English
Thailand: Password stealers eye small businesses
Small and medium enterprises form the backbone of Southeast Asia’s growing economy. Accounting for more than 90% of the private businesses in the region, this sector is responsible for generating employment, exports and GDP growth.
Hit badly by pandemic-induced lockdowns, SMEs are embracing e-commerce and digitisation to recover from the prolonged bout with physical restrictions and unstable cash flow. Cybercriminals, on the other hand, are delivering their own one-two punch, the global cybersecurity company Kaspersky warns.
Given the upturn in online activity, it’s no surprise that malicious activities zeroing in on small and medium enterprises in Southeast Asia also increased during the first half of 2022.
In just six months, cybercriminals launched 11.3 million web attacks against SMEs in six key Asean markets: Indonesia, Malaysia, the Philippines, Singapore, Thailand and Vietnam. Most of the incidents were aimed at Kaspersky users from Indonesia, Vietnam and Thailand.
The figure, covering businesses with 50-250 employees, was based on detection reports received from Kaspersky customers who consented to provide statistical data.
Web-based threats are a category of cybersecurity risk that may cause an undesirable event or action via the internet. Web threats are made possible by end-user vulnerabilities, web service developers/operators or web services themselves.
$74,000 PER BREACH
“The cost of a single data breach against an SME was $74,000 in 2021, according to our latest report,” said Yeo Siang Tiong, general manager for Southeast Asia at Kaspersky.
“We all know that this sector has been on its knees since the pandemic and with the wave of attacks cybercriminals are launching against them, we should find the balance of including cybersecurity into their limited budgets to ensure a more sustainable recovery.”
Aside from web threats, Kaspersky said it also detected 373,138 instances of Trojan-PSW (password stealing ware) trying to infect SMEs in the region during the first half of 2022. The highest number of incidents occurred in Vietnam, Indonesia and Malaysia.
Trojan-PSW is malware that steals passwords, along with other account information, which then allows attackers to gain access to a corporate network and steal sensitive information.
“Small business owners may think their companies are too insignificant to become a target for cybercriminals. There is a certain logic in that because attackers usually look for maximum profit from minimum effort,” said Mr Yeo.
“However, enterprises and government organisations should remember that SMEs are usually third-party suppliers to bigger companies and critical entities. This sector is part of a bigger chain and, like dominoes, if a single password stealer can enter into a small enterprise’s systems, consider the entire chain compromised.”
For small businesses, choosing a security solution is traditionally difficult. Products for home users lack the necessary capabilities, and solutions for large businesses are expensive and too complicated to manage without a dedicated IT security department.
In addition, the challenge of just maintaining cash flow after the prolonged pandemic continues to haunt SMEs, putting the possibility of a cybersecurity budget on the back burner.
PROTECTION TIPS
To avoid falling victim to web attacks and Trojan password stealing, Kaspersky suggests that small and medium businesses follow these tips:
When it comes to granting access to resources or services, follow the “least privilege” principle. That is, an employee must have the minimum set of access rights — enough only to perform their tasks.
Know exactly where your important information is stored, and who has access to it. From this, develop guidelines when hiring new employees, including clearly defining which accounts are needed for each employee, and which ones should be limited only to certain roles.
Mature corporate cybersecurity culture helps to prevent many cyberthreats. You can, for example, start by creating a cybersecurity manual for employees so that everyone is on the same page.
All passwords must be stored in a secure password manager. It will help your employees not to forget or lose them and also to minimise the chance that an outsider will get access to your accounts. Also, use two-factor authentication wherever possible.
Advise your employees to lock their computers when they walk away from the desk. They should keep in mind that an office can be visited by all kinds of third parties, including couriers, clients, subcontractors or job seekers.
Consider installing antivirus software in order to protect devices from viruses, Trojans and other malicious programs.
Source: https://www.bangkokpost.com/business/2428015/password-stealers-eye-small-businesses