Not every cyber attack comes at your business directly. Criminals now often break into a company that lots of businesses rely on, like a software maker, a service provider or a supplier, and use that trust to reach its customers. These are called supply chain attacks, and small businesses are very much in the firing line.

What it looks like

Breaking into one company that thousands of others depend on is less work than attacking those thousands one at a time. In practice it can look like:

• A harmful update delivered through software you already use and trust

• A supplier's email account taken over and used to send you a real-looking invoice with new bank details

• A service provider whose remote access to its clients' computers is used to get into yours

• An online service you rely on going down or being breached, taking your data with it

These attacks are hard to spot because they come through a channel you already trust. The supplier is real, the update is real, and the email turns up in a conversation you're already having.

Why small businesses get caught

It's easy to think this only happens to big companies. Often the reverse is true. Small businesses use the same popular software as everyone else, so they get caught up in the same incidents, with fewer people to notice and fix the problem. Small businesses are suppliers too. Criminals sometimes break into a small business just to get to its larger customers.

Steps that limit the harm

You can't control how well your suppliers protect themselves. You can control how much harm a breach at their end can do to you.

• Keep a list of the suppliers who can get into your systems or data, and remove access nobody needs any more.

• Ask before you sign up. Where will our data be kept? Do you use the second login step, called MFA? What happens if you're breached?

• Check any change of bank details by phone, on a number you already have. Fake invoices sent from a hacked supplier's email are one of the most common and costly scams hitting Australian businesses.

• Give suppliers and connected apps access only to what they need for their job.

• Keep your own backup, separate from the service. If a provider fails, your data shouldn't go with it.

• Install updates promptly. They fix the weak spots criminals look for.

Your IT provider is a supplier too

Your IT provider is part of your supply chain, usually with more access than anyone else, so ask them the same questions. Elevated IT looks after security for businesses across Lake Macquarie, Newcastle and the Central Coast, and we're happy to explain exactly how we protect our own access to your systems. Call us on 1800 620 449.