By Joshua Walsh, Information Security Practitioner, part of the cyber, data and information law specialist team at rradar
Cybercriminals pose a significant and growing threat to businesses of all sizes. As industries become more reliant on technology to manage or support key functions, risks posed by cyber criminals cannot be ignored. Businesses can no longer afford to consider if they will suffer a cyber attack, but when.
Business leaders must do everything they can to prepare for that reality. It’s not about whether businesses are burying their heads in the sand, but more about whether they are fully aware of the risks and know what to do to mitigate them. For instance, SMEs often mistakenly believe that cyber attackers only target larger organisations, but that’s not the case. Good security practices don’t have to require a lot of money. It just requires a bit of time and effort to understand what you need to do.
Cybercrime Is Becoming More Accessible
As technology continues to evolve at a rapid rate, the difficulty bar for malicious actors to cause harm through hacking and phishing is significantly lower than it was a couple of years ago, as they can use freely available AI tools to help them write legitimate looking emails or create code. This not only expedites the amount of time a cybercriminal spends on crafting these attacks but it also makes previous guidelines and training around spotting such attacks less effective (e.g. poor grammar, typos, tone, etc).
4 Steps SMEs Can Take to Prepare
- Create, test and continue to update a business continuity plan or incident response plan. This is really important because it provides a step-by-step guide, outlining who’s responsible for what and the actions that need to be taken should an incident happen.
- Ensure your Cyber training for staff is up-to-date and useful. It only takes one person to click on a link to compromise the business. One of the best ways to get the point across to people is to show them examples of real phishing attempts that the business has faced. You also want people to feel safe owning up to mistakes or calling out issues they find without fearing repercussions.
- Set up Multi-factor Authentication. This isn’t a silver bullet, but it gives organisations enough time to react, slow down the attacker and deal with the incident.
- Apply the principle of least privilege for system access. This means employees should only have access to the specific data resources and applications that they need to carry out their jobs. If access goes beyond that, there’s a security risk because if someone is compromised, they have access to more than they should. It’s also vital to keep systems and software up to date.
By taking these steps, SMEs can reduce their risk and build resilience against the growing threat of cybercrime. Staying proactive is essential for businesses to strengthen their defences, limit potential damage and ensure they are better equipped to respond to an attack.
