Digital security for the self‑employed: Staying safe without an IT team to help

Approximately one in seven people in Europe and the United States are self-employed, often realizing their dream to be in charge of their own destiny and having more freedom and control over their careers. But with nominally more freedom to shape the trajectory of their future comes extra jeopardy. This often means little or no sick pay and holiday/parental leave and in the IT realm a lack of support of an IT department, something most salaried workers take for granted.

This is particularly acute when it comes to cyber-risk that sole traders or proprietors are facing. If you run your own business, you will be on the radar of threat actors taking aim at your funds, sensitive client information and potentially even your intellectual property. Understanding where the risks are and how to build resilience are key. No sole trader wants to be spending their time dealing with the fallout of a breach, rather than building up their business.

What’s at stake?

The bottom line is that cybercriminals want to make money. And in general, more money can be extorted and stolen from businesses – however small – than individuals. But threat actors are also largely opportunistic. That means they go after the low-hanging fruit – those online accounts that aren’t properly protected, devices that have no security software installed, or PCs that aren’t running the latest operating system, browser and other software versions.

There is little publicly available data on the volume of breaches impacting sole traders. However, it stands to reason that with fewer resources and little or no in-house IT support, they’ll be more exposed to cyber-threats. Consider how the following could affect your business:

• A ransomware attack that locks you out of your business files, including any synced cloud storage.
• An attack where threat actors steal and threaten to leak your most sensitive files, and/or sell them on the dark web. This could include highly regulated personally identifiable information (PII).
• Account takeover attacks via password theft or “brute force” techniques. The hijacked business account could be used in follow-on phishing attacks on clients or even business email compromise (BEC).
• Malware designed to harvest logins to your online corporate bank account in an attempt to drain it of funds.