5 questions for SMBs to reveal hidden security threats
Headline-making mass outages—think 2024’s CrowdStrike event and 2023’s Google Cloud services disruptions—can bring multinational corporations and small businesses to their knees. But smaller technical events are far more common and can shut down business functions with equally devastating effects.
Cybersecurity attacks like Change Healthcare and Snowflake data breaches that impacted millions wreak even greater havoc, especially for small- and mid-sized businesses (SMBs) that rarely have strong protections in place to fend off potentially business-ending attacks.
Security and cybersecurity threats are inevitable in today’s high-risk security environment, and they don’t discriminate by company size, industry, or geographic footprint. This is why every business needs to plan to evaluate its network and security status to identify and address areas of weakness.
For SMBs, this may seem like a financially and technically infeasible expectation. It doesn’t have to be. Properly focused self-audits can reveal vulnerabilities, many of which can be corrected without blowing up the IT budget.
CEO, CTI Technical Services.
Today’s High-Risk Landscape
The 2024 Observability Forecast from New Relic found that the median number of annual outages among respondents was 232, with more than half experiencing weekly low-impact disruptions. IT teams spend 30% of their time, equivalent to 12 hours per 40-hour workweek, addressing interruptions ranging from network failures and third-party service issues to human error. For high-impact outages like Crowdstrike, the median annual downtime is 77 hours and carries an hourly cost of up to $1.9 million.
Cyberattacks are also surging, with SMBs an increasingly favorite target. According to The State of SMB Cybersecurity in 2024, 94% of SMBs reported suffering from at least one cyberattack, and 89% are concerned they will be targeted within six months. Moreover, The State of IT Security in SMBs in 2023-2024 found that the average monetary cost of a cyberattack can range from $120,000 to $1.24 million per strike—a cost from which many don’t recover as 60% of SMBs fail just six months after an incident.
While 90% indicated that cybersecurity is very important or critical to their business, more than three-quarters of Observability Forecast respondents (76%) also agree that their organization lacks the in-house skills to deal with an attack properly. Further, just 8% of SMBs with fewer than 50 employees have a dedicated cybersecurity budget. Most typically spend less than $500 annually on cybersecurity, and 72% lack necessary insurance coverage, leaving them highly vulnerable.
These numbers tell the story of a high-risk environment where no SMB is safe from outages and attacks. As such, the lack of investment in protection is an oversight that can have business-ending repercussions.
Taking Proactive Measures
There are steps SMBs can take to mitigate their risk, starting with a self-assessment to determine areas of vulnerability. No IT expertise is required. Just responses to a handful of questions in the following five areas:
Staff training: is your team trained in cybersecurity best practices, including recognizing phishing attempts and the need for strong passwords, and is this training updated regularly?
Security safeguards: Are security measures in place that minimize human errors (e.g., email filters, browsing restrictions, multi-factor authentication, etc.), particularly around personally identifiable information (PII) access? Are they kept current?
Software patches and updates: Are procedures in place for patch management to apply the latest updates to software and systems, to protect against emerging threats and harden existing vulnerabilities? Are they followed?
Vendor security profiles: Do vendors, partners, and any other entity that may access the company’s systems have proper cybersecurity and security protocols to prevent a breach on their end from impacting your operations?
Business continuity: Is a business recovery and continuity plan in place to get operations back up and running after a breach? Is it regularly reviewed and updated? Are staff aware of the plan and trained in its deployment?
This information will help determine if broader protections are required and if engaging an IT service provider is warranted. If it is, look for a provider with security and cybersecurity experience that offers, at minimum, proactive monitoring, regular security assessments, and staff training.
Prospective partners should also deeply understand industry-specific compliance requirements and offer comprehensive services to ensure any issue can be addressed—a feature made more critical by the rapid pace at which threats evolve. They should also have advanced technological expertise and the willingness and ability to leverage cutting-edge tools and processes capable of outperforming older or less adaptive technology.
SMBs should also look for an IT partner that offers personalized customer support, emphasizes long-term relationships, and provides flexibility and scale in its service approach. Transparent price structures, clear and fair service terms, and simple contracts are also helpful.
Finally, during the evaluation process, ask prospects about their response times and disaster recovery capabilities and obtain and check references.
An Investment in Longevity
Determining security and cybersecurity gaps and establishing protocols to close them need not break the bank but must be a budget priority. Much of the work can be done via an internal audit, even with limited technical know-how.
In cases where audits reveal deeper issues than can be handled internally, customer-forward IT partners can apply experience, skills, and flexibility to resolve problems and harden systems within the organization’s budget to lower its risk profile and help ensure longevity.
We’ve rated the best endpoint protection software.
This article was produced as part of TechRadarPro’s Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro
Headline-making mass outages—think 2024’s CrowdStrike event and 2023’s Google Cloud services disruptions—can bring multinational corporations and small businesses to their knees. But smaller technical events are far more common and can shut down business functions with equally devastating effects. Cybersecurity attacks like Change Healthcare and Snowflake data breaches that impacted…
