October is Cybersecurity Awareness Month, making it a good time for Kentucky business owners, CEOs, practice managers, and office managers to take a hard look at their cybersecurity.
Not what you think is protecting your business.
What is actually protecting it.
Cybersecurity has become especially important for organizations that handle sensitive information or operate under regulatory requirements. Healthcare organizations may have HIPAA Compliance obligations. Defense contractors may need to address CMMC requirements. Financial businesses may fall under the FTC Safeguards Rule. Businesses that accept payment cards may have PCI DSS responsibilities.
Yet one of the biggest cybersecurity problems we see isn’t a lack of available technology.
It is the belief that the technology a business already has is “good enough.”
A firewall doesn’t automatically make a business secure. Microsoft 365 doesn’t automatically make a company compliant. Backups don’t automatically guarantee recovery. And having an IT person doesn’t necessarily mean cybersecurity risks are being managed.
The good news is that understanding these misconceptions is the first step toward fixing them.
Here are six cybersecurity myths we regularly encounter when working with small and midsize businesses.
Myth #1: “We’re Too Small for Cybercriminals to Care About Us”
This may be one of the most dangerous cybersecurity assumptions a small business can make.
Cybercriminals don’t necessarily care how many employees you have. They care whether they can gain access to something valuable.
That could include:
- Bank accounts
- Microsoft 365 accounts
- Customer information
- Patient information
- Employee records
- Intellectual property
- Credit card information
- Login credentials
- Business systems
- Sensitive government or defense information
Small businesses can also become stepping stones into larger organizations through vendors, contractors and supply chains.
NIST specifically recommends that small businesses treat cybersecurity as an ongoing business risk and implement foundational protections such as MFA, backups, software updates, employee training and phishing protection.
The fact:
Cybercriminals don’t have to target your business specifically when automated attacks can find vulnerable businesses for them.
That means your company doesn’t have to be a large corporation to need professional it support, cybersecurity and proactive monitoring.
Myth #2: “Our Employees Will Recognize a Phishing Email”
The classic phishing email used to be easier to spot.
Bad grammar. Strange email addresses. Obvious scams. Nigerian princes.
Those days aren’t necessarily representative of today’s phishing attacks.
Modern phishing messages can imitate vendors, banks, Microsoft, shipping companies, coworkers, executives and other trusted organizations. Artificial intelligence can also help attackers create convincing messages.
NIST warns that AI can make phishing messages increasingly convincing and recommends taking extra care with requests to click links, download files, transfer money, provide sensitive information or log into an account.
A suspicious message isn’t necessarily one that looks suspicious.
Instead, train employees to recognize unusual behavior.
For example:
- Did someone suddenly request a wire transfer?
- Did a vendor change its payment instructions?
- Is someone asking for confidential information?
- Is an executive making an unusual request?
- Is there a new login link?
- Is the message creating an unusual sense of urgency?
When something doesn’t look right, verify the request using a known phone number or another trusted communication method.
Don’t use the contact information contained in the suspicious message.
The fact:
A convincing email can still be a phishing attack.
This is why employee security awareness training should be part of your cybersecurity program—not an annual checkbox.
Myth #3: “We Have MFA, So We’re Completely Protected”
Multi-factor authentication is one of the most important security controls a business can implement.
But MFA isn’t magic.
NIST recommends MFA for small businesses and notes that some forms of MFA provide stronger protection than others. Phishing-resistant authentication can provide additional protection for sensitive systems and accounts.
Attackers may attempt to:
- Steal credentials and session information
- Trick employees into approving fraudulent requests
- Use social engineering
- Exploit poorly configured accounts
- Target weaker authentication methods
That’s why MFA should be one layer of a larger security strategy.
Your organization may also need:
- Endpoint protection
- Email security
- Patch management
- Privileged access controls
- Security monitoring
- Employee training
- Password management
- Backup and recovery
- Incident response procedures
- Regular risk assessments
The fact:
MFA reduces risk, but it doesn’t eliminate risk.
The goal isn’t to buy one security product and declare the company protected.
The goal is to build multiple layers that work together.
Myth #4: “Our Backups Have Us Covered”
This is another common misconception.
Ask a business owner:
“Do you have backups?”
The answer is usually yes.
Ask:
“Have you tested those backups recently, and do you know exactly how long it would take to restore your critical systems?”
The answer can change quickly.
A backup that exists but cannot be restored when needed isn’t much help during a ransomware attack, hardware failure or other disaster.
NIST recommends that small businesses regularly back up their data and establish measures to protect and test those backups.
A good recovery strategy should answer questions such as:
- What data is backed up?
- How frequently is it backed up?
- Where are the backups stored?
- Are backups protected from ransomware?
- Are backups monitored?
- Have restoration procedures been tested?
- How quickly can critical systems be restored?
- Which systems need to come back first?
For healthcare organizations, this becomes even more important because the HIPAA Security Rule includes requirements involving contingency planning, backup and restoration of electronic protected health information.
The fact:
Having backups is not the same as having a tested recovery strategy.
Your backup plan should be tested before you need it—not after the ransomware starts.
Myth #5: “Cybersecurity Is the IT Department’s Responsibility”
Your IT team plays an important role in cybersecurity.
But cybersecurity doesn’t happen exclusively in the IT department.
Employees open emails.
Employees create passwords.
Employees approve MFA requests.
Employees share files.
Employees use mobile devices.
Employees communicate with customers and vendors.
That means every employee has some responsibility for protecting the organization.
The FTC’s small-business cybersecurity guidance recommends controls including MFA, software updates, access restrictions, encryption, regular backups and employee training.
For organizations subject to HIPAA Compliance, workforce security awareness and training are also part of the HIPAA Security Rule’s administrative safeguards.
The same basic principle applies to organizations dealing with other regulatory requirements.
The fact:
Your employees can either increase your cybersecurity risk or become an important part of your defense.
That is why effective Managed IT Services should address people, processes and technology—not simply computers and servers.
Myth #6: “We’ll Know What to Do If Something Happens”
Imagine it’s Tuesday morning.
Several employees suddenly can’t access their files.
Your accounting software isn’t working.
Email may be unavailable.
Someone says they received a strange message.
Nobody knows whether the problem is a server failure, ransomware or something else.
Now the questions start:
- Should employees shut down their computers?
- Should affected devices be disconnected from the network?
- Who contacts IT?
- Who contacts management?
- Who contacts the cyber insurance company?
- Should law enforcement be contacted?
- How do you communicate if email is unavailable?
- Who communicates with customers?
- Who makes decisions about restoring systems?
- What systems should be restored first?
Trying to answer those questions while an attack is happening is not the time to develop your plan.
NIST recommends that businesses prepare for cyber incidents and establish response and recovery processes before an incident occurs.
The fact:
Your incident response plan shouldn’t make its debut during an incident.
A good plan identifies responsibilities, contacts, procedures and decision-making processes before something goes wrong.
Compliance Doesn’t Mean Buying Every Security Product
One of the biggest mistakes we see business owners make is assuming that cybersecurity compliance means buying a long list of expensive products.
It doesn’t.
Compliance requirements vary depending on your industry, the information you handle, your contracts and the specific regulations or standards that apply to your organization.
For example, the HIPAA Security Rule requires covered entities and business associates to implement appropriate administrative, physical and technical safeguards for electronic protected health information. It also requires risk analysis and ongoing risk management.
The FTC Safeguards Rule requires covered financial institutions to develop, implement and maintain an information security program appropriate to the organization’s size, complexity, activities and the sensitivity of the information involved.
For defense contractors, CMMC establishes cybersecurity requirements for protecting certain federal and controlled unclassified information within the Department of Defense supply chain.
And businesses that process payment cards may have obligations under PCI DSS, which establishes technical and operational requirements designed to protect payment account data.
The important point is that compliance should begin with understanding your actual risks and requirements.
Then you can determine what controls are appropriate.
The Real Cybersecurity Myth: “It Won’t Happen to Us”
This is the assumption behind many cybersecurity decisions.
A business owner may know that cybersecurity is important.
They may know they need better backups.
They may know MFA should be enabled.
They may know their computers should be patched.
They may even know their industry has regulatory requirements.
But spending money on something that prevents a problem that hasn’t happened yet can be difficult to justify.
That’s understandable.
The problem is that cybersecurity isn’t simply an IT expense.
For many businesses, technology is part of the infrastructure that allows the organization to operate.
If your computers stop working, your employees may stop working.
If your systems are encrypted by ransomware, your business may stop operating.
If sensitive information is compromised, you may face business disruption, contractual issues, regulatory obligations, legal expenses and damage to customer trust.
The question isn’t:
“Can I afford cybersecurity?”
A better question is:
“What risks am I accepting by not addressing these vulnerabilities?”
That is where a professional risk assessment, cybersecurity review or compliance assessment can provide useful information.
What Should a Small Business Do Next?
You don’t necessarily need to implement every possible cybersecurity technology tomorrow.
Start by understanding where you stand.
A practical cybersecurity review should consider:
- Who has access to your systems and data?
- Are MFA and strong authentication being used appropriately?
- Are computers, servers and applications patched?
- Are endpoints protected and monitored?
- Are your backups protected and tested?
- Do employees receive ongoing security awareness training?
- Do you know which regulatory requirements apply to your organization?
- Have you completed an appropriate risk assessment?
- Do you have an incident response plan?
- Can you demonstrate that your security controls are being maintained?
For organizations with compliance obligations, this process becomes even more important.
At iSAFE Complete, we work with Kentucky businesses to address technology, cybersecurity and compliance requirements through proactive Managed IT Services, computer support, cybersecurity and compliance solutions.
Our approach is not simply to sell another security product.
It’s to help business leaders understand what they have, what they need, where their risks are and what should be addressed first.
For organizations dealing with HIPAA Compliance, CMMC, FTC Safeguards, PCI DSS or other requirements, our compliance IT services can help bring technology, risk management and compliance activities together.
For healthcare organizations specifically, our healthcare IT services are designed around the cybersecurity and compliance challenges healthcare organizations face.
And if you simply need dependable Managed IT Services and proactive it support, we can help manage the day-to-day technology while keeping security and compliance in the conversation.
Don’t Confuse Peace of Mind With Protection
Cybersecurity myths are comfortable.
They allow businesses to say:
“We have antivirus.”
“We have Microsoft 365.”
“Our data is in the cloud.”
“We have backups.”
“Our employees know better.”
“We’re too small to be targeted.”
But none of those statements, by themselves, demonstrate that your business is adequately protected.
Cybersecurity is an ongoing process of identifying risk, implementing appropriate safeguards, monitoring those safeguards and improving them as your business and the threat landscape change. NIST describes cybersecurity as a continuous process rather than a one-time project.
If one of these six cybersecurity myths sounds familiar, don’t panic—and don’t ignore it.
Find out what your organization actually needs.
Schedule a free 10-minute discovery call with iSAFE Complete to discuss your IT, cybersecurity and compliance concerns.
Call 859-200-0428 or schedule your discovery call.
