Too many SME’s continue to take risks when it comes to cybersecurity. With over half of all cyber attacks now targeting smaller organisations, the risks are multiple. So what are the basics of an effective cybersecurity defence?
The well-used analogy of securing your home is often used to illustrate strategies for protecting a business. For example, installing an alarm system, locking doors and windows, and keeping lights on when you’re not at home make your house less appealing to a criminal than a neighbour’s unsecured, dark house without a functioning alarm system.
You wouldn’t think of not protecting your home, so why do so many businesses neglect to put in place proper systems to safeguard their infrastructure and their data? Data attacks and cybercriminals can strike from anywhere, regardless of location, and if your defences and systems are not secure, an existential level of threat can exist for your business. Not only can your systems be crippled, your data hacked and stolen, but your reputation can also be damaged beyond repair.
Cybercriminals continually probe email platforms, user accounts, firewalls, business applications, and even home user networks, seeking vulnerabilities to exploit. Businesses with robust cybersecurity measures and strategies are less exposed to risks compared to those that choose to roll the dice and hope that “it will never happen to me.”
Remember, it’s not just your systems that are at risk, but also the data that customers have entrusted you with.
The Reality of Cybersecurity for SMEs
Cybercrime now ranks as one of the highest-frequency crimes worldwide, contributing to over $1 trillion in global cybercrime in the past year alone, with Cybersecurity Ventures predicting that Cybercrime damages will reach $10 trillion globally by 2025. Data breaches, ransomware attacks, and malicious links are common threats every business, regardless of size, must defend against.
Smaller businesses often believe they are not desirable targets, yet they forget that they have the most to lose, from reputation to financial stability. A 2021 report by the tech consultancy StrongDM found the following worrying trends in SME’s:
- 46% of all cyber breaches impact businesses with fewer than 1,000 employees.
- 61% of SME’s were the target of a Cyberattack in 2021.
- At 18%, malware is the most common type of cyberattack aimed at small businesses.
- 82% of ransomware attacks in 2021 were against companies with fewer than 1,000 employees.
- 37% of companies hit by ransomware had fewer than 100 employees.
- Small businesses receive the highest rate of targeted malicious emails at one in 323.
- Employees of small businesses experience 350% more social engineering attacks than those at larger enterprises.
- 87% of small businesses have customer data that could be compromised in an attack.
- 27% of small businesses with no cybersecurity protections at all collect customers’ credit card information.
Obviously, smaller businesses lack the resources that large multinationals have, such as dedicated large-scale IT security teams and significant budgets. However, the basics of good cybersecurity apply equally to small businesses.
Rising Prevalence
Technology has become integral to our lives and businesses, with hosted applications, online sales, and flexible working arrangements expanding the attack surface for cybercriminals. The pandemic further changed our working habits, with hybrid and flexible working becoming the norm, offering more opportunities for cyber attacks.
The weakest link in cybersecurity? Unfortunately, it is people. Despite having all the tools and systems in place, if staff are not empowered and educated, they pose a risk, accounting for, according to reports, up to 75% of cybersecurity threats.
The Basics of Cyber Defence
A cyber plan starts with three core areas: people, processes, and technology, aligned with a cybersecurity standard.
Focus on the biggest vulnerabilities first, but don’t rely solely on technology. Many businesses have firewalls that are not properly secured or configured. Technology must be used correctly to be effective. An expensive system can prove either ineffective or become a liability, if not deployed correctly.
Train Until you Don’t get it Wrong
It is estimated that 75% of IT security breaches begin with the human factor, often unnoticed until it’s too late. For example, an email account compromise can give cybercriminals access to an account, allowing them to subtly monitor and exploit it over days or weeks.
Employees must undergo continual training to stay aware of cybercrime realities, its impacts on the business and practical examples of how it can be counteracted. Empowered and knowledgeable staff are your best line of defence when it comes to cybersecurity,
Using the Right Technology
Technology is crucial for business success, but its cybersecurity features must not be overlooked. Businesses often assume modern applications have built-in security and that vendors are solely responsible for protecting data. Both vendors and clients must ensure proper security controls during implementation. Don’t skimp training or accreditation on systems.
Basic Security Measures
- Enforce Multi-Factor Authentication (MFA) and Single Sign-On (SSO)
- Ensure software is up to date and patched
- Use centrally managed antivirus software
- Implement threat hunting and ransomware detection
- Regularly report and monitor these measures and ensure staff know the reporting process and who they can call on for help.
Educated staff and advanced technology require structured processes and frameworks. Policies dictate what needs to be done, while processes describe how to implement these policies.
Without proper guidance, employees might use systems in ways that expose the business to cyber threats. Effective policies and processes standardise and control technology use, reducing risks such as data breaches and ransomware attacks.
Cybersecurity poses a significant threat to businesses of all sizes. Ignoring the risk is dangerous, especially with data clearly showing that cyber-attacks target small to medium-sized businesses.
While your business may have been exposed to these risks, it is never too late to start building a security policy that works for your company. Every day you don’t is like leaving another window open in your house. In the words of James Scott, Co-Founder of the Institute for Critical Infrastructure Technology; “There is no silver bullet with cybersecurity; a layered defence is the only viable option.”
For expertise and information on the best cyber and data protection practices for your business, get in touch with us at IT Experts Europe.