Phishing most common Cyber Incident faced by SMEs

The European Union Agency for Cybersecurity identifies the cybersecurity challenges SMEs face today and issues recommendations.

Small and medium-sized enterprises (SMEs) are considered to be the backbone of Europe's economy. 25 millions of SMEs are active today in the European Union and employ more than 100 million workers.

The report Cybersecurity for SMEs ENISA issues today provides advice for SMEs to successfully cope with cybersecurity challenges, particularly those resulting from the COVID-19 pandemic. With the current crisis, traditional businesses had to resort to technologies such as QR codes or contactless payments they had never used before. Although SMEs have turned to such new technologies to maintain their business, they often failed to increase their security in relation to these new systems. Research and real-life experience show that well prepared organisations deal with cyber incidents in a much more efficient way than those failing to plan or lacking the capabilities they need to address cyber threats correctly.

In addition to the report, ENISA also publishes today the Cybersecurity Guide for SMEs: “12 steps to securing your business”. The short cybersecurity guide provides SMEs with practical high-level actions to better secure their systems, hence their businesses.

Based on an extended desktop research, an extensive survey and targeted interviews, the report identifies those pre-existing cybersecurity challenges worsened by the impact of the pandemic crisis.

Key findings

85% of the SMEs surveyed agree that cybersecurity issues would have a serious detrimental impact on their businesses with 57% saying they would most likely go out of business. Out of almost 250 SMEs surveyed, 36% reported that they had experienced an incident in the last 5 years. Nonetheless, cyberattacks are still not considered as a major risk for a large number of SMEs and a belief remains that cyber incidents are only targeting larger organisations.

However, the study reveals that phishing attacks are among the most common cyber incidents SMEs are likely to be exposed to, in addition to ransomware attacks, stolen laptops, and Chief Executive Officer (CEO) frauds. For instance, with the concerns induced by the pandemic, cyber criminals seek to compromise accounts using phishing emails with Covid-19 as a subject. CEO frauds are other decoys meant to lure an employee into acting upon the instructions of a fraudulent email displayed as if sent from their CEO, and usually requesting a payment to be performed in urgency under business-like circumstances.

The report unveils the following challenges SMEs are faced with:
- Low awareness of cyber threats;
- Inadequate protection for critical and sensitive information;
- Lack of budget to cover costs incurred for implementing cybersecurity measures;
- Availability of ICT cybersecurity expertise and personnel;
- Absence of suitable guidelines tailored to the SMEs sector;Moving online;
- Low management support.

How to address those challenges?

The recommendations issued fall into three categories:

People
People play an essential role in the cybersecurity ecosystem. The report draws attention to the importance of responsibility, employee buy-in and awareness, cybersecurity training and cybersecurity policies as well as third party management in relation to confidential and/or sensitive information.

Processes
Monitoring internal business processes include performing audits, incident planning and response, passwords, software patches and data protection.

Technical
At the technical level, a number of aspects should be considered in relation to network security, anti-virus, encryption, security monitoring, physical security and the securing of backups.

Target audience

The report intends to deliver actionable guidance to the owners and employees of SMEs. In addition, this work can be of use to other entities involved in the SME ecosystem, such as SMEs national and European associations, policymakers and implementers, SME ICT providers and others.

More informationon https://www.enisa.europa.eu/publications/cybersecurity-guide-for-smes

#Enisa #cybersecurity #sme #yokdata #mindyourdata