How SMEs can protect themselves against cyberattacks

IN ARCHERY, the bull’s eye grants the highest score when hit. For cyber criminals, Fortune 500 companies could be seen as the bull’s eyes of the enterprise world – they possess huge amounts of valuable data and financial resources, and successful cyberattacks on them would reap the biggest rewards.

However, threat actors are now turning to companies on the outer rims of the target board: small and medium-sized enterprises (SMEs).

SMEs may have a false sense of security, with the misconception that they are too small to be attacked. Yet they remain lucrative as targets. Even the smallest of businesses may be managing large sums of money or huge amounts of data. And if they work with larger corporations, they could be a gateway for malicious actors to reach those companies.

A 2022 report found that threat actors have carried out nearly 11.3 million Web attacks against small businesses, with Indonesia, Vietnam and Thailand experiencing the most Web attacks.

For SMEs, cyberattacks are more than just a setback – they could place business owners and their customers’ personal data in jeopardy. At the same time, SMEs play a critical role in global economic development, and their importance to Asean’s economy is hard to overlook. More needs to be done to safeguard these businesses against growing cyberthreats.

Don’t let trust be exploited

Humans tend to be the weakest link in cybersecurity. LinkedIn recruitment bait, bogus social media accounts and malware attacks are some of the latest social engineering techniques by threat actors to take advantage of our trust and gain entry to company networks.

To ease the burden on their employees when it comes to keeping data secure, SMEs can adopt a “zero trust” model. Such a model assumes that any and every attempt to access the network is a breach, and verifies every single request, no matter where or who it comes from. Every data request is authenticated, authorised and encrypted before it is granted.

The implementation of a zero trust framework cannot be completed overnight. SMEs will need a roadmap that gradually integrates the framework into their existing infrastructure, rather than starting from scratch. This allows SMEs to minimise costs, build upon their current technology, and gradually adopt a partial zero trust architecture.

Adopting multi-factor authentication

Two-factor authentication (2FA) or multi-factor authentication (MFA) is not new, and is one of the first and immediate measures a company can implement in their zero trust journey. This may be an added inconvenience, particularly when we need urgent access to a service – but verifying our activity at crucial checkpoints provides more layers to secure sensitive personal information.

For a start, SMEs should require their employees to always enable 2FA or MFA where available, incorporating mobile pushes or secret questions for added security.

At the organisational level, adaptive MFA rules can be coded to balance security requirements with employee user experience. For instance, the authentication process can include contextual rules based on the geographical location of a user login. Considering such details will enhance the organisation’s digital security. Friction need not be a nuisance; it can be a valuable feature of security design.

Non-tech moves

As counterintuitive as it may sound, the growing sophistication of cybercrimes means that cyberrisk management cannot be addressed solely by technology.

Most SMEs face difficulties in securing access to capital and would need additional financial support to recover from a cyberattack. Business leaders should opt for cyber insurance to cushion the financial impact of any such attack. They should also look out for third-party protection, remediation, helpline support, and business interruption coverage.

SMEs should prioritise cybereducation to ensure employees are adequately trained on their responsibilities, and have a good understanding of the latest cyberthreats and social engineering tactics. Regular internal tests may be implemented to assess employees’ cybercompetence, providing insights into how they can best be trained.

Keeping pace with the number of new and sophisticated cyberthreats remains a challenge. Criminals are constantly looking for ways to slip malicious code into networks and encrypt data, leaving individuals in compromised circumstances. We cannot afford to be on the backfoot with a reactive stance.

In today’s world, there are only two types of businesses – those that have faced a cyberattack, and those that will face a cyberattack. To avoid the consequences of becoming a target, SMEs will need to ensure that their people, processes, and technologies are prepared for these attacks when they happen.

The writer is managing director of software company Adnovum Singapore.