Another day, another security breach. The media is littered with tales of companies being hacked into, data breaches and online service attacks that disrupt businesses.

While attacks on multinationals such as Sony and Target make the headlines, SMEs are often the forgotten victims. Symantec reports that in 2014, 60 percent of all targeted cyberattacks globally focused on SMEs.

“SMEs face the same threats from cybercriminals as large organisations,” says David Powell, Chief Security Officer, NAB. “The fact that SMEs often have fewer security measures in place only makes for an easier target, and criminals love an easy target.”

Cybersecurity matters

“Why me?” is often the first thing SME owners say in the wake of an attack.

“Business owners may imagine they have been unlucky; that an attacker must have handpicked their business out of millions of others,” says Powell. “What most business owners don’t realise is that cybercriminals use automated hacking tools to scour the internet to identify vulnerabilities. Using automated tools, cybercriminals can scan websites anywhere in the world, quickly and at little cost.”

Using these types of hacking tools, attackers can probe thousands of IP addresses, looking for weaknesses such as poorly configured websites, or internet-connected computers and servers using out-of-date technologies.

According to Incapsula’s 2014 Bot Traffic Report, 80 percent of the traffic to websites with fewer than 1000 visits per day didn’t come from customers or potential customers, but malicious agents with the sole purpose of probing the website looking for vulnerabilities.

Many bots are used for malicious activity including mass-scale hack attacks, Distributed Denial of Service floods, spam schemes, and click fraud campaigns.

Vulnerabilities are giving cybercriminals a foothold in a computer network, says Powell.

“From there they may be able to penetrate the network and steal business and customer information and on-sell this data to other criminals,” he says. “They may also be able to exploit the vulnerability in other ways, for example, installing malicious software on your networks or redirecting legitimate customers from your website to theirs to steal financial credentials.”

Four steps to protecting your business

When criminals are choosing a target, an SME with no security can look a lot like a mailbox with no lock – particularly compared with large companies with well-guarded computer networks, teams of IT security professionals on staff and large budgets to invest in the latest security tools.

“The good news is,” says Powell, “there are some simple things you can do to protect your business, and you don’t need a large team or budget to do so. The following security basics may protect your business from online attacks.”

1. Fortify your operating system

• Ensure anti-virus, anti-spyware and firewall software is installed and working.
• Make sure your computer has the latest patches installed including Operating System and other commonly used programs such as Microsoft Office (Word, PowerPoint, and Excel) and Adobe
• Ensure automatic updates are enabled so your operating system and software applications can receive important security upgrades.
• Uninstall any programs you don’t use.

2. Data protection is vital

• Make regular backups of your data and store them offsite. Test these backups regularly.

3. Don’t be lazy with passwords

• Use strong passwords or a passphrase using letters, numbers and symbols.
• Use a different password for each of your accounts.
• Use a ‘password safe’ to store an encrypted copy of all your passwords.

4. Be vigilant on access management

• Employees in your business should have their own login credentials to business systems.
• Remove administration rights from computers that don’t need it.
• Don’t browse the internet using an administration account. This prevents the entire network from becoming infected if a compromised website is visited.
• Ask your IT provider if they have remote access to your systems and what security controls they have in place.
• Ask your IT provider if they use different passwords for each of their customers’ sites.

For further information

Managing the threat of a cyber attack is a vital part of running any business in this new digital age. If you are looking for more information about how to protect your business from such threats, visit these sites.

•  For easy to understand computer security advice for home use and SME business, visit staysmartonline.gov.au
• To see the latest scams, or to report a scam, visit scamwatch.gov.au

 The Australian Cybercrime Online Reporting Network (ACORN) is a secure reporting and referral service for cybercrime and online incidents that may be in breach of Australian law. Certain reports will be directed to Australian law enforcement and government agencies for further investigation. report.acorn.gov.au

 More from NAB:

• Continuous improvement is key to business success
• Keeping meetings on time and on track
• Top 10 apps for small business