A woman in Arkansas ran a business making puppets for traveling Christian circuses. While that might seem like a tiny business in a pretty niche market, that didn’t stop her from being targeted by cyber criminals to the tune of $15,000.
Eventually, after both the police in her the hometown and the FBI said they couldn’t do anything to help her, the woman tracked down the criminal herself.
He was a 12-year-old boy in Alaska who had raked in more than $100,000 through hacking.
That story was told by Brian Dennis, director of the Cyber Security Center for Small Business at the University of Wisconsin-Whitewater, during Thursday’s Lunch and Learn sponsored by the Fort Atkinson Area Chamber of Commerce and held at Fort HealthCare.
The goal, Dennis, of Fort Atkinson, said, isn’t to put small business owners in a panic about their lack of protection. It’s to let them know it can happen to everyone and they need to be prepared if — and when — it does.
“It’s a big, scary problem,” Dennis said. “But our goal isn’t to scare the crap out of everybody.”
Ninety percent of data breaches will affect small businesses, according to Dennis, and that means it can and will happen to almost every business out there. The important thing is being prepared.
“If you have a plan for a fire, if you have a plan for a flood, what are you doing to prevent a cybersecurity breach?” said Dennis, head of the first-ever agency of its kind nationwide.
But, Dennis said, it doesn’t take a lot for a business to be protected. There are a lot of steps a business can take on its own, for free, that will keep it safe. Eventually, though, it’s important to call in professionals and spend some cash on defending the data.
Dennis suggested that a business spend 1 percent of its total revenues on cybersecurity. He said that can be through anti-virus software, firewalls and even cyber-breach insurance.
Even though he said it doesn’t take much, good cybersecurity policies need to have been in place yesterday, and if they aren’t in place now, they should be as soon as possible, Dennis said.
“I’m the guy ringing a bell saying ‘the end is near,’” Dennis said. “If we aren’t putting cybersecurity into budgets, we’re going to have a huge problem.
Dennis said the average cybercriminal — not foreign actors such as Iran or North Korea — can make more than $500,000 a year. This isn’t because they’re smarter than anyone, but because it’s become so incredibly easy to perpetrate these attacks.
It’s so easy because the technology gets more and more advanced and everything with an internet connection can be a target.
“We’ve got to start thinking of our data as a resource,” Dennis said. “This is at an epidemic level and we’re not talking about it.”
But actions such as frequently changing passwords, not using “password” as a password, training employees not to click on suspicious emails and backing up data can all help.
“Passwords are like underwear,” Dennis said, quoting tech blog founder Chris Pirillo. “You don’t let people see it, you should change it often and you shouldn’t share it with strangers.”
The cybersecurity center at UW-Whitewater is part of a national program that is aiming to get all businesses protected. Through lectures such as the Lunch and Learn, building best practice guidelines and assisting businesses with the development of their policies, Dennis said, the effort can get people better protected.
He said the program can get a business started down the right path and then send it to experts nearby to implement the necessary protections.
“You should find a local professional who can help you write a cybersecurity policy,” Dennis said.
From large cities such as Atlanta and Baltimore to the woman in Arkansas with her puppets, targets for cyber-crime are everywhere. Dennis said he needs to get people thinking and talking about the problem.
“Lack of awareness is huge; people don’t know what to do,” Dennis said. “Everyone thinks its too expensive and no one wants to talk about it. But this is an issue we’re all facing.”
Dennis will be speaking again at the 2019 Wisconsin Cybersecurity Summit Monday, Sept. 23, in Madison.