Cybersecurity basics for startups

In this article, we will explain the types of cybersecurity threats faced by startups, the consequences of falling victim to a cyberattack, and how businesses can bolster their defences.

Startups in 2021 need to use technology to a greater or lesser extent as part of their day-to-day operations. Whether it’s simply a matter of keeping in touch with customers by email or running a full-scale e-commerce enterprise, modern businesses all need to use computers and IT systems.

But although technology helps to facilitate business in the 21st century, increased reliance on IT also introduces risk in the form of vulnerability to cyberattacks. It is therefore vital to ensure there are sufficient cybersecurity measures in place to safeguard IT infrastructure and data.

What are the main types of cybersecurity threats faced by startups?

There are two main forms of cybersecurity threat facing businesses:

External

Direct cyber attacks from external sources are a fairly routine occurrence for most organisations. The good news is that, as long as any software is kept updated, inbuilt antivirus measures generally provide decent protection against most of the common forms of malicious hacking.

Internal

Any staff who are not trained in the basics of cybersecurity and data protection often pose a bigger threat than external hacking. This is generally inadvertent – such as clicking on a link in a scam email or losing a USB stick – but a disgruntled former employee can also cause a major cybersecurity headache.

Other common types of cyberattacks

There are thousands of specific types of cyberattacks, but here are some of the most common ones:

Malware and ransomware

Malicious software which unsuspectingly comes to be installed on a computer system or device is known as malware.

Ransomware is a type of malware that can lock up computers and demand payment (usually by Bitcoin) to unlock them. Occasionally malware hides as spyware and, rather than locking up a device, it collects sensitive data such as passwords.

Phishing

A play on the word ‘fishing’, phishing attacks cast a ‘phishing’ net to lure individuals into disclosing personal data and security details.

• How to fund a startup in the UK
• 5 ways to identify a good business idea

Phishing normally involves emails that appear legitimate at first glance, using the logos of banks or companies, etc. A variant of phishing is known as ‘spear phishing’, which involves the targeting of individuals or select groups through the deployment of more personalised emails.

Distributed Denial of Services (DDoS)

DDoS attacks aim to cause maximum disruption to a company’s websites and any of its online services. Multiple compromised computer systems – often infected by a Trojan – will essentially overwhelm a website with web traffic.

During a DDoS attack, the web servers are flooded with messages, connection requests, or malformed packets, causing network services to slow down or even crash and shut down entirely.

Brute force cracking

Cybercriminals attempting to gain access to a computer system sometimes use software tools that automatically try to find the correct password, using a trial and error technique known as “brute force cracking”.

The cracking tool will methodically proceed through all possible combinations of characters in sequence until it succeeds.

Social engineering

Social media presents novel ways for malicious hackers to trick, manipulate or blackmail entrepreneurs or their employees into releasing security details or sensitive data.

What are the consequences of a cyberattack on a small business?

The fallout of a cyberattack generally falls into three categories:

1. Data protection

The UK General Data Protection Regulation requires businesses to ensure that any personal data they process is protected from cyberattacks using “appropriate technical or organisational measures”.

Failure to do so can result in a fine from the Information Commissioner’s Office (ICO) up to the higher amount of £17.5 million or 4% of total annual worldwide turnover.

2. Reputational damage

A cyberattack that results in a substantial breach of sensitive personal data of customers can significantly damage the reputation of a business.

3. Infrastructure damage

Many modern businesses struggle to operate at all without their IT systems. Although a cyberattack is particularly serious for an e-commerce business, an entrepreneur who cannot access their email will face disruption to their day-to-day activities.

What should a business do in the aftermath of a cyberattack?

Once a business becomes aware that they have suffered a cyberattack, they should take the following steps:

1. Assess – assess the type of cyberattack and the scale of damage. Identify whether it was a purely external hack or involved a member of staff.
2. Action – plug any existing security holes, update software, change passwords and, in the case of an internal threat, decide on the appropriate disciplinary action.
3. Inform – the ICO should be informed of personal data breaches within 72 hours under the UK GDPR. Any relevant individuals may also need to be informed.
4. Record – the incident should be documented and stored.

How can a small business avoid a cyberattack?

Most cyberattacks can be prevented simply by being aware of the general threats, as outlined in this article and using common sense in relation to IT systems and data protection. Here are some tips and tricks:

• Auditing – carry out regular assessments of IT and data security within your business.
• Updates – make sure all software is regularly updated, especially operating systems such as Windows.
• Passwords – ensure that your passwords are long and complex, and use two-factor authentication where possible.
• Encryption – use encryption wherever it is available, particularly in relation to any personal data stored in databases, etc.
• Cloud working – most cloud services have excellent cybersecurity capabilities, and working in the cloud is generally more secure compared to home and office networks.
• Training – as well as ensuring they are aware of the most common cybersecurity threats themselves, entrepreneurs should also share this knowledge with any employees through training sessions.
• IT Policies – a set of clear IT policies, which include data protection and cybersecurity provisions, should be provided to members of staff and any relevant contractors.