Bob Hill got a call Tuesday night: An employee for one of his clients, a small business in Swanzey, clicked on a suspicious link in an email, and was concerned a computer might be infected with malware.
So Hill, owner of the Marlborough-based Stone Pond Technology LLC, told his client to unplug the computer. The next morning, Hill went to the customer’s office to restore the system through a data backup, even though the chances were slim the computer was actually infected, he said.
“But I’m not going to take that chance,” Hill said. “... Email is the primary way that malware is distributed, including ransomware. And backups are critical, so you can recover.”
Hill’s company, a one-man operation that works with about 50 small businesses in the Monadnock Region, provides a variety of information-technology services, including cybersecurity work. That portion of his business represents only about 15 percent of Hill’s work, but with the rise of international headlines about ransomware and other cyber attacks — often costing companies millions and snarling supply chains and infrastructure — Hill said his local clients are increasingly focused on cybersecurity, too.
“I’d say I’m spending a lot more time researching it, educating myself on it, because it’s ever-changing, and it’s what’s changing fastest now,” he said. “... It’s real, it’s growing, and it’s good that people are aware of it. I don’t think it’s being hyped.”
Other local IT companies are seeing a similar pattern. Before the COVID-19 pandemic, Scott Vickery, the director of professional services for SymQuest, said cybersecurity work accounted for about 5 to 10 percent of business. Today, that figure is closer to 25 or 30 percent, said Vickery, who works out of the Keene office for SymQuest, which is based in Burlington, Vt. and has locations throughout northern New England.
“It’s definitely increasing. We have a lot of projects focused on security right now,” said Vickery, whose company works with about 400 small-to-medium sized businesses. “... One hundred percent of businesses should be concerned about this. Everybody should be concerned about it, and very few businesses really have what is needed to protect them.”
The most important steps businesses can take to protect themselves from online threats, Vickery said, include implementing a strong password policy and multi-factor authentication. This latter method requires users to complete a second step to verify their identity after inputting their password for an application, typically by providing a code sent by text message or given via an automated phone call.
These preventative measures are part of a larger cybersecurity strategy: education.
“The human is the weakest link in the chain,” said Steven Ryder, president of Swanzey-based True North Networks. “The best way to fix that is security-awareness training.”
Companies like True North Networks — which works with about 180 businesses nationwide, including at least a dozen locally — provide a variety of cybersecurity training, including sending phony emails to clients’ employees and tracking how many people click on suspicious links. From there, Ryder said, IT companies can provide further instruction on how to detect and avoid potentially malicious messages.
And while companies like True North Networks can help small businesses with cybersecurity issues, Ryder said he encourages all businesses to do their homework before signing up for IT services through an outside provider, which themselves are vulnerable to cyber attacks. For instance, Miami-based Kaseya, which provides IT software to companies around the world, fell victim to a ransomware attack earlier this year, exposing many clients to potential cyber threats (the exact scale of the attack remains unknown, according to The Associated Press).
“So what I warn companies, when you’re trying to decide on a managed service provider — whether me or somebody else — you’ve got to do your due diligence,” Ryder said.
True North Networks, Ryder said, takes all of the same security measures it advises for clients. Additionally, the company undergoes an annual assessment by a third-party firm to ensure True North Networks is doing everything possible to protect itself and its clients.
And just like an IT company can suffer a cyber attack, Vickery said SymQuest has seen organizations of all sizes fall victim to malware, ranging from small town offices to legal and accounting firms and manufacturing facilities. And while ransomware attacks at big, global companies make headlines more frequently, Hill said local companies should be just as concerned about cybersecurity.
“It’s just as much an issue [locally] as it is anywhere,” Hill said. “The big players, the top level criminals, do target big companies, and they spend a lot of time researching and they make a big project out of attacking a large company.
“... But the tools that they use are freely available, and lots of very smart people are using them to attack everybody. But it does take work and resources, and the harder you can make it for them, the safer you become.”
Gloss