Information Security Best Practices: First Steps for Startups and SMEs

Consider the scale of malware threats facing a business today. Hundreds of thousands of new malicious files are detected every single day, and almost a third of user computers encountered an online malware attack in 2017 (Kaspersky Lab, 2017). Tens of thousands of phishing sites are created each day (Webroot, 2017). Ransomware, a form of malware that encrypts files on a computer demanding a ransom in exchange for (the possibility of) getting the decryption key, has, according to the European Union’s law enforcement organization Europol, “eclipsed most other global cybercrime threats” (Europol, 2017a, see also 2017b). In June of 2017, shipping giant Moller-Maersk was hit by ransomware. Maersk’s losses, according to a statement by CEO Soren Skou, were estimated to reach up to $300 million USD (Novet, 2017). The attack wreaked such devastation on the company’s IT infrastructure that Maersk employees, with both company email and address systems down, had to rely on using WhatsApp on their personal phones to do their work (Thomson, 2017). Two things are worth noting about the specific form of ransomware Maersk was infected with. First, it was designed to be self-replicating, meaning that every infected computer immediately started looking for new machines to infect. Second, researchers believe the ransomware in question, called NotPetya, was designed not for financial gain, but rather “to spread fast and cause damage” (Mathews, 2017), with little hope for companies of getting their data back even if they paid the ransom (Burton, 2017). However, malware is just one of many IT-related risks companies face. The abundance of Internet-connected computers in the array of devices known as the Internet of Things has introduced a host of new risks and vulnerabilities (Hypponen & Nyman, 2017). Consider the peculiar case of a North American casino where attackers used an Internet-connected thermometer in a fish tank in the casino lobby to gain access to the casino’s network and steal a database containing the casino’s highroller list (Williams-Grut, 2018). Data breaches can carry a high cost both financially as well as to a company’s reputation, as Yahoo! experienced first-hand after news broke, in the middle of a corporate merger, that all 3 billion existing Yahoo! accounts had been compromised (Oath, 2017).