Cybersecurity for small businesses: risks and solutions

Small businesses face increasing risks related to cybersecurity, especially in e-commerce. The lack of training and appropriate tools makes them easy targets for cyberattacks. This article looks at how to mitigate these risks and implement good security practices.

E-commerce has been experiencing rapid growth in Portugal, mainly based on the investment made by thousands of small businesses, many of them one-man operations.

This has been confirmed by a recent Mastercard Economics studywhich tells us that our country is the one with the most grew in e-commerce among SMEs across Europe, with an expansion of 39% compared to the years of the pandemic.

Simpler and cheaper than setting up a physical business, e-commerce opens doors to thousands of entrepreneurs who can earn additional income or even give their professional lives a new direction.

However, as with other types of business, betting on the online brings with it certain threats to businessand in particular those related to cybersecurity.

Why are small businesses an easy target for cyber-attacks?

Cybersecurity in small e-commerce businesses encounters obstacles that are easier to overcome in larger companies, not least because entrepreneurs often don't have the necessary training in the area, or they don't have the financial capacity to use technologies or specialists in the digital security of companies.

In addition to the lack of training in the area and the economic means, there is also the quality of the platforms used for sales, something that takes on even greater importance when deciding selling without a website through marketplaces based in countries where European data protection law does not apply, which ends up putting the business and customer data at risk.

Finally, even if the entrepreneurs take the IT security of their SMEs very seriously, all it takes is the use of free security toolsAs a general rule, cyber-attacks are designed for consumers, not businesses, so that they multiply and have serious consequences.

Main digital security risks for SMEs

According to the European Network and Information Security Agency (ENISA), the cybercrime is becoming an increasingly recurrent and damaging danger for SMEs. The data shows that more than half of European SMEs (57%) risk going out of business or facing numerous financial difficulties in the event of a cyber-attack.

Despite the enormous advances in the field of cybersecurity technology, the truth is that the reasons we have already mentioned make SMEs more vulnerable to cyberattacks, such as:

• Theft of sensitive company and customer dataand in particular the financial ones;
• Identity theft;
• Installation of ransomware which forces companies to pay a ransom to regain control of their site;
• Overloading servers with trafficmaking them inaccessible to customers;
• Malware installation which damages devices and opens the door to the theft of personal and financial data.

Good cybersecurity practices you should adopt

To avoid economic and reputational losses, theft of sensitive data or ransom payments, it is essential to protect your company's data, above all by adopting preventive measures such as:

• Keeping the operating system and programmes used in the business up to date at all times;
• Use an official antivirus and a robust firewall;
• Betting on certified and proven secure payment methods;
• Set up filters to block malicious, fraudulent and phishing sites;
• Setting up the company Wi-Fi network securely by, for example, changing the name/SSID, deactivating WPS and using WPA2 encryption;
• Back up regularly using the 3-2-1 rule (three copies, two types of media, one off-site copy);
• Have a cloud backup.

To all these security tips, small online businesses should also add a detailed action plan (to be put into practice in the event of a cyber-attack) that guarantees a quick recovery.

Affordable tools to protect your company

Avoiding cyber attacks on online businesses depends not only on preventive prophylaxis based on good cybersecurity practicesbut also of accessible tools that help improve online performance and ensure greater security of operations.

Among the most commonly used are

• Kaspersky or ESET antivirus
• cloud backup solutions (such as NOS Backup Pro, Dropbox or Google Drive)
• password managers

In the case of more complex and damaging threats, it is recommended to use endpoint detection and response (EDR) tools, VPN solutions and software that offers content filtering and device control functionalities.This is the case with Trend Micro Worry-Free Business Security and the Sophos XG Firewall platform.

Finally, regardless of whether your company sells with or without a website, we advise you to utilisation of online payment solutions such as REDUNIQ, which combines decades of development with the fact that it is the the only acquirer to hold PCI-DSS certification in our country, which defines the security standards to be followed and regularly audited in the context of e-commerce payments, websites and applications..