The Akira ransomware group is targeting small to medium-sized businesses (SMBs) – 80% of its victims, since March 2023, have been SMBs. According to Arctic Wolf, the groups ransom demand ranges between $200,000 USD to over $4 million USD.
If the organizations refuse to pay, the gang threatens to expose names and data. According to the same source, most intrusions leveraged compromise credentials to obtain initial access.
Akira is just one example of the growing security problem for SMBs. While breaches at enterprises may grab the headlines, 56% of SMBs had cyberattacks last year.
Why ransomware groups target SMBs
SMBs are attractive targets for cybercriminals. They typically have fewer resources like IT support, and lack robust security procedures, like employee cybersecurity training.
Hackers also target SMBs to find entry points to larger enterprises. Many of the largest breaches in recent years were the result of third-party attacks that started with a smaller company that was digitally connected to another.
In 2023, we’ve seen multiple breaches of SMBs that turned into large-scale attacks on major companies, including AT&T, Chic-fil-A, and 1Password.
The impact of cyberattacks on SMBs
A successful breach can cause significant damage. Globally, the average cost to recover from a data breach is $4.45 million, according to IBM’s Cost of a Data Breach Report 2023 — a 15% increase over the past three years. For SMBs, the average cost of a data breach is nearly $150,000.
Indirect costs can also be significant. Breaches can undermine customer trust and damage reputations. Data may be lost forever. Even when the ransom is paid, nearly 40% of companies are unable to restore their data.
What can SMBs do to mitigate their risks?
Businesses should use best practices for cybersecurity, such as adopting the cybersecurity framework for SMBs developed by the National Institute of Standards and Technology (NIST). According to the framework, SMBs can mitigate risks by:
- Controlling who can access your network and data
- Having formal policies for use
- Encrypting sensitive data, both at rest and in transit
- Using network firewalls with integrated security
- Monitoring for unauthorized access
- Backing up data regularly
- Creating plans for responding and recovering from attacks
These best practices can help reduce unauthorized access. However, 98% of cyber attacks start with some form of social engineering. If threat actors get their hands on an end-user’s valid passwords, they can bypass many of these security measures.
So, it is not only crucial to pay close attention to password policies, but to also block known compromised passwords.
Go beyond complex passwords
Enforcing a password policy that helps end-users create stronger passwords and blocks the use of weak and common phrases will make it more difficult for hackers. However, this must go beyond requiring basic password compliance requirements.
Specops data shows that 83% of compromised passwords satisfied both length and complexity requirements of regulatory password standards.
Password attacks are often successful because users are predictable. They tend to reuse passwords and use similar patterns when creating passwords and trying to meet the complexity requirements.
For example, starting with a common word and then following it with a number or special character.
Robust password policy enforcement can help users create easy-to-remember, but hard-to-crack passphrases.
Use Multi-Factor Authentication
MFA reduces the risk of account takeovers by adding an additional layer of protection.
Even if passwords are compromised, unauthorized users can’t access your network without the second authorization, such as a push notification sent to mobile devices or third-party identity verification providers.
This helps mitigate the risk of stolen credentials and brute-force password hacking.
Block compromised passwords
The easiest way for cybercriminals to access networks is by using compromised credentials. At any one time, more than 24 billion user names and passwords are for sale on the dark web.
You can significantly reduce your risk by blocking the use of known compromised passwords with Specops Password Policy with Breached Password Protection.
Audit Active Directory accounts
Conduct password audit scans of your Active Directory with Specops Password Auditor to check end-user accounts against 950 million compromised passwords and other password related vulnerabilities.
This is a free read only scan that can help your organization proactively identify password vulnerabilities in multiple reports.
End-user awareness training
88% of data breaches can be traced back to human error, according to a joint study between a Stanford University researcher and Tessian. The World Economic Forum’s Global Risk Report puts that figure at 95%.
SMBs should require end-user training to help them better understand importance of following cybersecurity policies and recognizing the signs of phishing, smishing, and other attacks aimed at stealing their credentials and falling victim of ransomware.
Improve cybersecurity with better password protection
SMBs can start enhancing their security posture by protecting their frontline.
Specops Password Policy protection helps enforce compliance requirements by automatically blocking the use of over 4 billion compromised passwords.
Learn more about Specops Password Policy solution to mitigate your cyber risks. Get a demo or free trial today.
Sponsored and written by Specops Software.