Four tips to protect your business from cybercriminals

In this increasingly digital age, small businesses are becoming more and more vulnerable to the threat of cybercrime. In particular, there has been an increase in supply chain attacks targeting small businesses. Cybercriminals are constantly adapting their tactics and using AI to fuel their attacks. As technology advances, so does the risk to your sensitive data.

This increasing risk means it’s more important than ever to get the basics right. The good news is, AI still can’t beat smart cyber habits. October is Cyber Security Awareness Month, so we’re here to equip you with four essential tips to safeguard your business against cybercrime.

1. Strengthen your first line of defence

Humans can often be the weak spot in a business’s cybersecurity efforts, so it’s important to have a strong first line of defence in your systems to protect your business. It doesn’t have to be super complex or expensive – the easiest and most effective solutions are free or low-cost. 

To start with, get your security basics sorted:

• Passwords: Strong passwords are the foundation of your online security. Use long, unique passwords for each account, and consider using a password manager to keep track of them.
• Multi-factor authentication (MFA): MFA adds an extra layer of protection by requiring additional verification, such as a code sent to your phone, when logging in.
• Secure products and services: Choose reputable providers that prioritise security. Look for certifications like ISO and SOC2 compliance when selecting software and services.

2. Educate your team about phishing

One way cybercriminals can exploit small businesses is through phishing scams, in which cybercriminals impersonate trusted individuals or organisations to trick them into revealing sensitive information through deceptive emails or text messages.

A phishing email looks like it comes from a legitimate source, but fraudulently tries to get you to provide sensitive information, such as your password or credit card details. Some of these emails might also try to infect your device by getting you to click a link to a malicious website or attachment.

However, even the most advanced phishing is still toothless if you know enough to pause, think critically about the message, and react appropriately if something doesn’t seem right. With this in mind, it’s important to educate your team about phishing and train them to:

• Adopt a zero trust approach: Your team motto where data is concerned should be ‘never trust, always verify’. Bake security into your processes, for example, a payment can’t be processed without specific verification steps (even if it appears to be the CEO asking you to process it!)
• Identify phishing attempts: Teach your employees how to spot phishing emails by being on the lookout for suspicious links, urgent requests, or grammatical errors.
• Avoid suspicious links and attachments: Encourage your employees to hover over links before clicking, and to avoid downloading attachments from unknown senders.

3. Learn how to spot a deepfake

Conventional scams are difficult enough to spot, but AI-based scams can be harder to detect and so even more dangerous. Deepfakes allow cybercriminals to create seemingly legitimate audio and video that can be incredibly convincing. Voice cloning replicates somebody’s tone and language to trick someone else into having a genuine phone conversation. 

Cybercriminals can use deepfakes to impersonate executives, clients, or even government officials. Train your team to look for signs of deepfakes, such as:

• inconsistent eye blinking or pupil dilation
• artificial-looking noise or distortions
• poor lip-syncing
• blurred or irregular shadows

4. Stay informed and vigilant, and report suspicious activity

Cyber threats are constantly evolving, so it’s crucial to stay informed about the latest scams and security best practices. Regularly update your software, apply security patches, and consider subscribing to cybersecurity newsletters or blogs.

Finally, ensure you and your team report any suspicious activity. Work to create a culture where employees feel comfortable reporting anything unusual, even if it turns out to be harmless.

So, what should you do if the worst happens and your business gets attacked or compromised?

First of all, and most importantly – don’t panic. But do act quickly. Don’t be afraid to speak up – the cyber criminal wants you to be too embarrassed to tell anyone. Report the attack to your local Computer Emergency Response Team (CERT) agency or national cybersecurity agency, and if there’s an immediate threat to life or risk of harm, call the police.  

Cybersecurity is everyone’s responsibility. By following these tips and staying vigilant, you can significantly reduce your risk of falling victim to cybercrime.