk to your business. However, every business needs to weigh up the protection/convenience ratio before jumping in.
The same goes for data in transit. It is far safer to make sure all online transactions are carried out using Secure Sockets Layer (SSL) than over an insecure connection. The best-practice advice is to investigate what encryption options are available to suit your data, devices and business usage.
Experts say the bottom line is that, from SSL and encrypted USB containers at one end of the scale to on-the-fly encryption at the other, encrypted data is more secure than data that is not.
Adopt cloud computing
While the idea of encrypting everything may be controversial, the idea of embracing the cloud technology for professional work purposes is seen by some as positively scandalous. However, the cloud could be a genuinely secure choice for most SMBs.
In particular, it makes sense if the firm does not have the time or knowledge to be on top of all the security issues, and the updates and implementations it needs, because a good cloud service provider (CSP) does have time. Computer Warehouse Group (CWG), MainOne, Vodacom Business Nigeria and some of the telcos have invested fortunes to build state-of-the-art data centres in Nigeria.
Experts say there is no need to be scared of the cloud for data storage or application-serving usage, since a reputable CSP will be more proactive than you at maintaining software patches and implementing security – in order to survive, CSPs have to take security seriously. They could also do so at less cost to your bottom line than you can.
The anytime/anywhere nature of cloud access even provides a good disaster-recovery route for smaller businesses. Of course, the cloud is not 100 per cent secure, and you need to think about where your data is located and who has access to it.
Frequent update, patch
The experts said: “If you want your business to be secure, you need to stay up to date. Specifically, you must update all the software you use day-to-day in your business: the operating systems of all the devices, from smartphones to servers, plus the software that runs on the security systems that protect them all.
“It is a no-brainer that keeping your antivirus software up to date will ensure it offers the best possible protection, yet for many small businesses this is low on the to-do list. Security software, generally, automatically checks for and installs updates. While the same might be said of operating system updates, auto-updates are usually switched off due to the resource drain and disruption they can cause.”
Larger companies have patching policies and automated patch-management systems, but these are beyond the financial and implementational reach of most SMBs. Useful alternatives include deploying scanners to run regular system checks for unpatched or vulnerable software, and then scheduling those updates during your business’s off-peak times. Doing nothing isn’t an option, especially if a patch has already been made available. Think about it: if the patch is out, then would-be attackers will be aware of the problem and will be finding ways to exploit it. Patching is relatively low-cost, especially at the smaller end of the business scale, but investing your time in it will bring invaluable rewards when it comes to security.
