SMEs are genuinely concerned about cyber security, as the threats continue to escalate and the technology becomes more complex. One in two (50 per cent) of Australian SME leaders consider cyber security a significant risk –and that is sapping energy away from seizing positive opportunities for digital growth and general business health.
Worryingly, statistics also show that SMEs are underprepared for cyber risks. 4 in 10 SMEs have little to no confidence in their ability to respond to a cyber threat, according to research earlier this year from The Council of Small Business Organisations (COSBOA). Given that 88 per cent of all data breaches are caused by employee mistake, this puts SMEs at high risk.
Meanwhile, data from the Australian Signals Directorate suggests that a single data breach costs a SMEs around $46,000. These are costs that are substantial enough to be business-ending.
So it’s understandable that SMEs with the limited resources that they have can become extremely risk-averse with embracing the digital opportunity. However that, of course, costs them the opportunity to innovate.
In practice, cyber risk doesn’t need to lead to decision paralysis and risk aversion for SMEs. What is important is that they understand that they don’t need to have a perfect knowledge with regards to cyber, but rather that they should start with user awareness and closing the easily-discovered gaps with strong passwords and multi-factor authentication.
From there, as the business scales what it is doing online and the innovation it is adopting, it can consult partners to understand the more sophisticated cyber security challenges.
Here are seven steps that are cost-effective in implementation and can give SMEs the confidence that they need that their IT environment is protected enough that they can embrace innovation:
1. Establish a Documented Cyber Security Policy
A well-documented cyber security policy is the foundation of any defence strategy. It should outline acceptable use of company resources, password management, and incident reporting procedures. It’s also important to ensure that all employees are aware of and understand these policies.
2. Educate Your Employees
Regular training sessions can help employees recognise phishing attempts, manage passwords effectively, and understand the importance of protecting sensitive data. Think of it like the fire drill, in that everyone is safer if everyone knows the process. This “human firewall” of highly aware employees that know how to identify, flag, and manage suspicious content is going to immediately reduce the risk exposure for the overall business.
3. Keep Your Technology Updated
Ensure that all software and systems are regularly updated. This includes installing security patches and conducting routine scans to detect and mitigate vulnerabilities.
4. Implement Multi-Factor Authentication (MFA)
MFA adds an extra layer of security by requiring users to provide two or more verification factors to gain access to a resource, making it harder for attackers to breach systems.
5. Prioritise Data Encryption
Encrypt sensitive data both at rest and in transit. This can be achieved through technologies such as VPNs. This ensures that even if data is intercepted, it remains unreadable without the proper decryption keys.
6. Outsource to Managed Service Providers (MSPs)
As the saying goes – you don’t know what you don’t know, and for many SMEs this is where a lot of the fear comes from. Rather than recruit an entire security team (or add to already strained IT personnel) to bring that knowledge into the organisation, the right managed services provider can fill that role.
7. Create Strong Backup and Business Continuity Plans
Finally, regular backups and a solid business continuity plan can help ensure that your business can quickly recover from a cyber incident with minimal disruption. Cyber attacks will happen. A lot of the costs involved with them comes down to lost data or systems that can’t be recovered. This is your best option for recovering from ransomware attacks.
The perception is that “perfect” cyber security is only possible with enterprise resources. In reality, for SMEs the problem is less to do with resources and more a lack of understanding and procedure. With that in place, there’s no reason that SMEs cannot embrace the same digital opportunity that larger companies can.
