Phishing is the number one cyber security threat. It exploits the most common weakness within a business: human error.

Attacks generally come as emails, texts, WhatsApp messages or social media, but calls are increasingly common. The aim will be to persuade employees to:

• Click on malicious links or downloads (which might contain viruses).
• Reveal important data, such as passwords.
• Transfer funds out of the business.
   

Common tactics used by cyber criminals include putting the victim under time pressure (e.g. “Your account will be suspended immediately”) or making an attractive offer (e.g. “A chance to earn £1000s”), so you act unthinkingly.

Small business cyber security  systems often lack advanced email filtering. Plus, you and your employees may not know what a phishing attempt looks like.

To protect your business, educate your employees about phishing and how an attacker might try to manipulate them. Make sure they can spot phony emails, messages and calls, and encourage them to always be alert.

Another common type of cyber attack, ransomware, is a specific form of computer virus that infects your digital technology.

It disables your tech or scrambles your important data so you can’t access it, until you pay the attackers a ransom for release.

It usually enters your systems via a malicious link or download. Check all your anti-virus software is constantly updated, and make sure everyone in your business is alert to the dangers.

Downtime and loss of data can cripple your business. What’s more, even if you pay the ransom, it may not guarantee recovery as there’s nothing to stop the criminals coming back for more.

So how do you protect your business from ransomware? Regularly back up everything that’s important to your business using a secure cloud service, such as Microsoft OneDrive or Google Drive.

And don’t think your company is too small for criminals to bother with. Cyber criminals know smaller organisations are less likely to have solid back-up and recovery procedures. That’s another reason why it’s so important to educate your employees on potential cyber threats such as ransomware.

Business email compromise is when attackers impersonate senior people in your business or a supplier. Their aim is to trick colleagues into transferring funds or revealing sensitive information, such as banking logins or system passwords.

A common scenario might be:

• An email that looks like it’s from the boss is sent to the head of finance, but it’s fake.
• It requests a sum of money be transferred immediately to a bank account, with a plausible reason as to why it’s urgent (for example, paying a new supplier).
• It may deliberately arrive at a time when the finance manager is likely to be busy, such as the end of a quarter.
• The finance manager, who has complete trust in their boss, acts without thinking and the money is lost to the criminals.

Attacks are highly targeted and plausible. Also, due to their low-tech nature, they often bypass traditional security tools.

To avoid business email compromise, tell employees to always double check an email address and follow up with a quick call if they have any doubts. Reassure everyone that it’s always better to be safe than sorry.

The people inside your business, if not educated on potential cyber threats, are your biggest security risk. And that’s not just your employees, it could be anyone else who has access to your systems, such as contractors or suppliers.

The danger may come from malicious intent, such as someone who’s disgruntled or planning to work for a rival. But it could also be down to human error or even ignorance: someone acting with the best of intentions but unwittingly causing a breach.

To protect your business’ sensitive data, limit access with a ‘need to know’ policy, so people can only view what’s necessary to do their jobs.

Small businesses often delay updating software and operating systems due to a lack of time or resources. But using old versions leaves you vulnerable to cyber attacks.

Criminal hackers are experts at spotting vulnerabilities in code, allowing them to sneak viruses onto your devices. That’s why software companies are constantly releasing updates with patches to plug these weaknesses.

Allow auto updates if possible, or assign a trusted team member to check for updates updates at least monthly, but ideally weekly. 

You don’t have to be an IT expert to protect your business from cyber attacks.

• Many threats come via email. So, educate your team, using trusted, up to date training, to be vigilant against messages that come from an unknown source or make suspicious requests.
• Ensure all your software is kept up to date, and back up all your data to the cloud regularly.
• Limit access of secure information and keep it on a need-to-know basis.

Follow these tips today to start improving your company’s cyber security.