Cybercriminals Have Small Town, USA in Their Crosshairs: How to Fight Back

It’s no secret that cybercriminals are targeting small businesses. Yet somehow, everyone seems to know that except the small businesses themselves. SMBs think:

• “I’m too small to hack.”
• “I have nothing of value to offer cybercriminals.”
• “The bad guys are busy with bigger fish – they’ll just ignore me.”

Meanwhile, threat actors are thinking:

• “It’s not about how small the organization is. It’s about how much their data or intellectual property is worth.”
• “This company is an easy stepping stone into a major corporation downstream.”
• “The ‘bigger fish’ have cybersecurity solutions too sophisticated to breach easily; let’s go for these easy targets before they level up.”

The sooner SMBs know they’re at the top of the list for easy attacks, the sooner they can do something about it.

How to Fight Back? Don’t be afraid to ask for help

For SMBs whose resources are strapped, IT teams are small and security benches aren’t deep. The only logical answer is to get help from outside. If you don’t know, ask. You’ll find help for every step along the way.

Before an Incident

There’s a lot a smaller organization can do to prepare for an incident, and several of these options don’t cost anything.

• Government or Government-adjacent entities like CISA and MS-ISAC are critical resources that offer free advice. The Cybersecurity and Infrastructure Security Agency (CISA) is the “pinnacle of national risk management for cyber and physical infrastructure” and supports NIST initiatives along with security frameworks of its own. The Multi-State Information Sharing and Analysis Center (MS-ISAC) is a CISA-supported project that acts as a trusted security partner for over 13,000 U.S. government organizations and seeks to raise the level of security competency among its members by fostering collaboration and communication.
• Nonprofits like the Center for Internet Security (CIS) – they run the MS-ISAC – also provide great, straightforward direction for smaller and less security-sophisticated companies. Take the CIS Controls, for example – they’re a great way to get started and make sure your organization ticks the boxes for basic security hygiene.
• Cyber Insurance providers seem like a counter-intuitive source for direction before something happens, but a lot can be learned from their requirements for approval. Use their “how to qualify for cyber insurance” metrics as a guide for what your organizations should be using as a base minimum; things like multi-factor authentication, a solid incident response plan, strong security controls, and encryption.

During or After an Incident

When you’re dealing with a critical event or incident response, it helps to have the right outsourced solutions. For SMBs with lean (or nonexistent) IT teams, this is sometimes the only way forward in an environment filled with ever-more advanced threats.

We’re not the only managed solution out there, but just to illustrate the point: Nomic is an outsourced security solution providing help from the outside to SMBs in critical need. We help you fight back:

• Before an attack – With the Outpost positioned at the edge of the network – beyond your firewall – to continuously shut down inbound recon and exploitation attempts. This preemptive capability is informed in part by our proprietary CINS Active Threat Intelligence feed.
• During an attack – Our proprietary Network Cloaking feature makes your entire network invisible to attackers as soon as a malicious entity has been detected. No pings go in, and no C2 commands come back out.
• After an attack – Insight’s Network Flows allow you to “rewind the DVR” of your traffic history, piecing together attack patterns and correlating all network flows, DNS queries, and web sessions to give you the full 360-degree story of an attack.

And our Support team is there every step of the way.

Let The Experts Do the Heavy Lifting

At the end of the day, it doesn’t matter why small companies are being targeted or what steps you should take if you’re not the one with the in-house security team. All that matters is that you are protected, and many small SMBs turn exclusively to managed solutions for this.

This is perfectly fine. Just a few things to bear in mind:

• Cover all 3 Stages – Ensure that your cybersecurity strategy covers all three stages: Before, during, and after an incident
• Find a Specialist – At Nomic, we understand small businesses because we are one. We understand the position most of our customers are in when they come to us; unprepared, understaffed, and overwhelmed. They need a managed security solution that can guide them every step of the way on their cybersecurity journey. Our solutions cover the before, during, and after stages of attack and are focused exclusively on cyber protection, prevention, and awareness.

As a small organization feeling all this pressure, we know how you feel. The best thing you can do is find a cybersecurity partner you trust will be there for you, get you to the next level, and do it with the resources you have on hand.

Open up a conversation with one of our security specialists and discover how we can help.

‍