TLDR: The end of 2013 provided a painful reminder that cyber-crime remains prevalent and that damaging threats from cyber-criminals continue to loom over businesses and consumers.
In last year’s annual security threat report from Symantec, it was made very clear that small businesses are increasingly being targeted by malicious hackers. The updated 2014 report was just released and it shows that things are now even more serious for smaller firms when it comes to online risks. For example, in last year’s report half of all spear phishing attacks were targeted at large enterprises, those with more than 2,500 employees. This year, however, the new report shows that only 39 percent of such attacks are still targeted at large enterprises as more and more attacks are now focused on small- (30 percent) and medium-sized businesses. This is a significant increase for smaller organizations from 2011 when only 18 percent of such attacks were targeted at these firms. Clearly this trend is evidence that hackers are taking notice of the fact that more SMBs are going digital and embracing the web but also likely lacking the defenses and employee training procedures found at large enterprises. Fox Business expands, ““Targeted attacks against small businesses almost doubled last year – it was up 91%. And it lasted three times longer than what we saw in 2012,” says Brian Burch, Symantec’s vice president of Global Consumer and Small Business Segment Marketing. Longer attacks, says Burch, hurt small businesses more than they do large enterprises. “You’re wearing down a company with [fewer] resources, who can’t batten down the hatch and ride out the storm,” says Burch. “Frankly, there’s more to steal from [SMBs] than consumers, and they’re a lot less secure than a lot of large enterprises,” says Burch. Burch says there are two main types of attacks occurring against small businesses. Ransomware attacks are those in which criminals invade computers at a company and rapidly encrypt important data. Burch says there was a 500% increase in these kinds of attacks last year. “[The cyber criminals] will attempt to represent themselves as law enforcements and say illegal activity has occurred, and your computer has been locked by the FBI or the CIA,” says Burch. Then, they’ll demand a fee payable in cyber currency. While the fee is not high – Burch says often it ranges from $300 to $500 – businesses often need professional assistance to recover their encrypted data. The second kind of attack is often undetectable – even by the victim. Burch says cyber-criminal syndicates are increasingly using small businesses, often those working in the supply chain of large companies, as Trojan horses to attack major enterprises. These types of attacks were particularly pervasive during the holiday season, he says…”
