Small and medium businesses are the backbone of many economies, yet they often do not have the same level of cybersecurity as larger businesses. This is because they think they are too small to be a target or believe that their cybersecurity measures are adequate. This blog post will discuss why SMBs are doing cyber security wrong and how to get it right!
Security is an enabler to your business growth when implemented correctly. This ensures a balance with usability, delivering frictionless performance while delivering a safe and secure workplace. If your business already has cyber security maturity and is looking to discuss your security concerns – please visit SME cyber security services.
SMB Cyber Security
Cybersecurity is not a game that can be solved by simply ticking a box. To be effective, it is crucial to understand ‘why’ and ‘how’ cybersecurity should be done correctly.
Your why lies in identifying where are your crown jewels. You are how lies in what all currently is in place amongst people, processes and tech; and what’s needed to fulfil the gaps. Utilising cloud services or SaaS subscriptions doesn’t mean you don’t have digital assets, lesser security vulnerabilities or a small security posture. Common examples of crown jewels include Active Directory, customer databases, and source code repositories.
Many IT directors and managers feel their senior stakeholders aren’t concerned about cybersecurity threats. Whether you are a CTO, CIO or IT manager handling security, cyber security as a business case needs to be made for SMBs to invest in the right tools and processes.
Your critical data protection starts from your board room, which must set the risk management regime. Security policies, adhering to cybersecurity best practices, tackling known threats, purchasing next-generation firewalls or endpoint detection software from an industry leader, or whether or not to utilise limited resources or managed services are all afterthoughts. None of these guarantees ways of reducing the most common digital security risks.
Here is the list of top 10 reasons we think cyber security isn’t working in SMBs, followed by each of the ‘how’ to get it right.
1. Lack of awareness of cyber security
Why do small businesses lack understanding?
In this day and age of data breaches covering headlines, most of us know the main security measures such as multi-factor authentication, timely patching/ updates, phishing and social engineering attacks. However, it is true that when it comes to the business side, stakeholders at SMBs lack awareness of the latest cyber threats, and this means that they do not have the proper measures in place to protect themselves against these threats.
Cybersecurity should be seen as an investment, not a cost. There are no immediate ROI figures like your advertising or retail project. This is related to risk controls, effectively following a risk-focussed approach to reduce the probability of adverse events in the future.
2. Reactive instead of a proactive approach to security
Why do a reactive approach to cybersecurity less effective?
Many SMBs adopt a reactive approach to security instead of a proactive one, which means they wait for something to happen before taking action. For example, they may only start to think about cybersecurity after regulatory concerns, security incidents or any related compulsory situations to act.
A proactive approach to security is much more effective. This ensures that SMBs are always one step ahead of the attackers. SMBs should start with a basic security strategy and then keep a continuous tab on the people, processed and technology functions.
Examples of a proactive approach to cybersecurity would be:
Responding only to regulatory concerns or tender requirements
Organisation-wise, cybersecurity is defined as antivirus software, firewalls and web proxies usage only
Reactive incident response after security incidents occur
A proactive approach to cybersecurity includes:
Have a comprehensive security strategy
Active logging and monitoring controls to identify and analyse unusual events
Regular attack surface analysis to stay aware of your exposures
Continuous penetration testing to identify and plan risk remediations
Train your staff to be aware of cyber threats
3. Limited understanding of how to mitigate cyber risks
Asking a cyber security company to conduct penetration testing is the easy part; the actual homework for the business starts after the pen test report is handed to them. This includes risk analysis and preparation of a risk remediation plan.
Additionally, businesses live under the myth that having modern security products in place will auto-magically take care of all things under the security domain. However, protecting company data or sensitive data involves a layered approach that includes multiple controls across all entry and exit points of Internet traffic. This could be email and voice communication, Internet access through endpoints (both mobile and office-based) and assets access (devices and servers).
Cyber risks can only be effectively mitigated if businesses understand them well. Ensure that you choose a partner supportive of your proactive approach, not a ‘report and run’ company.
For example, phishing attacks can’t be prevented by enforcing an awareness course that runs once a year, nor an email security gateway can prevent it. It’s the combination of people, process and technical controls that are functional in a continuous manner while measuring ROI. This attack vector impacts everyone, be it an individual, SMB cybersecurity issue, midsize businesses or large enterprises.
An organisation (whether a larger enterprise or small business) with well-defined ways to handle the infection of malicious code from a security incident could easily give bad actors a tough time. This would ensure limiting the impact and reducing the infection rate, allowing security teams more time.
4. Ineffective or nonexistent incident response plan
An incident response plan is crucial for any business, yet many SMBs do not have one in place. This means that they are not prepared for a cyber attack, and they do not know how to respond to one.
Ransomware attacks are not the be-all-end-all situations if businesses are prepared to limit the infections and reduce the likelihood. Most businesses have failed to control such cases due to the lack of incident response plans and logging and monitoring controls.
A response plan outlines a step-by-step procedure for successfully handling an incident, whether caused by malware injection, ransomware, advanced persistent threat (APT) or a Distributed Denial of Service (DDoS) attack.
A cyber security incident response plan is a document that provides instructions for an organisation to detect and analyse a cybersecurity incident and respond to minimise the damage caused.
5. Not understanding the cybersecurity investments
Why cybersecurity investment is more than security tools or hiring security professionals?
Rise in the cybercrime over the last few years has opened eyes across the boards and risk committees responsible for organisations. This has caused organisations to plan strategically against a data breach situation. Having antivirus software and firewall, those days are long gone.
Cybersecurity investments do not stop at outsourcing the cyber security function or buying modern products. It involves strategic planning in line with business objectives, keeping in mind all three areas, i.e. people, process and technological controls.
Many SMBs believe they do not need to invest in cybersecurity because they are too small to be a target. At other times, IT directors or managers face resistance from senior stakeholders due to a lack of awareness.
Over-reliance on IT service providers for security needs has a proven downside. The same teams handling your IT and cybersecurity needs simultaneously add to a conflict of interest. Further downsides could be a lack of security skill-set within IT MSPs or selling cybersecurity software without due diligence.
Cyber security could be presented as a business case in various ways, starting with a gap analysis that portrays the weaknesses across the infrastructure. These vulnerabilities or weaknesses could be at ground level – ones that can be mitigated using skill-set – or functional level due to the absence of the organisation’s strategic approach to security.
The best way to get around this challenge is to explain the implications of assessment findings translated into reputational, regulatory or financial risks, a language that senior stakeholders can easily understand.
6. Lack of trained personnel
Another reason SMBs do cyber security wrong is that they lack trained personnel. This means that they do not have the right people in place to carry out the necessary tasks. Some businesses prefer in-house teams, and some prefer a hybrid model to leverage partnerships with managed service providers. However, be aware that an IT and a managed security service provider are two completely different skill-sets.
Continuous and interactive training programmes aimed at employees are crucial for SMBs to stay ahead of the curve. These programmes should be designed to increase awareness about cyber threats and how to mitigate them. Think of it as internal consulting work for your security team, and various departments are their customers.
Suspicious activity can have varied forms of attack vectors. Therefore, you need your business users to be on your side. It has multiple advantages: creating a positive culture, a security-conscious culture where employees are an additional layer of defence, not just technical and process controls.
Remember, your people can be your most vital link to protect your organisation.
7. Poorly configured security systems and mobile devices
Misconfiguration attacks, default and weak credentials are often the most exploited security weaknesses. They can leave SMBs open to cyber attacks, even with the best security tools. Similarly, web applications lacking secure coding practices could leave gaping holes, an open invitation for attackers.
Encryption misconfiguration can cost dearly where organisations feel committed to a security solution while staying open to exposing their valuable data or intellectual property. Examples include AWS S3 buckets leakage or cloud security threats where minor misconfiguration has serious consequences.
Lack of testing backups, Distributed denial of service controls or DR situations could add to severe challenges to ensuring business operations during adverse events.
At the minimum, ensure secure baseline technology controls are documented as checklists and used every time new assets are rolled out into your environment. Also, regular change management audits should be done to flag potential risks. SMBs should also consider using security automation tools to help with security configuration.
Secure coding practices, secure SDLC for fast development and OWASP Top 10 web applications and API risks.
8. Lack of coordination between different teams responsible for cybersecurity
Another reason SMBs are getting cyber security wrong is that there is a lack of coordination between different teams responsible for cybersecurity. This can lead to duplication of effort and a waste of resources.
For example, the network team may be responsible for firewall configuration, while the IT team is responsible for configurational changes to servers in the DMZ. Without liaising about the upcoming change’s potential impact, timelines and other details, one could easily miss and allow certain gaps in the firewall forever. This would have a future impact on the company’s network, which might include allowing the transfer of malicious programs or allowing threat actors to gain access utilising connections initiated from inside.
Communication between teams, across departments and in general between senior management and the staff is one of the critical elements when it comes to handling a ransomware attack. Crisis communication is not just about a press release to handle financial information or other data leakage situations.
An organisation should utilise workflow mapping and issue trackers in this agile world. Alternatively, SMBs should have a centralised repository for all documentation related to cybersecurity, including network diagrams, asset inventory, contact details and so on.
9. Lack of balance across people, process and technology controls
Many SMBs make the mistake of thinking they can solve all their cybersecurity problems with technology. However, this is not the case. SMBs need to have a balance between people, process and technology to be effective.
The best way to achieve this balance is to have a comprehensive security strategy. This strategy should be reviewed and updated regularly. It should take into account the changing landscape of cyber threats and the evolving needs of the business.
10. Small businesses fail to keep up with the basics
The final reason SMBs are getting cyber security wrong is that they fail to keep up with the basics. This includes a lack of implementation of the least privilege principle, lack of segregation, and insecure information storage practices.
Avoiding exceptions would help businesses to ensure any controls are applicable across the estate. For instance, preparing against spear-phishing attacks includes awareness and controls applicability across the estate without exceptions. Losing login credentials in a phishing attack is not disastrous if small or medium-sized businesses are prepared to limit the impact of such security risks. Learn more around typosquatting techniques, how to identify and report phishing emails.
This is also applicable to third-party supply chain risks, and insider risks related to former employees and current employees (disgruntled or part of espionage); SMBs often outsource or use cloud-based solutions and neglect to ensure these services have appropriate security controls in place.
Organisations should make sure that they are doing the basics right. This includes things like enforced use of password managers, using two-factor authentication, securing mobile devices, VPN or IP restrictions on admin interface and encryption for sensitive information at rest and in transit.
Keeping a business online involves a layered approach, right from the outset, with defence in depth being a key consideration. Cybersecurity issues cannot be left to the IT department – it should be everyone’s responsibility.
Here are the 10 essential tips for a business still at the start of the cyber security maturity ladder:
Educate your employees about cyber threats
Implement the least privilege principle
Utilise segmentation concepts at network, user and environment levels
Use multi-factor authentication
Secure your mobile devices
Regular analysis and enforcing strong passwords
Harden your systems through operating systems patching and adherence to secure baselines
Implement a comprehensive security strategy
Monitor your environment for changes
Regularly review and update your security policies
It’s not all doom and gloom, though. You can take simple steps to shore up your cyber security posture and protect your business from these threats. We’ve outlined the top ten reasons companies are doing cyber security wrong, as well as tips on getting it right. So, where do you stand?
Get in touch to schedule a casual conversation with one of our experts and find out how you can improve your cybersecurity posture. Thanks for reading!
Harman Singh is a security professional with over 15 years of consulting experience in both public and private sectors.
As the Managing Consultant at Cyphere, he provides cyber security services to retailers, fintech companies, SaaS providers, housing and social care, construction and more. Harman specialises in technical risk assessments, penetration testing and security strategy.
He regularly speaks at industry events, has been a trainer at prestigious conferences such as Black Hat and shares his expertise on topics such as ‘less is more’ when it comes to cybersecurity. He is a strong advocate for ensuring cyber security as an enabler for business growth.
In addition to his consultancy work, Harman is an active blogger and author who has written articles for Infosecurity Magazine, VentureBeat and other websites.