As cyber threats rise, more SMEs going all out to protect their operations and clients

AMID increasing digitalisation, so too is the importance of having strong cybersecurity practices for businesses big or small.

With the help of the Cyber Essentials mark, a certification programme launched by the Cyber Security Agency of Singapore (CSA) in March this year, more companies here have developed a greater awareness of the need for cybersecurity, and have started to implement better and more stringent measures to protect themselves as well as their clients. 

Targeted specifically at small and medium-sized enterprises (SMEs), the Cyber Essentials certification serves to recognise and commend enterprises that have put in place good cyber hygiene practices to protect their operations and clients against common cyber-attacks.

Prior to the launch, CSA engaged 9 companies to be pilot users for the Cyber Essentials mark, to test the certification requirements and provide feedback.

Building trust with his clients

One of them was Singapore-based Kestrel Aero. Founded in 2017, the aerospace company provides a range of services including executive charter, aero-medical evacuation and special cargo. Its clients include high-net-worth-individuals, government officials and diplomats. 

Dek Mahendran, its chief executive officer and co-founder, said security has always been an area of concern for the company because of the nature of its business.

“Some of our clients are very important people and we cannot disclose where they are going and how they are doing so,” he said. “We cannot just go around sharing anyone’s personal or medical data with others.”

He highlighted that the self-assessment checklist provided by CSA was a good guideline for Kestrel Aero to identify any existing or potential gaps in its cybersecurity systems. When these shortcomings were pointed out, the company made sure to do all it could to rectify the situation, said Mahendran. 

After identifying its weak spots with the help of this programme, Kestrel Aero implemented solutions to secure its cloud productivity solutions and to enforce email encryption. The company also ensured that all its employees had a better understanding of the importance of cybersecurity and were trained to respond appropriately in the event of a cyber-attack. 

Among the many practices that Kestrel Aero adopted include having better oversight of data movements and storage, and having greater control over who is given access to confidential information. 

Mahendran said he has also noticed that cybersecurity is becoming a growing concern for some of his clients.

“The first thing a lot of our international clients ask us is whether we have cybersecurity and measures for personal data protection,” he said, adding that the certification has enhanced the company’s standing by building a greater level of trust with clients. Since obtaining the Cyber Essentials mark, Mahendran said the client base has grown by nearly 50 per cent.

“Certifications like Cyber Essentials are important, as it shows we are a strong Singapore company that follows the rules and regulations,” he said.

Lessons from a phishing scam

Fairtrade coffee company Puro Coffee Singapore, which caters for corporate clients as well as food and beverage (F&B) outlets, also felt that having the certification helps to build confidence with its clients. 

The Belgium-based company entered into the Singapore market around 12 years ago and provides catering to offices and F&B establishments, said sales and marketing director Delphine Goh. 

Recently, the company also branched out to create a new brand called Corporate Coffee Solutions, which provides organisations with coffee machines, technical services and freshly roasted coffee beans. 

For Puro Coffee, cybersecurity rose in importance and significance after several employees fell prey to a phishing scam, said Goh. 

Following the breach of the company’s cybersecurity policy, Puro Coffee decided to find ways to adopt safer cyber hygiene practices and agreed to join the pilot testing of the certification programme. Before embarking on this programme, Goh said: “We used to have the same password for everything in the office and we did not change any of our hardware and software for the past 10 years.”

While going through the self-assessment checklist, she noted that the company had to change and rectify many of its weak practices for its cybersecurity to improve considerably. 

It onboarded a virtual private network, or VPN, on all laptops so employees could work from home securely and added safeguards to the company’s internal networks. Policies to ensure staff adhered to cybersecurity practices were also adopted. 

Over time, the overall cyber hygiene of Puro Coffee was improved. This includes better password management, the implementation of access control, as well as the adoption of the zero-trust policy that eliminates implicit trust and requires thorough verification. 

Goh said the certification has helped Puro Coffee to protect its own cyberspace from attacks and breaches of personal data. Since then, she said the risk of phishing scams, the poor management of passwords and other cyber risks are all under control. 

“The Cyber Essentials mark has helped us build confidence when we work with organisations, government agencies and institutions that require privacy and protection of their data,” she said. 

What is the Cyber Essentials mark? This is a 2-year certification offered to SMEs to acknowledge their implementation of good cyber hygiene practices. As some SMEs have limited information technology systems as well as limited cybersecurity expertise and resources, the certification programme aims to help these enterprises prioritise the essential practices needed to safeguard their systems and operations from cyber-attacks. 

How do SMEs obtain this certification?

Enterprises who apply are required to adopt all the cybersecurity practices in the self-assessment checklist provided by the Cyber Security Agency of Singapore. After implementing the necessary measures, the company will go through an assessment by an assessor from an appointed certification body to obtain the certification.

What are the practices that SMEs need to adopt?

To fulfill the self-assessment checklist, SMEs need to have the necessary systems to protect themselves from viruses and malware, to control access to their data and to have secure settings and passwords for their hardware and software.

They are required to have plans to update their data and software on a regular basis, back up essential data, and be ready to respond quickly to a cyber incident as well. Measures also include educating employees to know how to defend themselves from a cyber-attack; understand the different types of hardware and software being used; know where data is stored, and how to secure and protect the data.