Bad actors targeting small businesses

Sadly, small businesses are increasingly under threat by cyber bad actors. They face the challenge of integrating cybersecurity best-practices into their very specialized operations. Small businesses and startups face a unique challenge in the realm of cybersecurity. There’s a lot at risk for the small organizations threat actors target. Not only is there potential to incur major financial losses, but are also dodging irreparable damage to the brand.

A survey by Trilix uncovered a significant vulnerability in a wireless router commonly used by SMBs. The vulnerability is in a device from a vendor – with a large user base around the globe – that CISA (Cybersecurity and Infrastructure Security Agency) previously observed PRC-sponsored actors exploiting. Edge devices, like routers, exist at the boundary between internal and external networks, making them a key target for cybercriminals and threat actors. Attacks on these devices can quickly lead to a compromised network and, ultimately, a data breach.

The survey further reveals that 200,000 devices with the vulnerability are currently exposed on the internet – and could be exploited without required interaction. This is immensely concerning, considering the attack can lead to a complete compromise of the device, allowing for a network breach and unauthorized access to internal resources.

According to RiskRecon, during 2020 and 2021, data breaches at small businesses globally jumped 152%, while during the same time period breaches at larger organizations rose 75%. Just like a contractor wouldn’t use the same tools, techniques, and tactics to dig a post hole as they would for a swimming pool – malicious actors adjust what they target to ensure they effectively compromise the vast landscape of small business.

Recently CISA released an advisory about the People's Republic of China state-sponsored exploitation of network devices typically used in Small Office and Home Office (SOHO) settings. Included in this list is CVE-2020-8515, related to a DrayTek small business router.

Edge devices themselves, such as routers and firewalls are rather uninteresting, however these devices are the gateway that protect the soft underbellies of companies. Once compromised, it's the open doorway into the rest of a network that is enticing for the adversary to perform the same level of research a team performs. A compromised edge device can lead to intellectual property theft,

Sensitive customer or employee data loss, access to camera feeds, the opportunity to simplify the deployment of ransomware and in some cases a foothold into a network for years to come.

They also assume that if their security has been outsourced to a managed service provider, log monitoring is happening, or the service includes intrusion detection.” This misinformation or mindset is dangerous to small businesses. It is imperative to understand, you are a target no matter the size or type of business. Data continues to demonstrate that not only is this space a target but often a more likely target.

It is critical for SOHO and SMB users to understand their networks, stay updated on all vendor patches and immediately report breaches to law enforcement.

While ransomware and cyberattacks are on the rise among small and medium sized businesses, the good news is that these businesses can take steps NOW to avoid becoming a victim in the first place and lessen the impact if an incident does occur.

S Mohini Ratna, Editor, VARINDIA