Cybercrime is making headlines. However, it is not only large companies that are increasingly being targeted, but also SMEs. The phenomenon can no longer be ignored. A pragmatic analysis is called for: What is the trend? What attacks can be expected? What countermeasures are available? And who can help? SMEs urgently need answers, because many are simply not “cyber-ready”.
Presentation “State of Security 2016 – Focus on medium-sized companies”
What SMEs need to consider in the fight against hackers and cybercrime in order to remain cyber-ready and secure their place in the procurement business.
The headlines about spectacular cyber incidents are becoming more frequent. The attacks are also becoming increasingly professional. According to the Cisco Annual Security Report 2016, even managers are losing confidence in their own IT security. In general, the attack surfaces are becoming larger and more complex. Hackers are finding their operational targets in networks, applications and, last but not least, at the human level.
The attack surfaces are growing
At the network level, the increasing use of Wi-Fi, new protocols such as Internet Protocol Version 6 (IPv6) and the rapidly emerging Internet of Things (IoT) are expanding the attack surface. In terms of applications, it is the increasing number of web and mobile apps, including those from the cloud, and shorter development cycles. Humans, on the other hand, are becoming a target due to the rapidly growing use of social media and the ever-increasing integration of mobile devices.
It’s not just the big ones who get caught
The idea that only large companies make worthwhile cybercrime targets has long been refuted. SMEs are definitely on the radar of hackers. This trend is also confirmed by official sources, such as the Reporting and Analysis Center for Information Assurance (MELANI) and the Swiss Coordination Unit for Combating Cybercrime (CYCO). The latter states unequivocally in its latest annual report: “Small and medium-sized companies are also increasingly being targeted by fraudsters.”
Coveted “crown jewels”
SMEs are generally considered to be more innovative than larger companies. Among medium-sized companies in particular, there are many that have successfully and highly innovatively found their niche and have their own “crown jewels”, i.e. key assets. These “hidden champions” store their business secrets in-house more often than average. They also often have many distributed locations, but have fewer resources at their disposal to protect their IT.
Hackers not only attack medium-sized companies to get their crown jewels, but also use these companies as a springboard. Cyber criminals like to target companies that represent the weakest link in the business ecosystem. As part of a supply chain, those with weak security become a gateway into larger companies.
Large companies are now increasingly demanding that their suppliers be “cyber-ready”. Those who do not recognize cyber security as business-critical risk being excluded from the procurement business or tenders in the future. But what specific threats are SMEs actually facing today?
Typical forms of attack
The term attack vector has become established as a term for attack methods and techniques. Spear phishing is one of the most commonly used attack vectors. Unlike untargeted phishing (mass) mailings, spear phishing attacks are focused on specific target persons.
Another popular attack vector targets so-called unpatched systems. Patches are correction deliveries that close security gaps or fix errors. In 2014, around 97% of attacks targeted security vulnerabilities in widely used standard software.
Malware toolkits are also a feared phenomenon. These are software packages that automate the attack process and, among other things, identify weaknesses in target systems, distribute malware and install backdoors for system control.
The classic attack vectors include weak passwords, e.g. very short passwords that only use alphanumeric characters.
Weak web applications are also becoming increasingly important as a gateway. Hackers scan web apps for known vulnerabilities and install backdoors for later break-ins as well as malware and control software.
Protect and be protected
Protection considerations start with identifying the really important business processes, data and systems that are worth protecting and reviewing the security measures already in place. The attack surface can be reduced by updating systems, reducing authorizations and strengthening passwords. Overall, it is important to update the security system and compare it with the security tools available today and those on the horizon.
As the threats in cyberspace are constantly and rapidly changing, many companies do not want to rely solely on their own measures. According to the KPMG study “Clarity on Cyber Security“, 95% of the Swiss companies surveyed stated that they were unable to defend themselves against the increasing cyber threats alone. The study “Cyberreadiness in small and medium-sized enterprises” from Germany, which recommends “finding a good partner who takes the issue of security seriously and competently”, is along the same lines.
It is therefore not surprising that SMEs are increasingly turning to a Managed Security Services Provider (MSSP), which has the relevant expertise and personnel. Among other things, the MSSP option offers network security services such as 24/7 monitoring and incident management, i.e. responses to detected or suspected security incidents and malfunctions. The MSSP option relieves the burden on in-house IT staff, closes gaps in the security system and sets the course for “cyber-ready”.
Presentation “State of Security 2016 – Focus on medium-sized companies”
What’s next? Get to know the 5 top attack vectors in 2016 and find out what SMEs need to consider in the fight against hackers and cyber criminals in order to remain cyber-ready and secure their place in the procurement business based on the latest facts and trends.