Keeping startups safe from cyber threats

By Tushar Haralkar

There is no doubt that cyberattacks are on the rise, and they are as much, if not more, threatening for startups as they are for large corporations. Now, India is considered a startup hub, with the third largest number of unicorns after the US and China, and over $42 billion was raised in 2021 by Indian startups. In addition to the increasing number of startups and unicorns, cyberattacks on the startup ecosystem have also increased. In the last couple of years, news about several attacks, with millions of stolen data records, is in the public domain. And there is a high probability that several attacks remain unreported.

In addition to the fact that most startups acquire customers rapidly, using mostly online means, there are several reasons why hackers prefer startups. Startups are typically more concerned with acquiring customers and growing their business than protecting it, which means they have a treasure trove of customer data online.

As a consequence, smaller enterprises are less equipped to protect themselves against cyberattacks, especially as attackers continue to become more sophisticated. They are also likely to have fewer resources dedicated to fighting cyberattacks. Due to the fact that these startups are born on the cloud, they are also reliant on their cloud service providers for their security needs. The question they need to ask themselves is: Is this enough?

According to IBM Security X-Force Threat Intelligence Index 2022, India is among the top-three most targeted countries in Asia, and Ransomware was the dominant attack type against organisations in India. In today’s ever-changing cyber threat landscape, where startups and entrepreneurs are lucrative targets for cybercriminals, it is imperative for startups to remain vigilant, even after implementing security best practices.

Here are 10 tips for startups to protect themselves from cyber threats.

1. Educate your users: The first step to endpoint security is educating the users of the endpoints on your network and data. Provide security and compliance training to your users and confirm that they complete it successfully on a regular basis. This is a critical but partial solution. The IT or security staff should also send out alerts to users whenever a questionable email is circulated, along with instructions on how to delete or quarantine it properly.

2. Asset discovery – Find and track all devices that connect to your network: IT teams should start by conducting an inventory audit of all devices connected to their network resources. BYOD (bring your own device) is becoming increasingly common as more employees work remotely or on the go. Before doing anything else, it is important to have complete visibility of all endpoint devices that are connected to corporate applications and data. After all, you cannot secure what you don’t know exists.