Much is made, and rightly so, of major hacks and denial of service attacks on large companies. But far less column inches and minutes of TV time are devoted to covering the often crippling cyber crimes experienced by small to medium sized companies (SMEs).

As Lorraine Mills, Managing Director of Blue Rock, a subsidiary of the NVT Group, points out, many SMEs have neither the time nor the resources to protect themselves from hackers. Some owner directors probably feel that they are “too small” to attract the hackers, and others may take the view that the bare minimum by way of protection is all that can be justified.

The Herald:

Mills, who has deep experience in the cyber security world, argues that doing the bare minimum – or less – is asking for trouble. “The analogy I like to use is household burglaries. Everyone knows that a determined burglar can generally force an entry even if the house has burglar alarms and is securely locked. But if you take a street with a row of houses on each side, with one side having burglar alarms and houses across the street having none, which do you think the burglar will choose?”

She points out that while it is an accepted truism in the cyber security industry that a group of experienced hackers will succeed in breaching any organisation they target, deterring casual attacks by having competent cyber security measures in place really is important. This is even more true since companies could face action from either or both the regulators and private litigation if it can be shown that they did not take reasonable measures to protect their IT systems and their data.

Where many established SMEs fall down, Mills warns, is by continuing to base their IT systems on older versions of Windows that Microsoft has stopped supporting. By definition, these systems are no longer receiving patches and updates from Microsoft and all the vulnerabilities in these operating systems are well known by the hacking community.

The Herald:

These vulnerabilities are known as “exploits” and they are often serious enough weaknesses to allow a hacker to take control of the user organisation’s servers. Once the hacker has administrator-level control of the system, there is no limit to what they can do. They can download malicious software such as a keystroke tracker that will send any keystrokes that look like a password direct to a server specified by the hacker. At their leisure, the hackers can then go to the company’s bank account, log on as a legitimate user, and help themselves to whatever cash there might be in the user’s bank account – a terrifying prospect for any owner director.

Breaking into an unpatched operating system is a doddle for even a teenage “newbie” hacker. There are tools aplenty on the internet to help even a moderately IT-literate 17-year-old hack into unprotected companies.

“Even when SMEs have their IT systems running on the latest Microsoft platform, Windows 10, when I visit them to do an IT audit, I often find that they are several weeks behind with their downloading and implementing of patches,” Mills said. Microsoft patches very frequently carry warning narratives telling Windows users that the vulnerabilities the particular patch is designed to counter, will allow a malicious third party to take control of the system.

Passwords, too, are a huge source of weakness, not just in IT systems, but also as regards the many devices that users bring into companies, including smart phones and tablets. One of the things Mills does for companies is to check the strength of the passwords in use in the organisation.

“When I go into a 100-user company, for example, I often say, give me four days and you will be astonished at the number of passwords I can crack,” she comments. Her success rate is typically around an astonishing 64 to 70 per cent.

“People struggle to remember passwords, so they always choose some meaningful string of characters and numbers, which makes them very easy to crack with the right tools,” she says.

Mills points out that the hacking community has a database that contains over a trillion passwords. So if a user has chosen any combination that is on that database, the password will be cracked in seconds flat.

“What is particularly worrying for SME owners is that it is not only their own IT systems that need to be patched each and every time a new patch is issued, the devices that their staff bring in are also sources of vulnerability. If a user has put off updating their mobile phone operating system, they’ve probably left an exploit unpatched, which means a hacker could breach the company IT systems when the mobile phone is linked to the company network,” she warns.

Blue Rock will carry out either half day or one-day initial IT-audits for companies for a very modest fee. This will give any SME a very reasonable idea of just how vulnerable their IT infrastructure is, together with advice on what they need to do to strengthen their cyber security.