Courcy's Future Threats - 7 August 2012

Given the amount of time and energy required to break through a company’s online defences, it is tempting to imagine that hackers will target big companies to secure the biggest possible payoff for their efforts, but small business now appear to be at greater risk than has been the case in the past.

According to security firm Symantec, the percentage of targeted attacks aimed at small businesses doubled in the first half of 2012. Experts believe this is because although the payoff could be smaller, they are significantly more vulnerable to attack than large companies. Furthermore, small companies often partner with large businesses in fulfilling major contracts. Smaller companies can be the weakest link in the chain, so cybercriminals use them to gain information they can use to penetrate the defences of their larger partners.

Symantec’s mid-year Intelligence Report shows that in the first six months of the year more than a third of targeted attacks on businesses were aimed at companies with fewer than 250 employees, double the percentage of attacks targeting small companies at the end of 2011.

A targeted attack is one tailored to a specific company. Cybercriminals customise malware to particular vulnerabilities and use information gathered publicly, or stolen from other companies, to create emails with malicious attachments that have a higher chance of being opened by employees. Social engineering has proved successful despite corporate efforts to bolster security training and warn workers to not open potentially dangerous emails.

Apparently, companies in the defence industry are the top targets of such attacks, followed by chemical and pharmaceutical firms and manufacturing companies, respectively. Large companies with more than 2,500 employees remain the most popular targets, accounting for 44% of all targeted attacks in the first half of 2012, but the trend will be an important one to watch.

Other factors are also contributing to more attacks on small businesses. More of them are online, interacting with customers on social networks, which in turn increases their visibility to hackers, said International Data Corporation (IDC) analyst Raymond Boggs. In addition, an increasing number of employees are using mobile devices that provide more open doors to hackers.

“It’s not quite a perfect storm of bad news for smaller companies, but close to it,” he said.

• “They [small businesses] are not as prepared, because they don’t think they have to be, and that’s left them vulnerable.”

Kevin Haley, director of Symantec’s Security Response Unit