Small Business Wake-Up Call

We’d been meaning to post this for a while now. Our primary business model is contractual by nature. We operate as a virtual employee for our partners. We do the occasional limited-scope break/fix work on the side, but our partner network always gets priority and our full resources. When onboarding new clients, one of the things we like to do is perform a security audit. And this is why:

One day, a prospective client, whose business existed in the custom flooring industry, called to report finding their accounting workstation locked with a notice that someone was currently logged in via Remote Desktop. Their accountant worked remotely most of the week, and this was normally not an unusual sight. What prompted the phone call was the fact that the accountant happened to be standing in the office at this time.

Below is a photograph of the Users with access to the accounting workstation. Besides the Administrator and Guest accounts, which were disabled, there was only one User account which was valid. The rest were created by an intruder (or intruders) to enable unadulterated access to QuickBooks and company files. This was bad. Not only was it bad, it was also too late.

The rogue accounts were added silently, using exploits predictably derived from having no IT department and no security policies and procedures in place. Simply allowing the workstation to be used both for work and for general Internet browsing by other employees led to the eventual total compromise of the system. Books, banking information, employee and customer personal information… all captured to be resold on the Dark Web.

Well, we figured out how it happened and how to stop it from continuing. But why did this happen? The management believed their business was “too small” to have to worry about Cybersecurity. My friends and fellow small business owners of the Gulf Coast, this used to be the case but times began changing several years ago. Yes, it’s still fairly unlikely this could happen to your business tomorrow, but the probability factor is quickly growing every year. This is the new criminal underworld. Eventually, your number may come up, regardless of what industry you serve. If you use Internet-connected technology in any form, the reality is you have a 24/7 target on your back.

We understand that the benefits of managed IT and Cybersecurity are largely invisible. It can seem like the money paid out isn’t justifiable as there’s no obvious manifested product. Let us assure you, while the short-term benefits may not be something that are readily seen, the long-term lack of these pillars of modern business are easily observed when things finally go sideways. Some of the social and legal consequences of being discovered as the reason why the sensitive information of your vendors, employees, or customers have been compromised and publicized can be enough to death-stroke a small business. Whether it comes in the form of a lawsuit ruling you can’t afford or a smear campaign on social media you aren’t able to ride out, the end result can be devastating at the very least.

While the expertise that Cyclone 365 offers isn’t free, as expertise never is, we are more than willing to work something out with the small and micro-businesses of the South-East. We want to see everyone’s businesses locked down, safe, and able to continue to innovate and evolve.

Click to Call or Email us today to schedule a meeting to discuss your company’s Cybersecurity needs.