Q&A with cyber crime expert Tim Francis

May 3, 2013

Timothy C. Francis is Second Vice President for Travelers Bond & Financial Products in Hartford, CT. Francis leads Travelers’ Business Insurance Management and Professional Liability initiatives and serves as Enterprise lead for Cyber Insurance. Reuters spoke with him about what small businesses need to know about cyber crime. 

Small business owners hear a lot about the dangers of cyber crime and how they should fear it, but what exactly should they be afraid of? What are some examples of how small businesses can be affected by cyber crime?


Data breaches can have serious consequences for the person whose data is breached, as well as the company that collects and holds that data. Nearly all 50 states have laws governing notification if/when a customer’s data is breached, and notification can be costly. Actual costs will vary depending on how many records are involved, but generally speaking it costs about $200 total per record. This total amount combines the actual cost of investigating and alleviating the situation, potential liability and potential loss of future business to competitors.
Why are small businesses often more likely to be victimized than larger businesses? Is it simply a lack of resources devoted to cyber security?

A small business’s lack of resources is certainly part of the problem. While a large corporation may be able to invest heavily in sophisticated security strategies, with 25-person IT teams to ensure that every office computer is protected, small businesses simply do not have the money or the manpower. This unfortunately leaves a small business not only vulnerable to an attack, but also allows crimes to continue unchecked until they’re detected or exposed – at which time the losses can already be significant.


Verizon and Symantec have both recently released reports detailing findings about cyber security and small business. What are some of the main points that small businesses should be aware of?

Small business should be aware not only of the increasing pervasiveness of cybercrime, but also the most common types of cyber attacks that are taking place. For example, cybersecurity firm Symantec recently released a study noting that half of all targeted attacks in 2012 hit companies with fewer than 2,500 employees, and overall, targeted cyber attacks jumped 42 percent in 2012. Of that 42 percent, nearly one-third (31 percent) were aimed at businesses with fewer than 250 people, up from 18 percent the prior year.

In terms of attack methods, Verizon’s 2013 Data Breach Investigations Report (DBIR) report revealed that hacking was the number one way breaches occurred and was a factor in 52 percent of data breaches. Common network intrusion methods included: weak or stolen credentials, such as a user name/password; malware use, such as malicious software, script or code; physical attacks, such as ATM skimming; and social tactics, such as phishing.

What kind of small businesses are especially vulnerable?


It’s important to note, however, that it’s not just the online businesses or brick-and-mortar stores that face threats to cyber attacks – any small business with a credit card machine, computer or tablet device is at risk. For example, each customer’s swipe of a credit card in a store provides data that is attractive to people who want to commit identity fraud.

The Verizon report breaks down the attackers into three categories — activists, criminals and spies. Can you elaborate on these groups and their motives?

For activists, their aim is to maximize disruption and embarrass victims. The methods used are quite basic and are more opportunistic in that they are not targeted at a specific individual or company.

For criminals, their actions are motivated by financial gain. They are more sophisticated and calculated in how they select targets, often using more complex hacking techniques than activists.


What are some basic things small businesses can do to avoid being attacked?



Social media sites like Twitter and Facebook have been great tools for small businesses to help in marketing etc. Are they also creating openings for cyber criminals to attack companies?


If, for example, a cyber criminal gains access to a small business’s Twitter handle or Facebook account, the business is at risk of dealing with reputational issues by customers. As we have seen with the AP’s most recent Twitter hack (an “activist” method), the effect of a cyber attack can create a visceral negative reaction among the public, so it’s important to have quick action plans in place to deal with an attack if/when it occurs.

Cyber crime isn’t going away. What are the areas you see that are of increased concern? Is mobile a growing exposure?


In addition to business apps, people almost always add personal apps to their devices. In a world filled with this type of mobile technology, it is more important than ever that small businesses manage associated risks by making sure their employees’ devices have safeguards, such as password protection and tracking capabilities, so they can be located if they’re lost or stolen. It is also important to monitor whether the apps being downloaded on their mobile devices are malware and virus free.




One comment


Great points made above regarding the data of others.



Your choices:

1) Beg your banker for your money back
2) Sue your banker for your money back
3) Get your money back from CDIA

Posted by MScholl | Report as abusive