Cybersecurity preparedness is one of the major obstacles facing businesses today. Despite the increased focus on making companies cybersafe, there are several common cybersecurity misconceptions that still pervade the business world.
If you or your employees believe any of the myths below, you could be opening up your business to unknown risk. Check out the full list, or jump to our infographic for tips on how you can bust these myths and keep your business cybersafe.
Get the Free Pen Testing Active Directory Environments EBook
Strong passwords are one of the foundations of good cybersecurity practices, especially for businesses. However, implementing and enforcing strong password policies is only the start. In fact, one of the major components of cybersecurity preparedness that companies overlook isn’t how people access the information — it’s what information is available in the first place.
Not only do employees need strong passwords, companies need to be more aware of who they allow to access what data. In a recent study, we found that 41 percent of companies had at least 1,000 sensitive files open to all employees. Many companies also don’t have a system in place to monitor admin access. Strong passwords help keep your company safe, but there’s a lot more at risk once employees are in the system.
The proliferation of high-profile hacks in the news cycle often tricks small- and medium-sized businesses into thinking that they won’t be targets of attack. In reality, the opposite is actually true. In fact, according to the 2018 Verizon Data Breach Investigations Report, 58 percent of data breach victims are small businesses.
This happens for several reasons. Many businesses aren’t targeted specifically, but instead are victims of what’s known as “spray-and-pray” attacks — hackers set up automated systems to randomly infiltrate businesses. As these attacks are random, any business can be damaged, regardless of size.
Small businesses tend to be “softer” targets, as they have less funding for advanced data protection software and often don’t have skilled security teams, which makes them more likely to fall victim to spray-and-pray attacks. Targeted attacks also tend to focus on small businesses, precisely because they’re unprotected.
Much like some businesses believe they won’t be attacked because of their size, other businesses wrongly assume that they won’t be attacked because of the industry they’re in. This myth also goes hand-in-hand with the belief that some companies don’t have anything “worth” stealing. The reality is that any sensitive data, from credit card numbers to addresses and personal information, can make a business a target.
What’s more, even if the data being targeted doesn’t have resale value on the darkweb, it may be imperative for the business to function. Ransomware, for example, can render data unusable unless you pay for a decryption key. This can make attacks very profitable for cyber criminals, even if the data is deemed “low value.”
Anti-virus software is certainly an important part of keeping your organization safe — but it won’t protect you from everything. Software is just the beginning of a comprehensive cybersecurity plan. To truly protect your organization, you need a total solution that encompasses everything from employee training to insider threat detection and disaster protection.
While outsider threats are certainly a concern and should be monitored extensively, insider threats are just as dangerous and should be watched just as closely. In fact, research suggests that insider threats can account for up to 75 percent of data breaches.
These threats can come from anyone on the inside, from disgruntled employees looking for professional revenge to content employees without proper cybersecurity training, so it’s important to have a system in place to deter and monitor insider threats.
While IT has a big responsibility when it comes to implementing and reviewing policies to keep companies cybersafe, true cybersecurity preparedness falls on the shoulders of every employee, not just those within the information technology department.
For example, according to Verizon, 49 percent of malware is installed over email. If your employees aren’t trained on cybersecurity best practices, like how to spot phishing scams and avoid unsafe links, they could be opening up your company to potential treats.
If your business has employees who travel often, work remotely or use shared workspaces, they may incorrectly assume that a password keeps a Wi-Fi network safe. In reality, Wi-Fi passwords primarily limit the number of users per network; other users using the same password can potentially view the sensitive data that’s being transmitted. These employees should invest in VPNs to keep their data more secure.
A decade or so ago it may have been true that you could tell immediately if your computer was infected with a virus — tell-tale signs included pop-up ads, slow-to-load browsers and, in extreme cases, full-on system crashes.
However, today’s modern malware is much more stealthy and hard to detect. Depending on the strain your computer or network is infected with, it’s quite possible that your compromised machine will continue running smoothly, allowing the virus to do damage for some time before detection.
Employees often assume that their personal devices are immune to the security protocols the company’s computers are subjected to. As such, Bring Your Own Device (BYOD) policies have opened up companies to cyber risk they may not be aware of. Employees who use their personal devices for work-related activities need to follow the same protocols put in place on all of the network’s computers.
These rules aren’t limited to cellphones and laptops. BYOD policies should cover all devices that access the internet, including wearables and any IoT devices.
Cybersecurity is an ongoing battle, not a task to be checked off and forgotten about. New malware and attack methods consistently put your system and data at risk. To truly keep yourself cybersafe, you have to continuously monitor your systems, conduct internal audits, and review, test, and evaluate contingency plans.
Keeping a business cybersafe is a continuous effort, and one that requires every employee’s participation. If anyone at your company has fallen victim to one of the myths above, it may be time to rethink your cybersecurity training and audit your company to assess your risk.
