A guide to cybersecurity for SMBs

Myth: “I want to focus on growth right now”

Fact: Good cybersecurity practices helps to power growth

Cybersecurity doesn’t have to be disruptive to your business practices, in fact implementing security basics can be done without any impact to your operations.

Two key defense tools are penetration testing and VA scanning. Both are low-touch and are carried out by a third party provider, meaning there’s no impact to your business activities. Likewise, training your staff is a basic but highly effective tool to securing your business, and only takes a few hours.

It’s also important to note that cybersecurity can actually help power your growth. It helps build your reputation amongst customers and suppliers through increased credibility. Consumers are increasingly aware of the importance of cybersecurity thanks to the GDPR and headline-hitting breaches which is a key reason for making cybersecurity a priority for your SMB business.

Myth: “I don’t have budget for this – my revenue is down right now”

Fact: Cybersecurity is accessible for all businesses, even start-ups

Despite the benefits of good cybersecurity and the risks of ignoring it, our consultants regularly hear that budget is the biggest concern for SMBs. But key cybersecurity measures don’t have to be extortionate. Even on the Essentials package of Defense.com™, you can pay as little as £60 per month for a host of security tools, including VA scanning, staff training and a Cyber Eessentials.

VA scans can make a huge impact on your security posture by quickly identifying your security weaknesses before a hacker does. Training your staff is also a great secret weapon to have as your best defense against cyber threats is your staff. Staff that are proactively aware of security risks helps you to prevent most opportunistic attacks.

SMB businesses can also certify with the Government-backed security standard, Cyber Essentials, as part of their Defense.com™ package. The certification covers 5 fundamental security controls that apply to businesses of any size.

Myth: “It doesn’t matter if I’m breached because I’m insured”

Fact: Cyber insurance is no substitute for strong cyber defenses

Insurance isn’t an excuse for not having security measures in place. Particularly as it’s unlikely that your insurance would reimburse the entire cost of a cyber breach. A pay out of any kind isn’t ever guaranteed either, there are instances where insurance providers haven’t actually paid out at all. The NCSC advises that insurance companies don’t pay out for “monies lost through business email compromise fraud”. Which you guessed it, is a clear description of the biggest form of cyberattack, phishing emails.

So although insurance might help you out with a small data breach, do you really want to spend your time and resources remediating the breach, not to mention any potential reputational damage. 33% of businesses have lost customers following a breach. So preventing the breach in the first place is better than counting on insurance to fix it, surely?

Myth: “Cybersecurity seems so complicated”

Fact: Getting started with security basics is simple enough

It’s actually simpler for SMBs to put cyber defenses in place because of their smaller infrastructure. For instance, increased use of cloud services, no legacy systems and fewer employees, means adopting security measures is far less complex than it would be for a large enterprise.

Cybersecurity basics, such as a penetration test, don’t have to be complicated either. They are a great way to give you a clear overview of your security position and prevent malicious cyberattacks. For instance, the British Airways and easyJet breaches in 2020 that lead to multi-million pound fines could have been avoided with a penetration test.

Why SMBs can’t ignore cybersecurity

There are various forms of cyber threats that could easily wreak havoc for an SMB. Such as phishing emails, DDoS attacks, malware and ransomware. So putting it simply, if you haven’t got basic cybersecurity measures in place, then it’s not a case of ‘if’ you get breached, it’s down to when.

Plus, as we’ve covered already in this guide, the costs of a breach far outweigh the costs of putting basic security measures in place. Aside from the headline grabbing fines such as those for BA and easyJet, the ICO regularly fines both SMBs and enterprises alike for breaches involving personal data. And don’t forget a breach goes beyond financial repercussions. It can also devastate your reputation and lose you business. Not to mention the possibility of having to close off parts of your business thanks to the disruption and investigation efforts. 57% of businesses who were hit by a ransomware attack didn’t have a business left to salvage, so post-breach havoc isn’t always temporary either.