October is Cybersecurity Awareness Month and it's a good time to take stock of what you know vs. what you think you know when it comes to cybersecurity. Not all the advice out there is accurate. Some have circulated for so long that it's taken on a life of its own and gets repeated until it sounds like fact, even when it's outdated or wrong.
When bad advice goes unchallenged, it creates blind spots. And blind spots are exactly what cybercriminals look for. Small businesses can be attractive targets when security gaps give cybercriminals an opportunity to gain access.
The good news is that these gaps are simple to close once you know where they are. Here are six myths we hear from small business owners regularly, along with the truth behind each one.
Myth 1. We’re too small for cybercriminals to care about
Even very small businesses can be targeted by opportunistic cybercriminals. It doesn’t matter if you’re a one-person operation, a small business with a dozen employees or a large corporation. If you have exposed accounts or vulnerable systems, bad actors can take advantage of them. A small business can offer valuable data, access to bank accounts or entry points to customers and vendors.
Fact: Cybercriminals often take advantage of opportunities regardless of a business’s size.
Myth 2. Employees will recognize a phishing email
Phishing emails aren’t always obvious. Many are polished, personalized and designed to look like messages from trusted sources.
As phishing techniques become more sophisticated, the wording of an email alone may not be enough to determine whether it’s legitimate. Instead, your team needs to think about sender behavior. For example, ask yourself if the supposed sender would:
- Make an unusual request
- Change payment instructions
- Request sensitive information
- Send a new or unusual login link
If anything seems off, double-check before clicking or responding.
Fact: A convincing email can still be a scam.
Myth 3. MFA fully protects our accounts
Multi-factor authentication (MFA) is important, but it's not invulnerable. Attackers may use techniques such as MFA fatigue, sending repeated authentication requests in hopes that a user eventually approves one. For example, “prompt bombing” floods your phone with requests in hopes you’ll approve access just to get them to stop.
Keep in mind, MFA is a tool, not a shield. Attackers are finding ways to get around weaker authentication methods, which is why MFA needs support from the controls around it.
Fact: MFA should be part of a broader security strategy.
Myth 4. Our backups have us covered
Ask yourself: if your business was hit with a ransomware attack tomorrow, could you restore your data? How long would it take?
A backup is great when you know it’s going to work. However, an untested backup isn’t something you can rely on during an incident. Knowing how long your business will be down can save you time and money.
Fact: Having backups is not the same as being able to recover.
Myth 5. Cybersecurity is only IT’s responsibility
Your IT department does a lot to keep your business safe, but they can’t control every click employees make. Cybersecurity decisions happen across every department. A single unsafe action can create an opportunity for attackers to compromise accounts, devices or data.
Employee security awareness training matters. When everyone knows what to look for and when to ask for help, they become part of your cybersecurity defenses.
Fact: Training employees to make good decisions strengthens your cybersecurity.
Myth 6. We know what to do if something happens
It's Tuesday morning. Several employees suddenly can't access their files. Many teams discover in that moment that nobody has answered the basic questions:
- Should employees shut down their computers?
- Who calls IT?
- What do you do if communication systems are down?
- When does the insurance company get involved?
- Who communicates with customers? How?
Don’t rely on memory in the moment. Have an incident response plan.
Fact: Your recovery plan shouldn’t debut during an incident.
Cybersecurity awareness starts with the facts
Cybersecurity Awareness Month is about making sure the assumptions guiding your decisions are correct. Myths are comfortable. They let you feel covered without having to dig deeper. But cybersecurity gaps aren’t always caused by a missing product or procedure. They can also come from assumptions that existing protections are enough.
If any of these myths sound familiar, it’s time to take a closer look at where your business stands. Schedule a free 10-minute discovery call, and we’ll help you start identifying where your existing protections are strong and where there may be opportunities to improve.
Call us at 206.414.7441 or schedule a free 10-minute discovery call.