SMEs Wake Up – You ARE the low-hanging fruit for cybercriminals

July 2024 Information Security

According to an IBM report, on average, it takes nearly 287 days to detect and contain a data breach. A lot of damage can be done in such a long period of time. For one thing, your reputation can go down the drain, along with your dream of selling this great little business it has taken you 20 years or more to build. This is according to Ethan Searle, Business Development Director, LanDynamix.

Ethan Searle

Searle says many SMEs are under the illusion that their size makes them impervious to cybercriminals. “Too often, small business owners underestimate the knowledge, skills, and ability of cybercriminals to pick the low-hanging fruit – those are the businesses that are most likely to lack cybersecurity measures, with the excuse that it is too costly for a company of their size.

“Cybercriminals today are no longer single hackers, but entire collaborative networks on a global scale. It is delusional to think these organised hackers only target large corporations with vast resources. It is never a case of the bigger the organisation, the more attractive the hit will be because the yield will be bigger. In fact, the opposite is true; smaller organisations are more vulnerable due to lack of focus and investment in protection, making them prime targets for hacking, as they require minimum effort and resources,” says Searle.

He explains how a cyber breach can have far more sinister implications for small businesses than large enterprises with greater financial reserves and investment in recovery systems. “SMEs are characteristically founded by entrepreneurs with a vision to grow their business into a saleable entity; however, a cyber breach can do irreparable damage operationally, financially, and of course, reputationally. All these impacts can be devastating to the resale value of a business. SMEs need to ask themselves if they are willing to risk this outcome.”

Digital security awareness is vital

Searle says while modern technology has enabled access to business data from anywhere, at any time, it has also vastly expanded the attack surface and presented hackers with new points of entry.

“So, you have small business owners with a limited number of employees, but all of whom have been supplied with the necessary apps and tools that enable them to perform their duties to the highest standard and with speed and ease. However, many SMEs are unaware of what is called ‘Shadow IT’, which is when employees are using tools that are not officially sanctioned by the company. These are convenient access points for cybercriminals. In addition, the proliferation of smart devices broadens the opportunity landscape even further,” notes Searle.

Don’t overlook security patching

“Security patches are defined as software and operating system updates that aim to fix security vulnerabilities in a program or product. These updates literally ‘patch’ a hole in your defence, preventing a hacker or piece of malware from exploiting a way into your network. The Ponemon Institute has reported that nearly 60% of data breaches could have been prevented by better patch management. Updating your software — whether through a rapid alert or regular software updates — can help keep your information secure against evolving threats. Remember these software updates not only help your cybersecurity, but also your compliance, and a compliant business is a far more saleable entity.

“If you are clever enough to have taken on a managed service provider (MSP), security patches are often sent as push notifications from the MSP administering your operating system, email, and web applications. One of the major advantages for small businesses who take this approach is cost, often an outsourced team suits SME budgets better than managing a full internal team – that’s even if you can find the necessary skills to do it effectively. Patching is an important practice to protect your company against malware, ransomware, and hacking attempts. A good MSP will ensure relevant patches are applied to your devices as soon as possible, thereby greatly reducing the risk to your business. A skilled MSP will deliver not only best practices in cybersecurity, but advice on the right technology solutions that will grow and secure your business and turn it into a highly saleable entity.

“If you didn’t think your ability to sell your business is intrinsically linked to your technology deployments and security practices, think again,” Searle concludes.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

New ransomware using BitLocker to encrypt data
Technews Publishing Information Security Residential Estate (Industry)
Kaspersky has identified ransomware attacks using Microsoft’s BitLocker to attempt encryption of corporate files. It can detect specific Windows versions and enable BitLocker according to those versions.

Create order from chaos
Information Security
The task of managing and interpreting vast amounts of data is akin to finding a needle in a haystack. Cyberthreats are growing in complexity and frequency, demanding sophisticated solutions that not only detect, but also prevent, malicious activities effectively.

Trend Micro launches first security solutions for consumer AI PCs
Information Security News & Events
Trend Micro unveiled its first consumer security solutions tailored to safeguard against emerging threats in the era of AI PCs. Trend will bring these advanced capabilities to consumers in late 2024.

Kaspersky finds 24 vulnerabilities in biometric access systems
Technews Publishing Information Security
Customers urged to update firmware. Kaspersky has identified numerous flaws in the hybrid biometric terminal produced by international manufacturer ZKTeco, allowing a nefarious actor to bypass the verification process and gain unauthorised access.

Responsible AI boosts software security
Information Security
While the prevalence of high-severity security flaws in applications has dropped slightly in recent years, the risks posed by software vulnerabilities remain high, and remediating these vulnerabilities could hinder new application development.

AI and ransomware: cutting through the hype
AI & Data Analytics Information Security
It might be the great paradox of 2024: artificial intelligence (AI). Everyone is bored of hearing it, but we cannot stop talking about it. It is not going away, so we had better get used to it.

NEC XON shares lessons learned from ransomware attacks
NEC XON Editor's Choice Information Security
NEC XON has handled many ransomware attacks. We've distilled key insights and listed them in this article to better equip companies and individuals for scenarios like this, which many will say are an inevitable reality in today’s environment.

iOCO collaboration protection secures Office 365
Information Security Infrastructure
The cloud, in general, and Office 365, in particular, have played a significant role in enabling collaboration, but it has also created a security headache as organisations store valuable information on the platform.

Cybercriminals embracing AI
Information Security Security Services & Risk Management
Organisations of all sizes are exploring how artificial intelligence (AI) and generative AI, in particular, can benefit their businesses. While they are still figuring out how best to use AI, cybercriminals have fully embraced it.

A strong cybersecurity foundation
Milestone Systems Information Security
The data collected by cameras, connected sensors, and video management software can make a VMS an attractive target for malicious actors; therefore, being aware of the risks of an insecure video surveillance system and how to mitigate these are critical skills.