Finding the Right Balance: Cybersecurity Challenges for SMBs

Cybersecurity Challenges for SMBs: Navigating Complexity and Building Resilience

The Growing Threat Landscape

Small and midsize businesses (SMBs) are increasingly becoming targets of cyberattacks. The evolving threat landscape poses significant challenges for these organizations, which often struggle with limited resources and knowledge about managing cybersecurity risks effectively.

During the recent Cybersecurity for SMBs Roundtable hosted by Sage, a group of CISOs and cybersecurity professionals discussed the major concerns faced by SMBs in securing their company assets. Several key challenges were highlighted:

The Human Factor

One of the prominent challenges faced by SMBs is the human factor. Employees often make mistakes that put company networks at risk, such as clicking on phishing emails or allowing unprotected access to their devices.

Third-Party Compliance Needs

SMBs face increasing demands from partner organizations, vendors, contractors, and other third-party entities to meet cybersecurity requirements. This is particularly true for highly regulated industries like financial institutions.

Data Privacy Laws and Compliance

Complying with data privacy laws across various states and countries presents a significant challenge for SMBs. Failure to meet compliance requirements can result in sanctions and fines.

The Hybrid Workforce

The shift to remote work has created challenges for SMBs in ensuring the same level of oversight over devices and online behaviors. This lack of control increases the vulnerability of company networks to cyber threats.

Targeted Platforms and Industries

Threat actors specifically target organizations that use applications designed to raise money or collect large amounts of personal information. SMBs operating in these sectors are at heightened risk.

Changing Threat Landscape

The threat landscape is constantly evolving, with new attack vectors, malware, and threat actors emerging every day. SMBs must stay updated and adapt their cybersecurity measures accordingly.

A recent study by Sage revealed that nearly half of SMBs have experienced a cybersecurity incident in the past year. While 69% of respondents worldwide claim that cybersecurity is part of their company culture, only 1 in 4 respondents say their company regularly discusses cybersecurity.

The Cost of Cybersecurity

Cybersecurity measures can be expensive, particularly for SMBs that have limited financial resources. Many SMBs lack the appropriate systems and tools for effective network protection. For example, the study found that 46% of SMBs do not use firewalls and 19% rely solely on basic cybersecurity tools.

However, cybersecurity does not have to be prohibitively expensive. SMBs can adopt affordable or even free approaches to enhance their security measures. A starting point is to establish an insider risk program that oversees security policies across the company, focusing on employee behavior.

Shawnee Delaney, CEO at Vaillance Group, emphasized the importance of having conversations with employees about cybersecurity, even if some discussions may be uncomfortable. The majority of cyber incidents are unintentional and can be prevented through proper employee training and awareness.

Managing the employment lifecycle is crucial to an effective cybersecurity system. From the interview and hiring process to onboarding and offboarding, SMBs should ensure that employees understand how cybersecurity fits into the organizational structure. Basic security hygiene, such as least privilege access, should be emphasized during onboarding, and access must be completely disconnected when an employee leaves the organization.

Individualized Security Training

Given the human connection to cybersecurity, it is crucial that everyone in an SMB has a basic understanding of potential threats. Security awareness training should be individualized based on factors like job function and generational gaps in tech savviness.

SMBs should avoid one-size-fits-all training options, as different employees have different learning styles and relationships with technology. Tailoring training programs based on these factors ensures more effective and impactful cybersecurity education.

Making Cybersecurity a Business Issue

One common misconception among SMBs is that cybersecurity is solely an IT problem. It is essential to shift the perspective and recognize cybersecurity as a business issue. Security culture should be driven from the top, with management actively discussing cyber threats and their potential impact on the organization.

Gustavo Zeidan, Sage’s CISO, emphasized the significance of business leaders openly acknowledging cybersecurity as a problem and actively engaging in discussions about it. Proactive discussions and preparedness are essential to avoid disruptions caused by security incidents.

When a cyber incident occurs, transparency is key. The Federal Trade Commission (FTC) provides guidelines on whom to contact, including law enforcement, customers, and vendors. However, SMBs should go beyond these guidelines and share their experiences and lessons learned with other businesses. Through open and honest communication, organizations can collectively strengthen their cybersecurity practices and contribute to national security.

Knowing Where to Go for Help

Every company, regardless of its size, requires more cybersecurity expertise than it possesses internally. SMBs should seek resources and guidance to navigate their security journey effectively.

The Cybersecurity & Infrastructure Security Agency (CISA) offers a range of resources, including an SMB cybersecurity guide tailored to small business environments. CISA emphasizes the importance of partnerships with businesses of all sizes and types, as collective efforts are crucial in tackling the ever-changing threat landscape.

Shawnee Delaney highlighted the availability of mitigation techniques for SMBs and stressed the importance of finding the right program that suits their individual needs. It is crucial for SMBs to invest in cybersecurity measures that align with their specific requirements and capabilities.

Conclusion

SMBs face significant challenges in securing their company assets in an evolving threat landscape. The human factor, compliance needs, data privacy laws, the shift to remote work, targeted attacks, and the ever-changing threat landscape contribute to the complexity of cybersecurity for SMBs.

However, affordable and effective solutions are available. SMBs should prioritize conversations about cybersecurity, create insider risk programs, and individualize security training. They should also recognize cybersecurity as a business issue and openly share their experiences and lessons learned to improve collective security.

SMBs can leverage available resources, such as the SMB cybersecurity guide from CISA. By investing in suitable cybersecurity measures and seeking guidance, SMBs can navigate the challenges and build resilience in the face of cyber threats.