Davey Winder reveals the biggest threats that hit systems in 2023 and what’s likely to happen over 2024.

A real-world targeted phishing attempt; the ‘boss’ is often posed asking a subordinate to buy gift vouchers.

CREDIT: Magictorch

You might assume that cybercriminals would focus their attentions on the biggest organisations – after all, those are the ones Y best able to afford huge ransoms. In fact, smaller targets can and do get attacked all the time.

“Regardless of the size of the business,” says Matt Cooke, strategist at cybersecurity specialist Proofpoint, “if they have a bank account, or sensitive information to steal, they are very much at risk.” Proofpoint has found that 72% of organisations with fewer than 500 employees have dealt with a material loss of sensitive information within the past 12 months (see http://proofpoint.com for more information).

Indeed, small and medium-sized businesses are prime targets for malicious actors. Recent research from cybersecurity specialist Trellix (http://trellix.com) reveals that companies with 51-200 employees are the most common victims of ransomware, representing a third of all attacks in Q1 2023. “Smaller, less prominent organisations often lack the resources to implement robust security measures,” explains Trellix VP Fabien Rech, “either from a financial or skill-based standpoint.” To protect your company and data, therefore, it’s vital to be aware of the threats that you’re most likely to encounter, and to direct your (likely limited) resources accordingly, so as to minimise exposure to these security risks.

Phishing for cash

One important thing to understand is that your small business will mostly face the same range of threats as larger ones. This is because, by and large, cybercriminals are creatures of habit. They use tried and trusted methods to attack your networks and data, sometimes with an indiscriminate ‘spray and pray’ approach, other times with carefully targeted attacks. In both cases, by far the most common threat facing businesses of all sizes is phishing.

The challenge with phishing is that it comes in many forms. Michael Skelton, VP of security operations at Bugcrowd (http://bugcrowd.com), notes that, while most associated with email, phishing can equally take place via SMS, online chat services or even live telephone calls. The most common theme is using social engineering to trick employees into revealing sensitive information, especially login credentials, which can then be used for further mischief.