Cybersecurity threats for small businesses, and how to reduce the risk
Key Takeaways
- What is ransomware, and what backup does CISA name?
- How do you spot a phishing email before you pay?
- Does a host replace those controls?
What is ransomware, and what backup does CISA name?
CISA describes ransomware as malware that encrypts files so the files and the systems that rely on them cannot be used. The actor then demands a ransom for decryption. CISA's backup practice is offline, encrypted copies of data, tested on a regular schedule.
The same page says to patch software and operating systems, and to scan for vulnerabilities, especially on internet-facing devices (CISA, Stop Ransomware). This page does not claim those steps stop every attack.
How do you spot a phishing email before you pay?
CISA's February 1, 2021 guidance says phishing uses email or a malicious website to ask for personal information while posing as a trustworthy organization. Check the sender address for small changes, do not follow links in the message, and do not open an unsolicited attachment. CISA also says to enforce multifactor authentication (CISA, Avoiding Social Engineering and Phishing Attacks).
A compromised mailbox can be used to copy an invoice and redirect a payment. Verify a payment change with a known contact, not with the details inside the email. Email authentication, SPF, DKIM, and DMARC, is a separate guide: SPF, DKIM, and PTR.
Does a host replace those controls?
No. Tested updates, monitoring, and backups on a host can close part of the website gap. They do not replace MFA, offline backups, or a check of a vendor that already has access. This page does not certify anyone and does not guarantee that an attack will fail.
References
- CISA. Stop Ransomware. https://www.cisa.gov/stopransomware
- CISA. Avoiding Social Engineering and Phishing Attacks. Released February 1, 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks
- Related guide: SPF, DKIM, and PTR.