Do you think your business is too small for a hacker to break in and take data? Is data breach a concern for your business? Banks were said to be ‘too big to fail’ in 2008. Today the big risk is for hacking and crime, many small businesses believe they are ‘too small to be a target’.

In August and September 2018, property and casualty insurer Chubb completed a survey with YouGov in Singapore to gauge their attitude to cyber risks.

“Some SMEs believe they are too small to be targeted by cyber criminals or any internal issues will not greatly impact them. In effect, they think they are “too small to fail”. However, every report, survey or set of statistics on cyber events tell us that all businesses are exposed, whether big or small.

“Structured risk management methods and strategies are largely nonexistent as most SME owners seek to maximise profitability and growth. I see this is an opportunity for insurance companies and brokers to better inform their clients,”

Andrew Taylor cyber underwriting manager, Chubb Asia Pacific

Securing your small business from data breaches is good for you and good for your clients. Many small businesses work for larger businesses and the supply chain is going to gather more focus. Supply chain and audit is growing in focus and companies need to start connecting their whole supply chain with an audit support function to highlight risk and correction. Do companies know the strength of the companies within their supply chain? Especially cyber risks? Hacking small businesses can be an easy way to literally allow a hacker to walk into a larger company.

Do you remember when the news was hacking wireless networks with a Pringles tube?

Back in the mid 2000’s empty cans of Pringles crisps could be helping malicious hackers spot wireless networks that are open to attack. A security company, i-sec, demonstrated that a directional antenna made with a Pringles can significantly improves the chances of finding the wireless computer networks being used in London’s financial district, at the time the informal survey carried out by i-sec using the homemade antenna found that over two-thirds of networks were doing nothing to protect themselves.

Jump on 10 years and what do we have today?

Drones! We have a drone being used in hacking, WIRED has a great story on how it works. The ability to compromise a ‘air-gapped’ computer, the safeguard of separating highly sensitive computer systems from the internet to quarantine them from hackers.

A group of researchers at Ben-Gurion University in Beersheba, Israel cybersecurity lab has devised a method to defeat “air gap” computers.

This video shows the drone taking off from a car park.

In ten years or so we have moved from a hacking with Pringles Tube to a Drone – this shows amazing progress!!

We are told that we should secure our data against data breaches and make sure we don’t tell people and companies un-necessary information about ourselves. Just 15 years ago we were told to shred our old post and envelops for fear of thieves going through our bins.

Yet on the other hand, today people will tell you that there’s no point as all our data is out there, its been breached and hacked already, sold multiple times, and anyway we post the craziest details all over Facebook, so why secure your data against a data breach now? Why stop sharing everything?

This last point of view comes from the fact that many large corporations don’t seem to care about your data as much as you may have hoped.

The well-known password security company Dashlane has compiled a list of the top 20 data breaches of 2018. If you thought that the British Airways case was bad take a look at the list, it only just made the list at number 20.

The list shows that just under 3 billion data records were stolen. And this was ONLY 2018. The chances that your data is not on this list is quite small – somewhere some part of your data is already compromised. Especially if you add the many smaller hacks of 2018 and those of previous years.

We are heading into 2019 and I am wondering is securing my data worth it today, since its already out there?

I take the view that it is. Hackers don’t know what my new passwords are, things that I have added today, things I have updated etc. My profile changes all the time. I am working to actively make my historical data out of date and not useful. Change passwords, stop adding sensitive data to social media, only give data that companies need to interact with them. For example, why give a correct Date of Birth unless is essential? Your main email – why give that? Your mobile number – why give that? Your correct zip code – why give that? Unsubscribe as soon as it’s not useful, why not?

Each bit of data given should be questioned and if you think its not important to the actual transaction then don’t give the data. That hotel site, why does it need your Date of birth or your main email address? We have responsibilities too.

Companies take more data than they need and then don’t secure it as we have seen. I understand that new platforms are trying to automate ‘trust’ by vetting guests or workers before they use the platform so that providers and users can trust the site. But the platform must then be responsible for the data. Again the hotel is a good example – You can pay cash at a hotel and they don’t know anything much about you…. AirBnB on the other hand needs to know your complete verified identity just to sign up and book. The duty of care here for data is completely different.

Looking forward to December 2019, I wonder what the list will look like, one thing for sure it won’t be an empty list! Ask any security expert today what the biggest risk in December 2019 will be and they wont know – hacking threats change and update all the time. Is it finally time to look at information insurance? To buy that data recovery policy? To ask your broker about your business insurance?

Why would a cyberattack on 15-person company raise any alarm bells? Why is it the a concern to anyone let alone the Department of Homeland Security?

There are millions of small businesses in the USA and globally, in fact over 100 million of them and this number is growing each year, and faster as the world changes employment strategies.

So, why are any of them a concern to a government agency like the DHS? Surely the DHS is focused on banks and larger companies, this is where the threat is? Keep them safe.

No, this is not so true. In a recent example, a small business working with utilities and government agencies, suffered a cyberattack that was an early thrust in the worst known hack by a foreign government into the USA’s national electric grid.

The Wall Street Journal have reconstructed the events around the hack that revealed huge vulnerabilities at the heart of the electric power system.

Rather than strike the utilities head on, the hackers went after the system’s soft and unprotected contractors and subcontractors. There are hundreds of them, all vulnerable and some more than others.

This should be sounding an alarm bell to every large corporate if not every company.

Small and medium sized businesses generally have no reason to be on high alert against foreign agents 24 hours a day. Why would they be? They also don’t have the people, systems or solutions in place to do this.

Yet through these small companies the hackers, in this case, found the footholds necessary to work their way up the supply chain. Enabling the final target to be reached, hacked and exposed. Some experts believe 20 or more utilities ultimately were breached.

The hackers have the time and resources to do this and they are aware that small and medium sized businesses are a very soft target.

The WSJ article is a must read, I am not going summarize it here to save you time- just read it!

Have you read it yet?

On a similar note and to underline the issue the FBI is investigating the alleged theft of 18,000 insurance and legal documents relating to the September 11 attacks on the World Trade Center by a hacker with a long record of holding companies to ransom. This ransom attack, if it did happen, highlights the vulnerability of a business not just from within but across a huge web of suppliers and partners.

This type of breach can lay your clients details bare, data lost and cause untold issues, at the very least a PR nightmare.

Where does this leave you?

What can you do about the growing threat of hackers? First, put in place the best tech barriers you can afford, get some advice too – know where you are weak. Buy cyber liability insurance to cover the recovery costs too. vulnerabilities change all the time, insurance is there to bring you back to life when all else fails.

Then patch your biggest vulnerability: your people. They need training and awareness of these issues, especially if you work for large corporates or government bodies.

It’s not just about employees having smarter passwords and spotting sketchy emails but also to think about their online actions. This is not about a list of rules, it’s about awareness and responsibility. Remember rules create a path for hackers to follow….

It’s that time of year…. nights are dark, its cold, Christmas, bargains galore, children are excited, returns are simple, you name it there is every reason you can think of to shop online. The bargains are there. 2018 will be another record for on-line sales.

So too will internet crime. Will it be another record-breaking year? What are the top threats and data breaches. Non-payment/Non-delivery, Phishing, Cyber attacks, data breach are all on the up. Check out the FBI’s Internet Crime Complaint Center (IC3).

Every day you can trawl the net and find hacking attack reports and every security firm or press office does its own hacking survey showing alarming results. Should you stop, pop-up the umbrella, add a scaf and walk to the shops with a bundle of cash, staying off grid? No, of course not. However, some not so common sense should be applied to your shopping online processes. As they say a dog is not just for Christmas (important to note this!) and it is the same with online shopping and usage. Best practice is a year-round thing and not just for Christmas!

A. Do you know the Site? Used the site before? Recommended from a friend? Researched well? Search results can be rigged to lead you astray, check spellings of sites, don’t click sites from ‘friends’ email recommendation – check email addresses, beware of misspellings or sites using a different top-level domain. Or use the App via your mobile device, signing into the retailers app creates another level of trust and security

B. Check the certificate. Look for the lock. Today more and more sites are adding a SSL (secure sockets layer) certificate even to what are informational sites. BUT, never ever buy anything online using your credit card from a site that doesn’t have SSL encryption installed — at the very least please check for this. You’ll know if the site has a SSL cert because the URL for the site will start with HTTPS. What is SSL. Got it? Never shop online with out checking for SSL.

C. Love to share? Don’t. For shopping, ONLY give the site the data that you think they need, not what they ask for, when possible. You should, as a default, give as little personal data as you can. Don’t overshare. Some of the top headlines for hacking and security failure in 2018 were major sites – British Airways, Facebook etc to name just two. Its your data, keep it to yourself.

D. Do your admin! Check your online bank & credit card accounts often and regularly during the holiday season. ANY out of place or surprising amounts or payments could be fraudulent. Don’t be fooled by it coming from the likes of PayPal. Its better to highlight payments than to lose the money. If you see something wrong, deal with it quickly.

A good thing to consider is to ONLY buy online with a credit card, this not linked to your bank account like your debit car. Also having ONE card you only use online can help too with low limits.

E. Add protection, don’t want to pick up a nasty disease. Add antivirus and malware protection to your computer and devices. Also its not good enough to load and forget. Make sure your anti-malware tools are always up to date. New threats are always being developed and protections needs to be updated regularly.

F. Go private. If you feel the need to use a public hotspot, like those found in hotels, libraries, coffee shops and bookstores you should use a virtual private network (VPN) to be safer.

Most people don’t when they are out and about. It’s a simple thing to use and set up. It will make you more secure and less vulnerable to attack.

G. Be aware…. When you are in a café or bookshop browsing and casually shopping using your VPN etc remember those around you, people snoop!
If you have to shop online in public then beware, be aware. Back to the wall, nice corner seat, check people if they are watching.

H. Get a manager. Today smart people use a manage to deal with their important stuff and passwords are no different. Use a password manager to create hard to crack passwords for you. It’ll also keep track of them and enter them, so you don’t have to think about it. Good eh?

I. Know your seller. Put websites and companies through the wringer before you buy. Check reviews, ring them up, check with people who have purchased before, spend the time checking. Non-delivery/non-payment is one of the most common cybercrime complaint these days- more and more people are reporting the issue – no goods showed up!

J. All for one and one for all…. Complain! Tell the world if you get scammed. Think of others and don’t let it happen again. Complain, Report, Publish. Complain to the seller, report to the police and federal authorities, publish the scam and the site far and wide, give poor reviews. Don’t be embarrassed and let others get ripped off too.