Hackers do not only attack the companies in the Ibex-35. SMEs are also part of their hunting ground. They have more digital assets than an individual citizen and are usually less well protected than a large company. The phenomenon is booming in the US, so I decided to take a look closer to home, here in Spain. According to Verizon, 61% of data breaches occur at SMEs (and, by extension, entrepreneurs).
Cyber-security is rather like family affairs: the outside world only ever learns a small part of what is brewing indoors. Indeed, in many cases we only hear about the brew because there is no longer any choice. That is why the available data are scarce, scattered and, in many cases, of questionable credibility. Understandably, it is not in human nature to go around announcing that we have been robbed. The Spanish financial sector is said to suffer close to a million cyber-attacks a day. Admittedly, the vast majority are rejected automatically, but the number alone gives an idea of the scale of the problem, and of what we are talking about if we transpose it to our beloved SMEs and entrepreneurs, who account for more than 90% of Spain’s productive fabric.
According to Towergate Insurance, SMEs underestimate the risk of being hacked. Some 82% believe they cannot be the target of such attacks because they have nothing worth stealing. Hackers do not see it that way. In fact, because these firms invest less in cyber-security, getting in is easier. Moreover, it has been shown that the owners of SMEs, and entrepreneurs themselves, are more willing to pay a “ransom” to recover, say, their hard drives so that the business can carry on. As if that were not enough, hackers often use SMEs as a vehicle for breaking into the large companies they may work for as suppliers. As with any chain, it tends to break at its weakest link. An acquaintance of mine remarks that, given how hard many large companies squeeze their smaller suppliers, this could be seen as a form of poetic justice.
If you are an entrepreneur or the owner of an SME, you may want to understand what kinds of cyber-threats lie in wait for you and what you can do to protect yourself. The aim is almost always the same: to steal and monetise confidential information. That might be the details of a company credit card, information about the company’s customers, valuable information on processes and patents, or personal information that could lead to manipulation or identity theft. Let us look at some of them:
APT: This stands for Advanced Persistent Threats. This type of threat is usually associated with sophisticated hackers whose priority is to remain undetected. They care less about how long it takes than about going unnoticed. The most advanced even plan alternative routes for extracting data in case the routes by which they got in are closed off. Their aim is to stay inside the system, waiting to identify and extract the most sensitive information possible at the most opportune moment. These are the worst. The financial sector fears them in particular. The easiest way for attackers to get round its defences is through the Trojan horse unwittingly brought in by smaller suppliers that lack the sophistication to detect such threats.
DDoS: This stands for Distributed Denial of Service. These attacks are cruder and rely on brute force. That does not make them any less dangerous. They work by bombarding the target’s servers with massive numbers of requests, overloading them and stopping them from working. In extreme cases they bring down the target’s websites or even its entire network. If, during the attack, the target had to carry out a crucial task or a service that could not be postponed, the damage is irreparable. Once the attack stops, systems return to normal, since these attacks leave no agents (viruses) embedded in the system. If this happens to an SME, there is a high probability that it will end up paying a sum of money to make the attack stop.
Insider attack. The worst enemy is the one within. An angry employee, a dismissal that was not understood: in the hands of someone with access to the systems, this can prove lethal for the company. It is the digital version of the classic employee with access to confidential information who wants to use it against the firm in revenge for treatment he or she considers unfair. Having protocols in place to revoke all access to systems the very moment an employment contract is terminated seems more than prudent.
Malware: This is a generic term for any software created with malicious intent and somehow introduced into target computers with the aim of causing damage or taking control of them. These are what are known as viruses, worms, Trojans, ransomware or spyware. When choosing an antivirus, it helps to understand how this malware works. Most commercial antivirus products work by holding the “signature” of each virus in their database. That is why the first thing antivirus programs usually do is update that database regularly. If the signature is not there, the associated virus waltzes into the system as if it owned the place, antivirus or no antivirus. If the systems are sensitive and of vital importance to the SME, it should consider another kind of protection, based not on signatures but on analysing anomalies in the system’s behaviour. In the trade, these are known as systems based on Machine learning or, if they are ultra-advanced, on Deep learning.
There are other types of cyber-threat that we can explore another day, but I would like to close with some thoughts on what can be done in the face of these threats. Bodies such as INCIBE offer a series of useful tips on how to be better protected. It is not enough simply to have some kind of antivirus. We need to know what sensitive information we hold whose loss could harm us. Regularly up
date operating systems. Run the latest versions of the software we use. Avoid pirated copies. Install firewalls to prevent unauthorised users from accessing sensitive information. Encrypting that sensitive information (“masking”) can help not only to protect it but also to comply with the new data protection law that comes into force next May. It might also be wise to take out insurance to cover us against the consequences of a potential data breach.
Let us remember that there is no one-size-fits-all solution. It is advisable at least to know where we stand: a snapshot of the situation telling us how vulnerable our systems and activities are. This is what is known as an ethical audit. Depending on the size of the SME and the systems it uses, there are highly professional firms in Spain that carry out these audits at more than reasonable prices. An ounce of prevention is worth a pound of cure. Let us be careful.
Francisco Canos
Article published on 16 April 2018 in:
