Malware: what it is, and why small business owners should care

Malware is any type of software that harms or disrupts your system’s regular way of running.

So, why should business owners pay attention to this cyber-attack?

Despite 40% of businesses being knowingly targeted by a cyber-attack in 2022, only 19% had a proper incident response plan in place. This means that the majority of businesses, if hit with a malware attack, would lose confidential data, money, and take a serious hit to their reputations.

Not only this, but if you're a small business targeted by this type of attack, due to the severity of it, you may be unable to recover! 

As business owners, we often underestimate the external online threats: malware can’t lower your market share the way competitors can, and phishing won’t affect your capital the same way new regulations in the business sector will.

Malware, however, can be used to take a system down, lock users out of their servers, and even spy on your online operations. So, what makes you a target?

Why might hackers choose you?

1. Your connection to bigger corporations. If you work with bigger businesses, it’s likely you’ll be used as an entryway into their systems. This is because smaller businesses are less likely to have high-level security over their digital data than bigger corporations, meaning hackers may see you as a weak spot to exploit. This is called a supply chain attack.

2. Your confidential data: national insurance numbers, banking details, and private business information are all valuable data. Whether they’re trying to sell it on the dark web, or use the information for their personal gain, your business data is a reason for hackers to launch a malware attack.

3. Your money in your business bank account. They can do this by recording your account details when logging into your banking account online. They can also do this by launching a ransomware attack (in which the hacker prevents you from accessing any files on your computer or mobile device before paying them a certain amount).

Protect yourself

It’s likely that most businesses will have at least one of these reasons to be targeted by a malware attack, meaning it’s important to know how to prevent them.

The first way is to always have backups of your data., This is done by having a consistent, three way backup strategy. For example, you may backup your information to a third party cloud service, or an external hard drive. You may also use a NAS (network attached storage device). If you’re hit by a ransomware attack, having these backups mean you won’t need to spend money to get back your important information, and don’t have to worry about losing it permanently. Ensure you use multiple cloud services across multiple different drives to reduce the likelihood of the hacker getting hold of your data.

The next way is to lower the odds of malware accessing your files. This is done by simply blocking any known malicious websites, adding mail and spam filters, and closing the window if you’re greeted with a malicious-looking pop-up ad.

Another good way to protect yourself and your business from a Malware attack is to stop it from running on your devices. It’s a good idea to educate your staff by giving them regular cyber-awareness training on common scams such as phishing, vishing and spoofing, as these are common methods hackers use to leak malware onto the network. You should also ensure that up-to-date anti-malware, MDR and anti-virus software is uploaded to your device.

The last way to protect yourself is to prepare an incident response plan. If your other defences fail, it’s a good idea to have a pre-planned strategy to mitigate the damage to your business. The first step is to decide which online assets will impact the business the most if they were to be targeted. This will allow you to build your defences around those, and have a well-thought-out route to recovery if you lose any of these. The next step is to decide how you’ll quickly send a report of the attack to the right people. The ICO, for example, requires a report of the incident within 72 hourS. There are certain legal obligations where you’ll need to document a report of the attack with certain regulators and will need to contact certain stakeholders about the incident. You should also decide how you’ll continue to operate your main services whilst dealing with the incident, as you’ll want to minimise the hit to your business and reputation throughout the process.

Conclusion

Malware attacks have the power to overrun your system and put your business out of the game for months: but it doesn’t have to. If you plan, and prepare, you can keep your business-and your clients assets-safe. We recommend businesses adopt frameworks such as cyber essentials or cyber essentials advanced.

 If you want to know how Vibrant Network's IT support services can help you keep your cyber-security updated running to a high quality, call us today on 01922 612387, or email at info@vibrant-networks.co.uk.