Key takeaways
- Cyberattacks have significant business impact: Average ransom demands reached $1.54 million, with attacks typically causing 21 days of downtime and the loss of nearly 30% of customers.
- Employee awareness reduces risk: With 75% of cybersecurity incidents involving human factors, ongoing training helps employees recognize phishing, scams, and other common threats.
- Layered security strengthens defenses: Recommended practices include software updates, backups, encryption, MFA, least-privilege access, risk assessments, and endpoint protection.
- MSPs play a key security role: MSPs help clients improve cybersecurity through employee education, security guidance, and support for incident preparedness and cyber insurance.
Last year, the average ransom for businesses nearly doubled, from $812,380 to $1.54 million. These massive payouts aren’t the only loss for the business either. The average business hit by a ransomware attack experiences 21 days of downtime, and nearly 30% of customers will no longer do business with a company if they determine that it has compromised data. As a first line of defense against these financial, operational, and reputation risks, many businesses turn to developing greater cybersecurity awareness throughout their company.
Cybersecurity Awareness: The Basics
Cybersecurity awareness is the continuous education of the potential cybersecurity threats, the risks they pose to a business, and their mitigation. Whether clicking on a malicious link or accidentally sharing sensitive data with other employees via an email, phishing, data breaches, and ransomware attacks can often be traced to human error and susceptibility or the “missing link.” For example, according to Verizon, 75% of attacks have human involvement (e.g., the misuse of a privilege, stolen credentials, or social engineering attack). As a result, cybersecurity awareness and educating employees on cybersecurity best practices remains one of the greatest strengths every business can leverage to reduce the financial, reputational, regulatory, and cybersecurity risk posed by attacks.
8 Different Cybersecurity Best Practices Clients Should Know
Cybersecurity awareness encompasses many best practices that businesses can implement to strengthen their security posture and greatly minimize their risk for cybersecurity attacks.
These include:
- Regularly update software/systems. Malicious attackers exploit vulnerabilities in old and outdated software to gain access to unauthorized data and infiltrate systems and networks. Anti-virus and firewalls, in particular, should be updated regularly as they often function as the first line of defense against attacks.
- Create regular backups and have a disaster recovery plan in place. When an attack does occur, clients should have a documented plan that includes the tasks for different roles in the company, such as HR, executive managers, and IT. Simply having a backup plan in place can save clients anywhere from $100,000 to $540,000 per hour during downtime.
- Safeguard sensitive data. Data should be encrypted to deliver a first line of defense against common malware and viruses. Businesses should also implement strong access controls such as strong passwords, multi-factor authentication (MFA), and the principle of least privilege (POLP) to protect against unauthorized access to confidential and sensitive data.
- Conduct regular cybersecurity risk assessments. Businesses should take a proactive approach to their cybersecurity by regularly identifying weaknesses and vulnerabilities in their IT infrastructure, evaluating the current security controls in place to detect any security gaps, and discovering areas for improvement.
- Employee awareness. MSPs play an important role in educating clients about how they can strengthen their cybersecurity posture. This can include conducting regular employee training sessions on the latest employee phishing emails and scams, sending out newsletters with cybersecurity tips, and alerting employees to any changes in policy or management related to cybersecurity.
- Consider cyber insurance for increased protection. Cyber insurance can mitigate financial risk for businesses by assisting in the event of a lawsuit, helping them recover from data loss, investigating the source of the attack, and helping your business recover and respond to the incident.
- Develop a culture of security. Cybersecurity should be everyone’s responsibility, and the top management level must instill this message. Employees must always feel that it is better to ask and exercise extra caution rather than put the company at risk.
- Explore multi-layered protection. Consider adding tools such as advanced threat intelligence, endpoint monitoring, and anti-phishing protection to existing solutions such as malware protection for better defense against attacks.
How Lantech Learned its Lesson the Hard Way
Lantech, an MSP specifically catering to lawyers, learned to promote cybersecurity awareness for its clients the hard way. Their client, law firm Mastagni Holstedt, is currently suing the MSP for $1 million in damages. In addition, the law firm sued its cloud backup provider, Acronis, for not being able to recover data from it during the attack and being forced to pay a ransom to gain access to its network. In response, Acronis declared that its systems were not compromised, suggesting that the compromise may have come from a compromised password outside its systems.
The case with Mastagni demonstrates the importance of MSPs not only having a detailed contract with their clients that limits liabilities but also having cyber insurance, which helps minimize legal fees and costs related to managing the fallout of the client. Most importantly, however, it illustrates the importance of educating clients thoroughly on cyber awareness and how to implement the best practices above to minimize the risk of cyberattacks on their businesses.
Guardz Cybersecurity Awareness
Businesses today face increasing challenges in raising cybersecurity awareness that matches the evolving level of risk their business faces continuously. Guardz empowers MSPs to protect their clients against the latest threats by ensuring awareness training campaigns are sent out and completed, as well as their AI Phishing Simulation, which enables MSPs to gather detailed data reports, highlighting the individuals who successfully identified the phishing attempts and those who failed to do so. In addition, Guardz delivers multi-layered protection and cyber insurance to MSPs and their clients. These services work together to deliver clients a proactive approach to cybersecurity and the peace of mind that comes with it.
