Cyberattacks on SMBs Reach Record Highs

In recent years, the landscape of cyberattacks has seen a worrying trend, with record-high incidents targeting Small and Medium-sized Businesses (SMBs). These attacks have reached unprecedented levels, posing significant threats to the very backbone of economies around the world. SMBs, often seen as attractive targets due to their limited cybersecurity resources and vulnerabilities, have become prime victims of cyber criminals.

One of the primary reasons behind the surge in cyberattacks on SMBs is the increasing sophistication of cybercriminals. They have developed more advanced and targeted attack techniques, making it easier for them to breach the defenses of these smaller organizations.?

Plus, the growth of remote work environments, fueled by the COVID-19 pandemic, created new opportunities for cybercriminals to exploit vulnerabilities in SMBs' digital infrastructures. With limited cybersecurity expertise, many SMBs struggle to adequately protect their networks, making them low-hanging fruit for cyber attackers.

The consequences of these cyberattacks on SMBs can be devastating. Beyond the immediate financial losses, which can be crippling for smaller businesses, there are also long-term implications for their reputation and customer trust.?

In certain industries, like healthcare and finance, cyberattacks on SMBs can severely affect data privacy and compliance. As a result, it has become imperative for SMBs to prioritize cybersecurity and invest in robust security measures to safeguard their operations and data from the growing cyber threat landscape.

Let’s take a look at some of the most recent figures, trends, and tips…

Cyber Attacks and Data Breaches on SMBs

In an article by SecureWorld , they wrote, “A new report from the Identity Theft Resource Center (ITRC) reveals cyberattacks and data breaches targeted at small and medium-sized businesses (SMBs) continue to climb, reaching their highest levels in the three years of the study.

The 2023 ITRC Business Impact Report shows that 73% of SMBs experienced a cyberattack, data breach, or both in the past 12 months. This represents a significant jump from the 58% attack rate in 2021 and 43% in 2022.

Yet, despite the rising threats, 85% of SMB leaders surveyed said they felt prepared to protect against or recover from cyberattacks. This confidence comes even as only 20-34% reported following best practices such as multi-factor authentication, strong passwords, and role-based access controls for sensitive data.

The disconnect between confidence and action on security concerned experts like George McGregor, VP at Approov Mobile Security, who said:

?"This is disappointing, with very poor levels of implementation of basic best practices and only half of the companies taking steps to stop breaches.

I also think the 'good news' in the report—a reported reduced financial impact of breaches—is probably not to be taken too seriously, either. If self-reported, it may not be accurate.

There will be more and more pressure on small businesses as new reporting requirements come into force, and they will be forced to take the issue of cybersecurity more seriously."

McGregor predicts that new regulations will force small businesses to take cybersecurity more seriously. But for now, the adoption of protections remains low.

While the financial consequences may be declining, the ITRC report shows cyberattacks still impact SMBs in other ways. Forty-two percent reported a loss of revenue, and 32% said they lost customer trust. One in three dealt with higher employee turnover after an incident.

As attacks reach unprecedented levels, SMBs must back up their confidence in defenses with concrete actions. Implementing multi-factor authentication, stronger passwords, and access controls are vital steps. Partnering with IT providers and cybersecurity experts can help small businesses prepare for the mounting threats.

Though leaders feel ready, the reality is that substantial security improvements are still needed at most SMBs. The threat from cybercriminals continues rising, and no business can afford to be the next victim.”

The Evolving Cyber Threats for SMBs?

In excerpts from an article by DarkReading , they wrote, “Small and midsize businesses (SMBs) are not immune to cyberattacks, yet they struggle with an evolving threat landscape and knowing how to best manage risk.

During the "Cybersecurity for SMBs Roundtable: Navigating Complexity and Building Resilience" earlier this month, Sage brought together a group of CISOs and other cybersecurity professionals from small businesses, government agencies, and nonprofit organizations to discuss some of the biggest concerns facing SMBs and their ability to secure their company assets. Among the top challenges for SMBs and nonprofit organizations are:

• The human factor. Employees continue to make mistakes, such as clicking on links in phishing emails or allowing unprotected access to their devices, that put company networks at risk.
• Third-party compliance needs. Partner organizations, contractors, vendors, and other third-party entities require SMBs to meet their cybersecurity requirements, especially those organizations, like financial institutions, that are highly regulated.
• Data privacy laws across states and countries. Not meeting those compliance requirements could result in sanctions and fines.
• The hybrid workforce. SMBs no longer have the same levels of oversight of devices and online behaviors when employees are working remotely, even part of the time.
• Targeted platforms and industries. Threat actors look for organizations that use applications designed to raise money or collect large amounts of personal information.
• Changing threat landscape. New attack vectors, new malware, and new threat actors seem to emerge every day.

Nearly half of SMBs have experienced a cybersecurity incident in the past year, according to a new study from Sage. While 69% of respondents worldwide say that cybersecurity is part of their company culture, nearly the same number don't consider it until there's an incident — only 4 in 10 respondents say their company regularly discusses cybersecurity.

Individualize Security Training

Because of the human connection to cybersecurity, everyone in a smaller company, from the CEO down, has to have a basic understanding of what threats look like. There are plenty of security awareness training options out there, but SMBs would be wise to avoid a one-size-fits-all option.

Training should be geared toward individual workers based on criteria such as job function and generational gaps in tech savviness and interests. Older workers often have a different style of learning than younger employees, just as employees who work in more labor-intensive jobs may have a different relationship to technology than those who are attached to their devices all day. Not respecting those differences results in uneven training that could end up doing more harm than good.

Make Cybersecurity a Business Issue

There's a tendency, especially among SMBs, to think of cybersecurity as an IT problem for which all the knowledge lies in the tech space, according to Gustavo Zeidan, Sage's CISO.

A better approach is to think of cybersecurity as a business issue. Security culture is better driven from the top, Zeidan said during the roundtable, and management needs to be discussing cyber threats and how their businesses may be targeted.

"Business leaders acknowledge it's a problem, but they don't talk about it," Zeidan explained. The worst thing that can happen is to be unprepared for a security incident that disrupts business operations.

And when there is a cyber incident within the company, don't keep it hidden. The Federal Trade Commission (FTC) offers guidelines on who should be contacted, including law enforcement, customers, and vendors.

But don't stop there. Communicate with other businesses and discuss strategies to work through the incident. Share this information through industry-focused organizations or at local Chamber of Commerce meetings — wherever you have contact with other business leaders.

"If you have a breach, be open, be honest, and share your lessons learned with other businesses so practitioners can learn from that," said Delaney. "It doesn't matter if we're competitors. It's all national security when you boil it down."

Practitioners and businesses might feel like they're playing whack-a-mole with their efforts to thwart these new threats, but the good news for SMBs is that mitigation techniques are out there. It's just a matter of finding the program that works best for the individual company.”

Simple Cyber Security Measures

In excerpts from an article by Nasdaq , they wrote, “Navigating the ever-evolving world of cyber security can be overwhelming for small and midsize businesses (SMBs). A recent study by Sage underscores this sentiment, with 43% of SMBs admitting that deciphering the right security measures feels like wading through murky waters.

Every day brings a fresh cyber threat, another breached company, or the latest indispensable security gadget. Alarmingly, Sage highlights that 51% of business leaders view keeping abreast of these relentless threats as their paramount cyber challenge. Given their limited resources, it's no wonder that nearly half of SMBs — a staggering 48% — have faced the brunt of at least one cyber security incident in the past year.

Given the devastating effects a cyber breach can have on a small business, it has become increasingly evident that cyber security isn't an inherent risk that can simply be ignored; it must be seen as an integral part of everyday business management, just like data protection and regulations such as GDPR. It should be considered and integrated into processes in the same way we manage any other business risk.

And while SMBs must get proactive and start prioritizing cyber security, it isn’t always clear where to start especially as many of them often lack a dedicated internal cyber security specialist. In fact, according to Sage, just 10% of SMBs have a dedicated security manager that can monitor and respond to cyber threats.

Therefore, SMBs should focus on a core of good cyber security practices that can be implemented easily. Despite the evolving tactics of cyber criminals, the vulnerabilities they exploit remain relatively unchanged, so tried and tested cyber security basics form a strong defense in the face of any attack and can be easily rolled out with minimal disruption to business.

Getting the basics right will not only protect businesses from a wide variety of attacks but will also offer business leaders the much-needed reassurance to focus on driving profitability.

The first step to cyber resilience – understand the fundamental security needs

Before diving headfirst into new tools and systems, businesses need to understand the possible vulnerabilities to ensure tools and best practices are optimized for their unique security needs.

?For example, for online retailers, an e-commerce website is likely the most valuable business asset, given it is the main source of revenue and attracting new customers, whereas, in the case of a manufacturing business, the most important asset is the operational technology used in the manufacturing process, without which operations would ground to halt. At the same time, all businesses hold personal data belonging to customers and employees, which must be adequately protected.

In order to focus precious resources in the right places, businesses must first assess their assets, which ones are most vulnerable to cyber attacks, and which assets they should prioritize.

To be effective, this process should include stakeholders from different parts of the organization. This will help ensure all important systems are included and will also generate buy-in from everyone when rolling out cyber security measures to reduce critical security risks most effectively.

Despite the variations and diversity across SMB security needs, there are practical steps that business leaders can take now to immediately bolster defenses against cyber risks.

Two Factor Authentication

In today's digital age, activating Two-Factor Authentication (2FA) stands out as an essential step. This security measure goes beyond the traditional password, creating a significant hurdle for cybercriminals. When they encounter 2FA, even a stolen password won't grant them access. By utilizing a unique code, sent either to a personal device like a smartphone or a dedicated hardware token, access is only possible for someone with the physical device in hand.

Security of the cloud

Next, as technology advances, businesses should embrace the security advantages of the cloud. Notably, reputable cloud providers often boast state-of-the-art security infrastructures that surpass what many organizations can manage on-site. By migrating to these providers, businesses tap into their extensive security research and rapid threat response mechanisms. These cloud services don't just provide robust, streamlined security; they also offer a cost-effective solution that reduces the burden on in-house IT teams.

Endpoint Detection and Response

Speaking of evolution in security, the implementation of Endpoint Detection and Response (EDR) tools is a game-changer. Traditional anti-virus systems are now being outpaced by these advanced tools. Solutions like Microsoft's Defender for Endpoint can be integrated across a company's devices, offering vigilant monitoring against unusual, potentially harmful behaviors. Their real-time response to threats, often without needing human intervention, means threats are detected and neutralized rapidly, minimizing potential harm.

Cyber security training and culture

While technology offers many solutions, the human element remains crucial. This is why prioritizing employee cyber security training is paramount. Instead of being the weak link, well-trained employees can become a formidable first line of defense.?

Through regular workshops and training sessions, employees can be updated on the latest threats, such as the ever-persistent issue of phishing. An organization that fosters open dialogue around cyber security ensures that every member feels responsible for the collective digital safety. The transformation is palpable: a workforce that once might have been vulnerable now becomes vigilant, able to spot and report suspicious activities.

Incident preparedness

Lastly, in the realm of cyber security, foresight is invaluable. Businesses should proactively plan for emergencies. This involves recognizing which data and systems are essential for daily operations and devising contingency plans. These plans should consider worst-case scenarios, such as crippling data breaches or ransomware attacks.?

Having a list of key contacts and a coordinated response strategy can be the difference between a minor hiccup and a major crisis. Such preparedness ensures swift, coordinated reactions during incidents, significantly reducing potential damage in terms of downtime, costs, and reputation.

Keeping it simple is the key to cyber resilience

Cyber security doesn’t have to be an insurmountable goal. While many aspects are highly technical, grasping the basic concepts of cyber resilience should be simple and easy to implement. Taking these steps will greatly reduce the likelihood of a successful attack and ensure SMBs are ready to take effective action if needed.”

In conclusion, the rising wave of cyberattacks targeting Small and Medium-sized Businesses (SMBs) presents a critical challenge that cannot be ignored. The sophistication of cybercriminals and the vulnerabilities created by remote work environments have pushed cyberattacks on SMBs to record highs. These attacks not only result in immediate financial losses but also have long-lasting implications for reputation and customer trust, particularly in industries dealing with sensitive data.

Recent reports indicate a worrying disconnect between SMB leaders' confidence in their cybersecurity preparedness and their actual implementation of essential security measures. This gap underscores the need for concrete actions to bolster defenses against the mounting cyber threat landscape.

To navigate this evolving threat landscape, SMBs should adopt a proactive approach to cybersecurity. This includes individualized security training for employees, recognizing that cybersecurity is not just an IT problem but a business issue, and fostering open communication about cyber incidents within the industry.

Moreover, SMBs can start with simple yet effective cybersecurity measures, such as Two-Factor Authentication (2FA), leveraging the security advantages of the cloud, implementing Endpoint Detection and Response (EDR) tools, investing in cybersecurity training, creating a culture of cybersecurity awareness, and preparing for potential cyber incidents with contingency plans.

In essence, while the world of cybersecurity may seem complex, SMBs can significantly enhance their cyber resilience by prioritizing basic yet crucial cybersecurity practices. Taking these steps will not only reduce the risk of successful cyberattacks but also ensure that SMBs are well-prepared to respond effectively if a cyber incident does occur. The ever-evolving cyber threat landscape requires SMBs to act decisively, recognizing that cybersecurity is an integral part of their everyday business management.

At Adaptive Office Solutions , cybersecurity is our specialty. We keep cybercrimes at bay by using analysis, forensics, and reverse engineering to prevent malware attempts and patch vulnerability issues. By making an investment in multilayered cybersecurity, you can leverage our expertise to boost your defenses, mitigate risks, and protect your data with next-gen IT security solutions.

Every device connecting to the internet poses a cyber security threat, including that innocent-looking smartwatch you’re wearing. Adaptive’s wide range of experience and certifications fills the gaps in your business's IT infrastructure and dramatically increases the effectiveness of your cybersecurity posture.

Using our proactive cybersecurity management, cutting-edge network security tools, and comprehensive business IT solutions, you can lower your costs through systems that are running at their prime, creating greater efficiency and preventing data loss and costly downtime. With Adaptive Office Solutions by your side, we’ll help you navigate the complexities of cybersecurity so you can achieve business success without worrying about online threats.

To schedule a Cyber Security Risk Review, call the Adaptive Office Solutions’ hotline at 506-624-9480 or email us at [email protected]