Hackers know a prime target when they spot one. Unfortunately, small-to-midsize businesses (SMBs) are often those prime targets. A lot of small business owners like to think that malicious attackers don’t have anything to gain by going after “the little guy,” or that they don’t have much to lose.

That’s simply not the case. Sixty-one percent of SMBs have been hit by cyber attacks, and the average cost of those breaches has exceeded $1,000,000. Here are some of the easy ways that hackers barge their way into small business networks.

Malware

Malware is malicious software designed to infiltrate computer systems and extract any important information it might find. It comes in several different forms, including viruses, spyware, Trojans, rootkits, and worms.

Without the right protection plans in place, malware can run rampant on devices, collecting all kinds of data without the user even knowing. And those protection plans have to be backed by a security team that understands the fast-paced world of malware – unfortunately, in the first quarter of 2017, a new malware specimen emerged every 4.2 seconds.

Phishing

A phishing scam occurs when cyber attackers send fraudulent emails pretending to be from a trusted source, but lead people to inadvertently deliver personal or professional information straight to a hacker via a malicious website link.

A lot of people think they’re too smart to get caught up in a phishing scam. By now, for instance, most people know that a Nigerian prince doesn’t really want to share his fortune. But hackers are constantly developing targeted, sophisticated emails that appear official and secure. For example, security experts are currently worried about a phishing attack where victims receive an email that looks like one sent from FedEx. The email instructs the recipient to click on a link that claims to help them manage a package delivery, but instead, clicking on the link gives a hacker access to their device’s system and information.

Ransomware

Like the name implies, ransomware attackers demand a payment in order to stop their attack, making this one of the most frustrating and devastating potential breaches. During a ransomware attack, hackers spread malicious software throughout a device or an entire system. The software shuts down those devices or systems until a payment has been made. In addition to deciding whether or not to fork over money to the people attacking them, SMBs also have to spend money bolstering their security systems and making up for the lost productivity.

One of those most wide-reaching ransomware attacks was the WannaCry worm of 2017, which hit more than 230,000 computers across the globe that were running outdated or vulnerable systems. The attackers demanded $300 in bitcoin from their victims, threatening to delete important files if the ransom wasn’t paid. Most didn’t pay the fee, but they still had to wait days for security fixes to be issued. The attack crippled England’s National Health System, shut down Australian speed cameras, forced a Honda factory in Japan to shut down, and all in all is estimated to have cost victims in the billions.

Spoofing

Spoofing attacks occur when the hacker sends out emails pretending they’re someone they’re not. For instance, attackers send out an email that appears to be from the company’s CEO or HR department requesting info on private company data. An employee would then send that info along to who they believe is their superior, but is actually a cyber attacker.

In a case like that, spoofing emails can harm a SMB directly. But they can also cause devastation via indirect ways, as well. For instance, German banking chain Deutsche Bank recently had to pay a $30 million fine after two of their former traders launched a successful spoofing attack that manipulated the prices of precious metals futures on the commodities market. A banking giant can afford that fee, but small businesses might not be able to afford the losses that could come from believing fraudulent, incorrect information about the markets.

Rootkit

Rootkit is sneaky and clandestine software that allows an outside user to take control of a device without the owner’s knowledge. Like some other cyber attacks, that control gives a hacker access to the device’s secure network and files. But a rootkit is extra dangerous because, in addition to accessing those files, the hacker also has complete control of the device. That means they can alter network configurations, falsify documents, override security mechanisms, and infect the device with more malware. The attacker can also spy on the device’s owner, for example by recording every websites they visit and provided credential information. Unfortunately, rootkits are very difficult to detect and almost always require the work of professionals to remove.

One of the most threatening rootkits is LoJax. Security experts worry that they have only seen the beginning of this rootkit, which is currently spreading. Right now, attackers are using it to modify security systems and then infect devices with even more malware. Since the attackers maintain control of the device, they can be sure that the malicious software is executed, all without detection. Researchers fear that attackers will develop even more sophisticated LoJax breaches in the months and years to come.

Ensuring Total Security

So what can small businesses do? For starters: get a VPN. VPN stands for Virtual Private Network, and it’s a solution that many businesses use to help minimize the chance of a cyber attack. The network is encrypted and often requires multiple authentication methods, making it easier for remote workers and employees in multiple branches to securely access the applications and systems they need to do their jobs.

It’s a great first layer of protection. But in order to ensure total security, small businesses need a security plan in place that will defend that VPN as well as make sure that every device contains several layers of protection. HP provides exactly that. The company knows that each PC decision is a security decision, and it equips each of your business’s devices with the tools they need to stop vulnerabilities from every angle.

Programs like HP Sure Start, HP Sure Recover, and HP Sure Click stop malicious software from spreading to a business’s devices and network, managing all potential threats so a small business can focus on building its business. In the case of an attack like LoJax, HP Sure Start would be able to stay one step ahead of the game by detecting the attack before it can happen. LoJax gets in by attaching itself to the BIOS, which is the first million lines of code that a device runs before being turned on. HP Sure Start recognizes rootkits like LoJax at the BIOS level, and then completely replaces the BIOS to ensure that LoJax doesn’t have a ride into the system.

The danger is real, but hope isn’t lost. With the right understanding of their own vulnerabilities and an HP cyber security plan in place, small business owners can make enterprise-level security decisions that will turn them from a hacker’s prime target to a hacker’s dead end.