Earlier this week I put a post on LinkedIn talking about why SMEs don’t take cyber security as seriously as they should and often just pay lip service to it.  I said I’d elaborate on that in the next newsletter.  Well, here it is.

When Cyber Security hits the news, and thus our consciousness, it’s nearly always in terms of breaches, regulatory fines, and business disasters, and nearly always concerning a major household name.  We don’t talk about the benefits that it can bring, particularly these days when businesses of all sizes are looking to drive efficiency through digitising their admin and operations.  Cyber-attacks on British businesses are increasing year on year.  When it comes to cybercrime, small and medium-size businesses are not exempt from the disruption that impacts large organisations. If anything, their size can make them more vulnerable as they are perceived as a softer target.

So why SMEs tend to underestimate the chances of being on the receiving end, and often play that down, is something of a mystery.  As is the mindset that it’s an IT matter, not a business matter, when nothing could be further from the truth.  Cyber security must be owned by the business owner or board and driven top down.  It cannot be left to an IT manager, or worse, a company under contract to provide IT services.

Let’s think for a moment about one potential aspect, supply chain security.  Many SMEs sit in a supply chain for a major company or companies.  In fact, for many it’s a critical part of their business, without which they could be in real trouble.  Their customer will spend money and commit resources to their own security and I’m willing to bet that somewhere in their contract with their suppliers, there will be a stipulation laying down some cyber security standards as a minimum that they must adhere to, which I’m also willing to bet that unless audited, are rarely being met.

Large organisations rely on a network of SMEs. If they operate within the EU, they are subject to the EU General Data Protection Regulation (GDPR) and if they operate only with the UK, then they are required to be in line with what has become known as UK GDPR.  The two are very similar indeed. Under both, data controllers (those that collect the data) are responsible for their own compliance as well as that of any third-party processors. Lax compliance in implementing regulations has in fact created a unique opportunity for those SMEs that make the effort to invest in cyber security. With so many damaging data breaches, large organisations are now starting to examine the security practices of any potential third party and seeking agreement with partners to ensure that secure systems are in place. It is the responsibility of the data controller to ensure that third parties within its supply chain take appropriate technical and organisational measures equal to their own.

The UK Government-backed framework Cyber Essentials Plus provides SMEs with a way to demonstrate their security credentials. By gaining Cyber Essentials Plus certification, SMEs can demonstrate that their cyber security has been verified and audited by independent experts. Auditable proof is often requested during tender bids as part of the warrants and liabilities process. Being Cyber Essentials Plus certified can leapfrog a business ahead of the competition.

Supply chains are only as strong as their weakest link and therefore require standardisation in terms of security across the whole chain. SMEs able to prove their cyber security credentials can differentiate themselves from the crowd and maximise on lucrative business opportunities. Some 65% of UK small businesses have no plans in place to deal with potential supply chain disruption, including cybercrime. Ensure your company isn’t one of them by staying ahead of the game – don’t lose business due to supply chain weaknesses.

I’ve already said that the main challenges that I come across is that SMEs do not accept that this is a business issue and continue to see it as an IT Issue.  Consider this; if an attack, say Ransomware, hits the business, who suffers?  Is it the IT department and/or the IT Support company you have under contract to supply your IT/Network?  Or is it the business that takes both a financial hit and reputational damage, perhaps losing contracts from the larger businesses they have been supplying?  You know the answer.  You can outsource your IT, but not your responsibility.

Let’s examine what stops SMEs from taking the view that it is in fact a business issue.  My experience of working with SMEs is that the two main issues are budget and resource, both of which are closely entwined.

SMEs do not budget for Cyber security.  They conflate this with their costs for IT support and will expect their IT support company to provide an adequate level of security within the services and products they supply.  I’ve talked before about this.  Most, if not all, of these companies are what is known as Value Added Resellers, or VARs.  What this means is that they sell other people’s products, firewalls, anti-virus etc. And of course, they push those products, ie the flavours of those products they sell, onto their clients.  The value added bit comes in the services they provide.  In terms of security that generally, although not always, means that their skill set is in the configuration and maintenance of the products they sell.

I’m not knocking that, it’s a perfectly acceptable business plan and has been around for as long as IT has been around.  But from a security perspective, it ignores the basics.  Whilst technology has come on in leaps and bounds, making it sometimes a nightmare to keep up with, the basic principles of security have never changed.  It is built on three towers, People, Process and then Technology.  If you haven’t got the right training and awareness in place, if your processes and policies aren’t sound, up to date and rolled out across the business, then all the technology in the world won’t protect you.  Risk management is crucial.  Understanding the threats to your business and how vulnerable you are to those threats, married to your assets (which aren’t confined to hardware and software), will inform you of the risks you face, in turn allowing you to focus your limited spend on the weakest areas first.

How you arrive at those risks brings us to the second point, resource.  It’s not just SMEs that don’t have the resource, but their IT support company rarely does either.  Cyber security professionals are expensive and very thin on the ground.  Perhaps buying in an advisor for a defined period every month, or on a retainer to be called off as and when required, is the way to go.

Another key plank is innovation.  Finding innovative solutions that SMEs can be sure are appropriate for their business, mitigating identified risks.  Of course, such innovations have also got to be affordable.  This is one of the reasons why many are adopting cloud services, not necessarily for security reasons, but for cost reasons ie no expensive infrastructure to buy in and maintain.  It’s also a reason why many security solutions these days are Software as a Service, SaaS, as again, no expensive infrastructure.

In summary, what I’m saying is that SMEs have to:

• Accept cyber security as a business, not an IT issue.
• Have a senior manager or preferably, board member, take responsibility for it.
• Have an adequate budget. Of course, that will be subject to what you can afford.  Take advice on what is important and what can wait.  It just might save you a lot of time, money, and angst.
• Have a defined strategy for improving your security stance, perhaps phased over budgetary periods.
• Consider a standard such as Cyber Essentials or, for the larger SME, perhaps even ISO2700x.