iscover
ReporterShare this article on:
Powered by
MOMENTUM
MEDIA
Kaspersky data has revealed that the average loss from a single cyber attack has exploded from $34,000 to just under $200,000 with small businesses three times more likely to fall victim to fraudsters than larger companies.
The Kaspersky researchers assessed the dynamics of attacks on small and medium-sized businesses between January and April 2022 and the same period in 2021 to identify which threats pose an increasing danger to entrepreneurs.
The data revealed that in addition to financial hits, these companies have had to shoulder legal fees, compliance penalties, the loss of customers and damaged reputations. The researchers also found the total number of attacks have increased significantly.
In 2022, the number of Trojan-PSW (Password Stealing Ware) detections increased by almost a quarter compared to the same period in 2021 to reach 4,003,323 from 3,029,903.
Trojan-PSW is a malware that steals passwords, along with other account information, which then allows attackers to gain access to the corporate network and steal sensitive information.
Another top attack takes advantage of Remote Desktop Protocol (RDP) technology. With the shift towards remote working, many companies have introduced RDP, which enables computers on the same corporate network to be linked together and accessed remotely, even when the employees are at home.
Despite the normality of such technology, it puts the security of employee devices and the corporate systems of a business in danger, as RDP is of particular interest to cyber criminals.
With RDP in place, if the attacker gains access to the corporate network, they can then conduct fraud on any of the business’ computers that have been linked.
Security measures need to evolve to support these sophisticated setups, according to Denis Parinov, Kaspersky security researcher, noting that the shift to remote working and the introduction of numerous advanced technologies in the daily operations of even small companies have made a significant impact.
“Cyber criminals are already way ahead of the curve, so much so that virtually every organisation will experience a breach attempt at some point.
“For small companies today, it’s not a matter of whether a cyber security incident will happen but when.
“Having trained staff and an educated IT-specialist is no longer a luxury but a must-have part of your business development,” Parinov said.
The overall number of attacks on RDP has decreased slightly, but not in all countries. For example, in the first trimester of 2021 there were about 47.5 million attacks in the United States, whereas for the same period in 2022, the number had risen to 51 million.
Many small businesses are unable to recover from such attacks. To prevent losses, Kaspersky researchers urge business owners need to take better care of their business’ online security with security beginning first and foremost with employees.
According to public reports, the average employee has access to over 11 million files. The information that they have access to can vary from financial information or customer data to the secrets of their company’s development.
Cyber criminals are aware of this, which is why most attacks on companies are conducted through its employees, who are often untrained in the cyber risks associated with their role.
One person in particular also has a huge bearing on a business's overall security – the IT specialist.
Advanced security services can provide built-in training to keep IT specialists up to date with the latest cyber threats, Kaspersky stated.
Through training and education, business owners can turn them into sought-after cyber security specialists who are able to analyse how threats may hit their particular organisation and adapt technical and organisational cyber security measures accordingly. This will help businesses avoid additional costs related to breaches of their corporate systems, according to the researchers.
Experts advise getting an advanced security product to provide incident analysis. Many organisations don't have any plan in place to mitigate a breach of their organisation, let alone the necessary protection to prevent an infringement in the first place.
This is particularly true if a threat infiltrates their system and goes undetected which is entirely possible if network monitoring and automated threat detection mechanisms aren't in place.
[Related: PwC reveals 13k more SA public servants impacted by payroll hack]
Be the first to hear the latest developments in the cyber industry.
