2023 has been off to a crazy start, with the third week of January alone bringing headlines that a major telecom company, a payment platform, and an email service provider suffered cybersecurity attacks. Even though large companies dominate the headlines, businesses of all sizes face the risk of cyber-attacks.
In August 2022, the FBI warned that threat actors were targeting US businesses using data obtained from these large-scale cyber-attacks in credential stuffing operations. While major multinational corporations grab a majority of the headlines when a breach occurs, small and medium-sized enterprises (SMEs) still need to prepare a strong cybersecurity strategy.
In 2020 we experienced a record number of cybersecurity events with breaches becoming more expensive than ever, and in 2021 we experienced a record number of cybersecurity events with breaches becoming more expensive than ever, in 2022… do you see where we’re going with this? Incidents keep increasing and keep getting more expensive. With more businesses of all sizes increasingly embracing remote work options and cloud technologies, ensuring adequate protection for these technologies is also non-negotiable table stakes.
Investing resources into cybersecurity can help mitigate risk and prepare SMEs for growth. Some good places to start:
- Complete a Social Engineering Assessment to understand organizational readiness for the most common attack vector.
- Consider a DarkWeb Intelligence Report to see if there are any active compromises in your organization.
- Utilize a formal Compromise Assessment to see if threat actors are already in your environment.
- Understand your current capabilities and cybersecurity features that exist within your current tech stack, or if using free versions of software does upgrading to paid or pro versions provide increased protection.
- Educate your team on the reality of cybersecurity threats and how individuals can make a difference in the security of the organization. Sharing what to look for in fraudulent communications is especially important.
Why me? I don’t have tons of consumer data.
Threat actors are savvy opportunists. Even though SMEs do not have millions of consumer data files, they are still interesting targets to threat actors focused on business shutdown rather than data acquisition. Security vulnerabilities in SMEs have four primary contributors.
The solution set
SMEs tend to have a less robust approach to cybersecurity than their large counterparts, often due to limited security budgets. On the smaller side of the spectrum, a focus on end-point security with low-cost, consumer-grade solutions is the most common. As organizations mature their approach to security, they may add network security to their planning. The bigger and more mature businesses in this category are likely to have a strong understanding of security needs but less willingness to pay for more new additional complex solutions. This results in the opportunity for threat actors to leverage both attack vectors related to consumer-grade tech as well as target more mature legacy platforms.
Limited oversight
SMEs run tight ships. Everyone is covering a large amount of mission-critical ground. In circumstances like these, it’s easy for those “I really need to get to this” items, like cybersecurity, to stay on the back burner. Many do not have in-house IT teams, or if they do, there is not a qualified cybersecurity resource in the mix. Without a cybersecurity resource, the organization’s security posture can become outdated very quickly. Additionally, many organizations do not even realize when they have been involved in a breach. Thus, more companies are considering DarkWeb Threat Intel and Compromise Assessments prior to partnerships and acquisitions.
An abundance of flexibility
Remote, hybrid, and flexible work options are quickly becoming requisite offerings in today’s job market. In SMEs, these options often pair with a more lenient approach to personal device use; remote solutions may also offer less ability to employ firewalls as a method of protection. With Social Engineering remaining one of the most effective attack vectors, the security gap created by this flexible approach poses a significant risk to organizations.
Limited resources
Whether it’s budget, time, or people, SMEs have resource limitations beyond what their larger counterparts experience. From a talent perspective, they are competing in an already understaffed cybersecurity job market. As budgetary spending hunkers down to face a fluctuating, uncertain economy, technology spending will be under increased scrutiny. And, for most SMEs considering a large initiative, the question of who will manage it is a big one.
As Baker McKinsey noted, the pandemic saw a 4x rise in the number of cyber-attacks, with small and medium-sized businesses being especially vulnerable. As we continue to weather economic uncertainty around the world, cybersecurity budgets are likely to shrink, further exposing existing vulnerabilities.
If your organization does not have the bandwidth or resources to craft a cybersecurity strategy, you can be confident in protecting yourself, seek a cybersecurity partner to assist in the process. From assessing to strategy, a cybersecurity consulting firm can help you build, implement, and manage a strategy customized to your needs.
