7 Reasons Your Employees Fail at Cybersecurity (And What You Can Do About It)

<a href="https://www.lastpass.com/contact-sales" target="_blank" rel="noopener"><img class="alignnone wp-image-160803 size-full" src="https://cdn.lputil.com/wp-content/uploads/sites/20/2023/06/Screen-[..]

A Cybersecurity Policy Template for Your SMB

<a href="https://www.lastpass.com/contact-sales" target="_blank" rel="noopener"><img class="alignnone wp-image-160796 size-full" src="https://cdn.lputil.com/wp-content/uploads/sites/20/2023/06/Screen-[..]

SMB Week may be over, but LastPass is always here for your small business cybersecurity challenges. Below is a round-up of all we’ve been doing throughout the week to ensure you’re one step ahead of cyber risk. 

This guide provides you with key educational tools that we've shared, including our SMB Week webinar, educational content, and support resources to learn from and share with your team members. 
<h3 aria-level="3">Webinar Recording</h3>
How a Small Business CEO Built a Cybersecurity Presence
Hear from Gary Salman, CEO Black Talon Security, Cameron Cumming, Director, Nueva Solutions, and Amy Appleyard, Chief Revenue Officer, LastPass about how SMBs can realistically reduce their risk while strengthening their security posture. 
Access a recorded version of the webinar <a href="https://lp.goto.com/Lastpass_Webinar_How_a_Small_Business_CEO_Built_a_Cybersecurity_Presence_LP.html?lsource=Website&amp;source=blog">here</a>.

<h3 aria-level="3">Educational Content</h3>
<a href="https://blog.lastpass.com/2023/04/what-is-the-roi-of-effective-cybersecurity/">What Is the ROI of Effective Cybersecurity?</a>

Learn how you can alleviate cybersecurity challenges and costs for your business each year.  

<a href="https://blog.lastpass.com/2023/04/how-to-implement-tight-cybersecurity-at-your-smb/">How to Implement Tight Cybersecurity at Your SMB</a>

Learn how the right cyber technology can help SMBs tighten their security and, in turn, protect the business’s long-term financial health.  

<a href="https://blog.lastpass.com/2023/04/your-checklist-for-implementing-strong-cybersecurity-strategy-at-your-smb/">Your Checklist for Implementing Strong Cybersecurity Strategy at Your SMB</a>

Use this checklist to implement a strong cybersecurity strategy at your SMB.
<h3 aria-level="3">How to Get Help</h3>
Visit the <a href="https://support.lastpass.com/home">LastPass Support Portal</a> to get answers and direct help related to LastPass products.
<h3 aria-level="3">Additional Resources</h3>
<a href="https://www.sba.gov/national-small-business-week">https://www.sba.gov/national-small-business-week</a>

<a href="https://www.cisa.gov/cyber-guidance-small-businesses">https://www.cisa.gov/cyber-guidance-small-businesses</a>

<a href="https://www.sba.gov/business-guide/manage-your-business/strengthen-your-cybersecurity">https://www.sba.gov/business-guide/manage-your-business/strengthen-your-cybersecurity</a>

<a href="https://www.fcc.gov/communications-business-opportunities/cybersecurity-small-businesses">https://www.fcc.gov/communications-business-opportunities/cybersecurity-small-businesses</a>

Ready to get started with LastPass?

<a href="www.lastpass.com/small-business-week" target="_blank" rel="noopener"><img class="alignnone wp-image-158765 size-full" src="https://cdn.lputil.com/wp-content/uploads/sites/20/2018/10/CTA-Button1.png" alt="" width="387" height="80" /></a>

Your LastPass 2023 SMB Week Round-Up Guide 

SMB Week may be over, but LastPass is always here for your small business cybersecurity challenges. Below is a round-up of all we’ve been doing throughout the week to ensure[..]

Are You Prepared for the Most Common Cyber Risks? A Checklist

<a href="https://www.lastpass.com/contact-sales" target="_blank" rel="noopener"><img class="alignnone wp-image-160443" src="https://cdn.lputil.com/wp-content/uploads/sites/20/2023/04/Are-You-Prepared-[..]

Top 4 Cyber Risks You Need to Know

<a href="https://www.lastpass.com/contact-sales" target="_blank" rel="noopener"><img class="alignnone wp-image-160274 size-full" src="https://cdn.lputil.com/wp-content/uploads/sites/20/2023/04/Top-4-C[..]

Drive Success With Strong Cybersecurity - LastPass

<a href="https://www.lastpass.com/small-business-week?utm_source=LinkedIn&amp;utm_medium=paid%20social&amp;utm_campaign=smb%20week" target="_blank" rel="noopener"><img class="alignnone wp-image-160421[..]

Your Checklist for Implementing Strong Cybersecurity Strategy at Your SMB

Doing nothing is costly. $4.24 million, to be exact. And when 85% of breaches involve a human element – that means your employees – protecting your passwords to secure your company’s data is crucial. 

Our LastPass experts walk you through the why and how of small business cyber risks – and what you can do to go from vulnerable to resilient. 

Too much data, too little time? Jerome Ferraro, Product Specialist, explains why SMBs are a hacker’s best friend. 

[video width="1920" height="1080" mp4="https://cdn.lputil.com/wp-content/uploads/sites/20/2022/12/SMB-Targets.mp4"][/video]

Your business is unique. The same should go for your passwords. Lou DeLillo, Solutions Consultant, shows you how to keep them that way.  

[video width="1920" height="1080" mp4="https://cdn.lputil.com/wp-content/uploads/sites/20/2022/12/Unique-Is-Key.mp4"][/video]

Your first steps against cyber risk are understanding why and how bad actors show up at your company’s doorstep. Your first line of defense is a password policy. Let LastPass help protect your data. 

<a href="https://www.lastpass.com/contact-sales" target="_blank" rel="noopener"><img class="alignnone wp-image-158765 size-medium" src="https://cdn.lputil.com/wp-content/uploads/sites/20/2018/10/CTA-Button1-300x62.png" alt="" width="300" height="62" /></a>

Learn From Cybersecurity Leaders: The Impact of Cyber Risks on SMBs

Doing nothing is costly. $4.24 million, to be exact. And when 85% of breaches involve a human element – that means your employees – protecting your passwords to secure your [..]

When most data breaches can be attributed to a human element, is your business taking all the precautions necessary to ensure both your data and bottom line are safe? By taking <a href="https://www.lastpass.com/resources/tools/password-management-roi-calculator" target="_blank" rel="noopener">LastPass’s ROI (return on investment) assessment</a>, you can better understand how your employees’ password behaviors are affecting the security and financial viability of your SMB. 

Let’s dive into what the <a href="https://www.lastpass.com/de/resources/tools/password-management-roi-calculator" target="_blank" rel="noopener">ROI assessment</a> covers to learn more about how you can alleviate cybersecurity challenges and costs for your business each year. 

Assessing your employees and their password behavior

The more passwords there are, the more keys there are to unlock sensitive data that your business depends on. And with the rise in remote work -- 70% of respondents noted they worked wholly or partly remote, according to the <a href="https://www.lastpass.com/resources/ebook/psychology-of-passwords-2022" target="_blank" rel="noopener">Psychology of Passwords</a> – the right tools need to be in place to help employees manage their sensitive business credentials. 

On average, employees manage up to 50 accounts protected by password credentials and must reset their credentials five times per month due to forgetfulness, according to data from LastPass and OnePoll. Taking about 10 minutes per reset, that nets out to 10 hours per year for each employee. 

Based on the size of your organization and how many passwords your employees are managing, our ROI assessment will tabulate the productivity losses you may be experiencing if you’re not using a password management solution across your entire organization. 

Assessing your help desk needs

Password-related challenges can cost your organization money. Forrester Research reports that the average cost of a password-related help desk call is $70 USD. And when 25-40% of help desk calls are due to password problems or resets, password mismanagement can add up. 

But it’s not just a monetary amount you need to worry about. Onboarding and offboarding your employees can be a productivity drain for your help desk – and cut into precious time that could be focused on more serious security incidents.

By looking at the workload of your help desk – how many password-related tickets they’re taking alongside employee onboarding and offboarding procedures -- our <a href="https://www.lastpass.com/de/resources/tools/password-management-roi-calculator" target="_blank" rel="noopener">ROI assessment</a> can paint a picture of just how much time and money you’re losing without a password management solution. 

Securing your organization

What you and your employees do has a direct impact on your business’ bottom line and operational risk. By taking the ROI assessment, you’re one step closer to understanding where your organization sits on the cybersecurity spectrum in terms of time, money, and risk.  

Anyone who manages at least one credential, has access to digital business accounts, or uses a company device, should be empowered to use password management tools. And this applies to your entire organization, not just certain departments. 

A password management tool can help you enforce proper password hygiene and manage user behavior through policies – from anywhere for anyone. Solutions like multi-factor authentication, single sign-on, and dark web monitoring can further reinforce and complement organizational password management. 
<h3>Take the <a href="https://www.lastpass.com/resources/tools/password-management-roi-calculator">ROI assessment</a> now. </h3>

What Is the ROI of Effective Cybersecurity - LastPass

When most data breaches can be attributed to a human element, is your business taking all the precautions necessary to ensure both your data <span data-contrast="n[..]

What Is the ROI of Effective Cybersecurity?

We all know hackers target multinational companies and top enterprises. When those brands publicly disclose a data breach, the impact on millions of people instantly grabs headlines. But we often don't hear about the everyday cyberattacks that devastate smaller companies. In reality, SMBs are just as likely to be cybercrime targets, and the impact can be more significant to the company's daily operations and bottom line. 

An SMB's ability to deter, resolve, and recover from a cyber attack is a product of the steps taken (or not) to implement cybersecurity measures and a well-planned security strategy. The right cyber technology can help SMBs tighten their security and, in turn, protect the business's long-term financial health. 
<h3>Why security matters for SMBs</h3>
A company's size does not determine its likelihood of becoming a target of cybercriminals, so SMBs shouldn't be lulled into a false sense of security when it comes to cybercrime. Nearly half of all cyber breaches (46%) impact businesses with fewer than 1000 employees. In 2021, 61% of SMBs were the target of a cyberattack, and nearly 40% of small businesses reported they lost crucial data due to a cyberattack. In 2020 alone, small businesses experienced a collective $2.8 billion in damages. 

In summary, SMBs are a top cybercrime target, and attacks can be costly. Since 51% of small businesses have no cybersecurity measures, these trends will likely continue.
<h3>Top SMB security weaknesses</h3>
First, SMBs must recognize that they're a target. Leadership must understand the risk of a cyberattack and the potential long-term damage and fully support the necessary steps to strengthen cybersecurity across the organization. And information security needs to have a seat at the leadership table; many SMBs say they take security seriously but fail to implement a top-down approach that builds cybersecurity into every business decision. When decision-makers fail to approach cybersecurity as a financial issue and instead downplay it as "just an IT issue," they expose the company to greater risks.

Everyone at the company - from senior executives to entry-level employees - must understand their role in protecting the business. Routine security training should inform employees of common threats so that they can recognize unusual or suspicious activity. Employees should also know how to report potential issues quickly. Achieving such a high employee cyber awareness and participation level requires a well-planned corporate security program.

SMBs often fail to implement safeguards against the most common threat vectors. While a positive for workforce flexibility, remote work and Bring Your Own Device (BYOD) introduce new threats and risks - especially ransomware attacks - that IT must assess before turning employees loose. 

With fewer resources, overworked employees, and less budget, IT teams at SMBs may fail to keep up with necessary security patches. As a result, bugs and vulnerabilities can be exploited by cybercriminals looking for a foothold in the corporate network and apps.  

Overall, it's common for SMBs to overlook the importance of a cybersecurity strategy and contingency plans for a cyberattack. A successful cyberattack is more likely to occur with no strategy in place. As a result, it will likely take longer to resolve, be more costly to remediate, and ultimately have a greater impact on the company's recovery. 
<h3>Three cybersecurity tools SMBs need </h3>
Though a security strategy is ultimately very individualized to a company's specific needs and risks, there are basic steps every SMB can take to tighten their cybersecurity and better protect against future threats. It's far better to focus resources and budget on a few highly effective tools, especially if an SMB is building (or rebuilding) a security program from the ground up. 

Build an incident response plan.

A <a href="https://blog.lastpass.com/2022/10/how-to-build-an-incident-response-plan-for-your-smb/" target="_blank" rel="noopener">documented step-by-step incident response plan</a> (IRP) will help your company better navigate the stresses and challenges of a cybersecurity incident. Every incident response plan should outline the four key phases - Preparation, Detection and Analysis, Containment and Recovery, and Post-Incident Activity. If decision-makers question why you need an incident response plan, stress the importance of responding quickly and effectively when a security breach occurs. In addition, an IRP helps create a feedback loop in which the team can continue improving its cybersecurity strategy and deal with a data breach's legal and commercial effects. 

Deploy multi-factor authentication.

Multi-factor authentication, or MFA, is a security technology that goes beyond account credentials to add security to logins. Multi-factor authentication requires additional information like a fingerprint scan or a one-time code to prove a user's identity before granting access. MFA can also analyze additional data like an IP address, device ID, or other contextual information to corroborate an identity further. As a result, MFA reduces or eliminates many common cyberattacks while being comparatively easy to deploy and use. For SMBs looking to stretch their dollar for the security benefits gained, <a href="https://blog.lastpass.com/2022/10/the-importance-of-mfa-for-smbs/" target="_blank" rel="noopener">MFA can be a wise investment</a>.

Acquire cyber insurance.

Traditional insurance policies provide a critical safety net, protecting against property damage, accident liability, and disruptions to daily operations. Cyber insurance offers the digital equivalent, providing businesses with the resources and financial support to respond to and recover from cybersecurity incidents. The type of insurance policy can vary depending on the company's size, industry, type of data stored, and risk exposure. To be eligible, companies may be required to <a href="https://blog.lastpass.com/2021/09/cybersecurity-insurance-providers-require-multi-factor-authentication-mfa/" target="_blank" rel="noopener">enable multi-factor authentication for account protection</a>, <a href="https://blog.lastpass.com/2021/05/protect-your-business-from-these-dangerous-data-breach-trends/">improve credential management</a>, and implement more stringent device and network security like firewalls, antivirus, and data backup. Meeting these requirements reduces an SMBs overall cyber risk, with the added perk of potentially <a href="https://blog.lastpass.com/2022/04/infographic-save-on-cyber-insurance-with-lastpass/" target="_blank" rel="noopener">lowering cyber insurance premiums as their overall cyber risk decreases</a>. 

Ready to tighten security at your SMB? Learn how LastPass can help you meet your cybersecurity goals. 

<a href="https://www.lastpass.com/small-business-week?utm_source=LinkedIn&amp;utm_medium=paid%20social&amp;utm_campaign=smb%20week" target="_blank" rel="noopener"><img class="alignnone wp-image-158765 size-full" src="https://cdn.lputil.com/wp-content/uploads/sites/20/2018/10/CTA-Button1.png" alt="" width="387" height="80" /></a>

How to Implement Tight Cybersecurity at Your SMB - LastPass

We all know hackers target multinational companies and top enterprises. When those brands publicly disclose a data breach, the impact on millions of people instantly grabs h[..]

How to Implement Tight Cybersecurity at Your SMB 

Four SMB Cyber Risks You Can't Ignore

<a href="https://www.lastpass.com/contact-sales" target="_blank" rel="noopener"><img class="aligncenter wp-image-160079" src="https://cdn.lputil.com/wp-content/uploads/sites/20/2023/04/Screen-Shot-202[..]

Small and medium-sized businesses may assume cyber attackers spend most of their time going after much bigger fish, but that's not true. Often, malicious actors go after organizations they see as easier targets – that is, businesses that don't have the resources to mount a robust cybersecurity defense. In fact, <a href="https://www.npr.org/2022/08/12/1116936751/what-experts-think-companies-should-do-when-ransomware-strikes" target="_blank" rel="noopener">seventy percent of ransomware attacks</a> in 2021 targeted businesses with fewer than 500 employees. 

Today, particularly as more employees are working from home than ever, nothing is more critical than a strong cybersecurity strategy and its complementary tools. Here's why it's time to ramp up yours and how you can do it on a modest budget.
Overlooking cybersecurity isn't just risky, it's expensive  
If you're concerned about the global economic forecast, you're probably looking for ways to trim your budget instead of adding new line items to it. It's good business sense to perform a careful cost-benefit analysis before approving any new investments, including cybersecurity improvements. As you do, though, also factor in the risk of not investing. Not prioritizing cybersecurity may seem financially advantageous in the short term, but this decision can also be incredibly expensive – to the point of threatening the viability of the business itself – and the bill might come due sooner than you think.

Chances are, your company doesn't have a spare $3 million lying around. Yet cyber attacks cost small and medium businesses <a href="https://www.ibm.com/downloads/cas/OJDVQGRY" target="_blank" rel="noopener">an average of $2.98 million</a> and $164 per breached record. Even companies that carry cyber insurance aren't prepared for an unplanned expenditure of this magnitude – just <a href="https://securityandtechnology.org/wp-content/uploads/2022/08/IST-Blueprint-for-Ransomware-Defense.pdf" target="_blank" rel="noopener">14% of them</a> have policies that cover over $600,000 in costs. What's more, the average claim cost for a small or medium business <a href="https://info.coalitioninc.com/download-2022-cyber-claims-report-mid-year-update.html" target="_blank" rel="noopener">increased by 58%</a> from 2021-2022. That's a staggering amount of financial exposure, and the risk is only increasing by the year. The best way to protect your business is by making strategic, cost-effective cybersecurity investments now.

How to cost-effectively strengthen your cybersecurity 

You can strengthen your current cybersecurity, and you don't need the resources of a large organization to do it. These five tips can help your small business bolster its cybersecurity without breaking the bank. 
<ol>
 	<li> Carry out regular backups</li>
</ol>
Every small business should be completing <a href="https://www.worldbackupday.com/en" target="_blank" rel="noopener">regular backups</a>, regardless of the cybersecurity threats it faces. Without reliable backups, a company is vulnerable to data loss in the event of a failure, an emergency, and – yes – a cyber attack. If you have regular backups in place and frequently test them to make sure they are working correctly, then you'll be in a far less precarious position if a cyber criminal tries to hold your data hostage in a ransomware attack. 

Make sure that, as part of your backup schedule, you have data backups securely stored offline in a location hackers cannot reach (this technique is known as air gapping). Insider threats, though rare, also threaten small businesses. So, confirm that only employees with the proper authorization have digital or physical access to your data backups.
<ol start="2">
 	<li aria-level="5"> Invest in a password manager </li>
</ol>
<a href="https://blog.lastpass.com/2021/05/how-a-business-password-manager-protects-your-smb/" target="_blank" rel="noopener">A password manager protects your business</a> from cyber attacks and the financial damage they cause. It gives your employees a secure vault where they can store all of their passwords, alerts them when one of those passwords is weak or has been compromised, and can even auto-generate a new password to replace it. A password manager also trains your employees in good password hygiene over time, and it provides your IT team better tools for enforcing security policies. These capabilities not only improve your cybersecurity, but they also save your employees time and lighten the load for your IT professionals.
<ol start="3">
 	<li aria-level="5"> Take advantage of MFA</li>
</ol>
By enabling multi-factor authentication (MFA) on as many business accounts, apps, and systems as possible, you can make it much harder for an opportunistic hacker to target your company. When MFA is enabled on an account, anyone attempting to log into that account must provide another form (or factor) of authentication in order to prove their identity. This factor may be a code provided via an authenticator app, email, or SMS. It may even be a biometric form of authentication, such as a fingerprint. 

When a bad actor tries to log in as one of your employees and they encounter an MFA challenge, they won't be able to get in without that additional form of authentication. Even better, your employee will get a heads up that someone's trying to log in as them. This way, they'll have a chance to alert IT that something dodgy is going on, then take quick action to protect their work accounts and crucial business data.
<ol start="4">
 	<li aria-level="5"> Train your employees</li>
</ol>
If your employees don't know how to spot a phishing attack, your business could fall victim to a cyber attack before anyone even knows what has happened. But with regular security awareness training, including for new employees, you can give your employees the knowledge they need to protect themselves, your company, and your customers. 
This is all the more important in today's work-from-anywhere world, where many employees are working from home and may feel a false sense of security in that familiar environment. As new kinds of threats emerge, such as phishing attacks that arrive in social media direct messages or even on Discord servers, be sure to refresh your training accordingly. 

<ol start="5">
 	<li aria-level="5"> Conduct a security audit</li>
</ol>
With a limited budget, you have to make hard decisions about where to invest your limited resources. A security audit will help you understand where your weakest links are, so you can prioritize your spending accordingly. Among other things, your audit should look at where your critical business is stored, whether that's in the cloud or on premises, as well as the security controls that govern who can access it. 
Protect your small business from cyber threats
Once you've taken these five steps, consider building on your achievements. You can create an <a href="https://blog.lastpass.com/2022/10/how-to-build-an-incident-response-plan-for-your-smb/" target="_blank" rel="noopener">incident response plan</a> that determines in advance how you will respond to a cyber attack, for example. <a href="https://blog.lastpass.com/2022/10/understanding-cyber-insurance-for-smbs/" target="_blank" rel="noopener">Cyber insurance</a> may also be worth exploring as a risk management option. 

Whatever best practices you choose to adopt, slow and steady progress is key to protecting your small business from cyber threats. With a commitment to keeping your cybersecurity strategy up to date, you'll have a much better chance of avoiding a costly cyber attack.

Learn how LastPass can help you tackle and build your SMB’s cybersecurity strategy. 

<a href="https://www.lastpass.com/contact-sales" target="_blank" rel="noopener"><img class="alignnone wp-image-158765 size-medium" src="https://cdn.lputil.com/wp-content/uploads/sites/20/2018/10/CTA-Button1-300x62.png" alt="" width="300" height="62" /></a>

5 Ways to Build Your SMB Cybersecurity Strategy

Small and medium-sized businesses may assume cyber attackers spend most of their time going after much bigger fish, but that's not true. Often, malicious actors go after org[..]

How to Build an Incident Response Plan for Your SMB

Does your business have a cybersecurity incident response plan? If not, you're not alone. 

IT teams may be stretched thin, especially at S[..]

Blog

Blog

Recent

Industry News

LastPass For Admins

LastPass Labs

Product Updates

Tips And Tricks

Smb