10 minute read
ESET
from Cyber Security 2022
by 3S Media
THE SME’S
CYBER-DEFENCE STRATEGY
Advertisement
If you are an SME, your company faces many of the same security challenges as a large corporate – but without the same type of budget. Here’s how to prevent your small to medium business from falling victim to cybercrime.
When reading the news, it is easy to assume that hackers almost exclusively target large corporations. Of course, there is a reason why these attacks so often make the headline news – this is because, when they do occur, the resulting data breaches or ransom figures are so large that they cannot be ignored.
However, the fact is that SMEs are actually the more frequent targets. In fact, some reports indicate that more than 60% of all data breach victims are businesses with fewer than 1 000 employees.
It has also been estimated that more than half of SMEs go out of business within six months following a hack. This demonstrates that avoiding a breach by effectively securing your company against cybercrime has become a critical component to business success in the SME space.
Troubling statistics It goes without saying that most SMEs do not typically have the advanced threat detection and security infrastructure deployed in large businesses, which is something hackers are quite well aware of.
They understand that it is far easier to break into 10 businesses with almost no security than a single large and near-impenetrable company. While the payouts may be smaller, in the end, their final total will make such an effort well worth it.
Unfortunately, IT security solutions are often seen as an avoidable operating expense – much like insurance, they are often a grudge purchase – but this is only until something goes wrong.
ESET research indicates that 69% of SMEs either do not have sufficient security budget, enough in-house expertise or, in some cases, both. In fact, it highlights that 20% – one in five of these businesses – have no security at all. Furthermore, SME operations are often more relaxed, with less control over endpoint protections like employee passwords, which are the cause of 63% of data breaches.
Now, more than ever, with staff working remotely and digital connectivity at an all time high, small to medium businesses need to take meaningful measures to protect their data, activity and systems.
The solution
So what is the solution for organisations with large security demands, but small security budgets?
Installing the first (and, often, least expensive) anti-virus program you find is not enough. In today’s highly connected world, a robust, companywide cybersecurity policy is essential.
This policy should outline your organisation’s cybersecurity defence strategy, which should include what assets must be protected, the threats to those assets, and the security controls required to mitigate such threats.
Documenting these points ensures that you – and your business – approach cybersecurity comprehensively and efficiently.
Here are some important points to consider: • Security systems: Outline which controls are implemented and the threats they address, such as anti-virus software and firewalls.
These controls are essential and, today, there are many costeffective products on the market specifically designed for SMEs.
Include guidelines on how updates and patches will be applied, such as how regularly browsers and operating systems will be updated.
Software providers regularly release patches to fix identified vulnerabilities, and these should be implemented as soon as possible. • Training: A chain is only as strong as its weakest link and it can take just one mistake from an unassuming employee – whether an executive or an intern – for criminals to gain access to your systems. Your policy should outline how employees will be trained in identifying suspicious situations and protecting confidential data. It should also address what happens when an employee doesn’t follow protocol.
In most cases, staff error isn’t an isolated incident, but rather a sign that training isn’t adequate. • Remote access: Employees’ home connections are usually less secure than internal company networks.
As such, these employees should either be supplied with secure equipment and networks, or prevented from accessing sensitive company information. The solution will depend on the company’s unique situation. • Password requirements:
Weak passwords are one of the biggest security threats, so system-generated password requirements or password rules are essential. These should contain a combination of at least eight upper- and lower-case letters, numbers, and special characters. • Backups: Company data must be backed up regularly, and preferably encrypted with multifactor
verification access, so that work can continue if systems are compromised. With the groundwork of a carefully thought-out policy in place, it simply becomes a matter of adhering to and enforcing it. The pay-off is the peace of mind that – even though you may be small – your company’s assets, and the employees who rely on them, are as safe as they can possibly be.
Carey van Vlaanderen, CEO, ESET Southern Africa ESET research indicates that 69% of SMEs either do not have sufficient security budget, enough in-house expertise or, in some cases, both.”
www.eset.com
2022’S MOST DEMANDING IT ROLE
– THE REMOTE IT SECURITY EXPERT
With remote work more the norm than the exception in a post-Covid world, providing effective security under such circumstances has become – in a word – complex.
In a post-Covid world, ‘going to the office’ is not what it used to be – today, the phrase could just as likely mean home or a coffee shop as it might the more traditional office space. It could even be a combination of all of the above.
This has made managing devices more complicated because, for many of today’s workforce, the line between home devices and office devices itself is blurred. Unfortunately, most people lean more towards efficiency than security.
Typically, in an office-based environment, IT administrators can manage the hardware and software on the network more closely, while the hybrid-work scenario changes all of that. This makes limiting the use of devices to a single network and protecting them far more complex.
The challenge is compounded by the growing threat of cybercrime. The global ESET Threat Report for the first half of 2021 showed a rise in threats targeting remote workers. And as employees blend remote work with office time, these threats are set to increase.
Unfortunately, the reality is that the more time employees spend out in the field on potentially unsafe public Wi-Fi networks, the higher the potential risk of becoming a victim of cybercrime. And, with almost 60% of SMEs stating they’d not be able to recover from the financial impact of a data breach, these risks canbe ill afforded in today’s challenging operating environment.
Businesses thus need to ensure that employees enjoy the same level of protection, whether they’re using their devices at home or through any other connection – even their mobile devices.
Smarter protection ESET’s consumer offering, which includes the ESET Smart Security Premium product, boasts a host of new features and improved protection across devices, including mobile phones.
At the forefront is LiveGuard, which provides an additional proactive layer of protection against new and unknown threats cropping up in the landscape. LiveGuard employs technology initially built for businesses to safeguard their diverse networks from both known and never-beforeseen types of threats. In essence, you could call it enterprisegrade security for regular users. A cloud sandbox pulls suspicious files – whether downloaded by web browsers, email services like Microsoft Outlook and Mozilla Thunderbird, or extracted from archives or USB drives – to a secure cloud platform for analysis first. This virtually eliminates the chance of infecting the device and those on the network it connects to, and allows for safe migration between networks whether at home, the office, or anywhere in-between.
Equally threatening is malware and ransomware – for good reason. Ransomware attacks continue to evolve to catch unsuspecting users. LiveGuard protects against these sorts of threats regardless of the ‘gift wrapping’ they come in.
This offers the person in the business with the most demanding role – the corporate IT security expert – a perfectfit solution that significantly lowers the risk of your employees unintentionally introducing malware or other threats into the business network simply because of their need to work remotely.
Steve Flynn, director: Sales and Marketing, ESET Southern Africa
KNOW THY ENEMY
When it comes to combating the increasing scourge of cybercrime, understanding the world of cyber-threats is the first step to defending against attacks.
When no lesser government department than that of Justice and Constitutional Development became the target of a ransomware attack in September 2021, it took a month to simply restore most – although not all – of its systems.
The news of this attack and its impact made many executives and business owners understandably stressed and left them wondering whether their businesses would survive a non-operational month. Of course, most executives and business owners are not necessarily IT or security experts, which is why it is important for them to realise that only by better understanding the world of cybercrime can they mitigate such threats to their own organisation.
Understand the basics Some of the major, and most common, cybercrime threats to businesses include: • Phishing: Criminals impersonate a legitimate source, usually requesting sensitive information such as passwords, with the aim of stealing money or important data, or gaining access to computer systems. • Whaling: A type of phishing where criminals masquerade as executives at an organisation and target other senior individuals. Criminals might, for example, send an email posing as the CEO, requesting payroll information. • Malware: This malicious software infiltrates a device without authorised access. While malware doesn’t cause damage to hardware, it can steal, delete and hijack data or spy on activities without users knowing. • Ransomware: A type of malware that can lock a device or encrypt its contents, preventing users from accessing files in order to extort money. • Trojan horse: Another form of malware disguised as legitimate software to gain the victim’s trust. Once installed, cybercriminals can steal, delete, block, copy or modify sensitive data. • Adware: These pop-up advertisements can harm a device by slowing it down, hijacking the browser, or installing viruses and/or spyware. • Spyware: Software that infiltrates a computer with the aim of discovering personal information such as credit card and banking details. Stay up to date Cybercrime is a sophisticated, lucrative trade and criminals are constantly creating new threats and finding undiscovered loopholes to launch their attacks.
ESET’s T2 2021 Threat Report, released in October 2021, highlights several concerning trends, including increasingly aggressive ransomware tactics and deceptive phishing campaigns.
Ransomware saw the largest ransom demands to date. A supply-chain attack leveraging a vulnerability in the Kaseya VSA IT management software had a US$70 million (R1.05 billion) ultimatum – the heftiest known ransom demand so far. Password-guessing attacks – also called brute-force attacks – which often serve as a gateway for ransomware, also increased. Between May and August 2021, ESET detected 55 billion new attacks (up 104% compared to T1 2021).
Of course, any threat protection should now extend beyond your office walls too, as employees settle into a hybrid model of in-office and remote work. The work-fromhome model has amplified the risks that cybersecurity poses to businesses of all sizes. Employees linking to public Wi-Fi in coffee shops and other ‘open’ networks, while looking for connectivity to work remotely, have exposed even the most secure businesses to increased risk.
Therefore, in order to stay ahead of digital crime, it is crucial to remain up to date on the latest tactics and ensure that your organisation is protected against them, and that employees have adequate training in recognising and avoiding threats.
Never mind not being able to operate for a month or more due to a breach, being held to ransom is not something any business can afford.
Philosophers believe that the greatest victory is that which requires no battle – using ESET will prepare any business to succeed in the ever-evolving war against cybercrime.
