October is Cybersecurity Awareness Month, and it’s a good time to take stock of what you actually know versus what you think you know when it comes to cybersecurity. Not all of the advice out there is accurate. Some of it has been repeated for so long that it starts to sound like fact, even when it’s outdated or simply wrong.
When bad advice goes unchallenged, it can create blind spots. And those blind spots are often where security problems begin. Small businesses aren’t immune just because they’re small, especially when outdated assumptions leave gaps that nobody realizes are there.
The good news is that many of these gaps are fairly simple to address once you know where they are. Here are six cybersecurity myths we still hear from small businesses, along with the truth behind each one.
Myth 1: We’re too small for cybercriminals to care about
There really is no such thing as a business that’s too small for an opportunistic cybercriminal. It doesn’t matter if you’re a one-person operation, a small business with a dozen employees or a much larger company. If you have exposed accounts or vulnerable systems, someone may try to take advantage of them.
Small businesses still have plenty that cybercriminals want, including valuable data, access to bank accounts and potential entry points to customers and vendors.
Fact: Cybercriminals often choose targets based on opportunity, not size.
Myth 2: Employees will recognize a phishing email
The days when every phishing email was full of typos and came from an obviously suspicious sender are gone. Today’s phishing emails can be polished, personalized and designed to look like they’re coming from someone you trust.
AI has made it even harder to identify a scam based on the writing alone. The SNAP method can still be effective, but your team also needs to pay attention to the behavior behind the message.
For example, ask yourself if the person sending you the email would normally:
- Make an unusual request
- Change payment instructions
- Ask for sensitive information
- Send a new or unexpected login link
If something seems off, it’s worth taking an extra minute to verify the request before clicking or responding.
Fact: A convincing email can still be a scam.
Myth 3: MFA fully protects our accounts
Multi-factor authentication (MFA) is important, but it isn’t invulnerable. Cybercriminals can use MFA fatigue to their advantage, counting on an employee eventually approving a request out of habit or annoyance.
One example is “prompt bombing,” where someone floods your phone with authentication requests in hopes that you’ll eventually approve one just to make them stop.
MFA is an important security tool, but it isn’t a complete shield. Attackers continue to find ways around weaker authentication methods, which is why MFA needs to be supported by the other security controls around it.
Fact: MFA should be part of a broader security strategy.
Myth 4: Our backups have us covered
Ask yourself this: If your business was hit with ransomware tomorrow, could you restore your data? And how long would it take?
Having backups is important, but an untested backup isn’t something you want to rely on during an actual incident. Backups need to be monitored and tested so you know they’re working and understand how long recovery would actually take. Knowing that ahead of time can make a big difference when every minute of downtime matters.
Fact: Having backups is not the same as being able to recover.
Myth 5: Cybersecurity is only IT’s responsibility
Your IT department does a lot to keep your business secure, but they can’t control every link employees click, every attachment they open or every request they receive. Cybersecurity decisions happen across every department. It only takes one bad click or one convincing request to create a problem.
That’s why employee security awareness training matters. When employees know what to look for, what to avoid and when to ask for help, they become another layer of your cybersecurity defenses.
Fact: Training employees to make good decisions strengthens your cybersecurity.
Myth 6: We know what to do if something happens
It’s Tuesday morning. Several employees suddenly can’t access their files.
What happens next?
- Should employees shut down their computers?
- Who calls IT?
- What do you do if your normal communication systems are down?
- When does the insurance company get involved?
- Who communicates with customers, and what do they say?
A lot of businesses discover during an incident that nobody has actually answered these questions.
Don’t rely on everyone figuring it out in the moment. Have an incident response plan in place and make sure the people involved understand their role.
Fact: Your recovery plan shouldn’t debut during an actual incident.
Cybersecurity Awareness Starts With the Facts
Cybersecurity Awareness Month is a good opportunity to make sure the assumptions guiding your security decisions are actually correct.
Myths can be comfortable because they make us feel like something is already handled. But cybersecurity gaps don’t always come from a missing product or security tool. Sometimes they come from assuming a protection is doing more than it actually is.
Take a few minutes this month to look at your own business. Are your backups tested? Do employees know how to handle a suspicious request? Is MFA being used correctly? Does everyone know what to do if something goes wrong?
If you’re not sure where your business stands, AT-NET can help you take a look. Schedule a free 10-minute discovery call and we’ll talk through what you have in place today and where there may be opportunities to strengthen it.
