Organizations in the UK with 250 employees or less need a solid understanding of the attack potential, methods used, and how to prepare.
The UK has faced its share of data breaches resulting from cyber attack – companies like Fortnum & Mason and Dixons Carphone have been in recent headlines. According to Hiscox, the average UK SME under 249 employees spends £25K annually to address cyber security incidents, while the average SME above 250 spends £351K annually! In either case, the amounts are material to the organization’s bottom line.
With 73% of UK businesses considering themselves “cyber novices”, the vast majority of UK SMEs are unprepared for current wave of threats facing businesses worldwide.
So, what should UK SME’s focus on:
- Get Educated on Attacks – Phishing scams, malware attacks, ransomware, cryptojacking, and more all top the list of attack vectors. Understanding how cybercriminals go about attacking organizations, gaining access, and carrying out their malicious actions provides context when determining a proper security plan.
- Plan a Layered Defense – At a minimum, your plan should provide coverage at the (logical) perimeter, the endpoint, and the user. Email gateways, multi-factor authentication, AV, endpoint protection, and security awareness training should all be a part of the defense strategy.
- Include DR in the Discussion – As part of a cyberattack, data, systems, and credentials are all leveraged, modified, encrypted, or stolen (all depending on the attack specifics). Having backups of critical data, applications, and systems is imperative to get the business back into a state of known-good operation – this from both a security and productivity perspective.
- Test Everything – You can’t put everything in place and just assume it’s all going to work. Your defense can be tested with penetration tests and malware simulators, users with phishing testing, and recovery of critical systems and data using cloud-based resources. There’s no excuse not to know if what you plan will actuall work.
While this article focuses on UK businesses, the same principles apply to every part of the globe. If you are a small or medium enterprise who considers themselves a “novice” when it comes to cyber attacks, consider the 4 steps above as a high-level plan to begin walking down a path to a better cyber security posture.
