Cybersecurity Trends for SMBs: Mobile, Security and the Cloud

Friday, April 10, 2015

Paul Lipman

C58e402c41b06ade1da4ce5bab5e19aa

Over the last several months, we’ve seen a myriad of predictions regarding the state of cybersecurity. Unfortunately, no one is forecasting fewer data breaches or a decrease in hacker activity in the year to come.

The warnings are dire, as the number, types, and complexity of attacks all continue to intensify. On a positive note, the noisy headlines and doom-filled prognostications have finally made a difference. In talking with our partners and customers, it is clear that small and midsize businesses (SMBs) are finally beginning to understand that they are just as vulnerable to cyber attacks as large enterprises. Consequently, security is one of their highest technology spending priorities in 2015.

While SMBs are vulnerable to many of the same types of attacks as the companies making headlines (Target, JP Morgan, Home Depot, Anthem, etc.), they must defend themselves with vastly smaller IT teams and budgets. Depending on their size, industry, business model, supply chain, and assets, SMBs are finding they have a unique set of challenges and vulnerabilities that require a comprehensive but tailored approach to security.  

As SMBs and their vendor partners become more attuned to these challenges and more knowledgeable about effective solutions, we expect to see three key security trends for SMBs in 2015:

1. Increased Awareness of Cyber-Security Threats

SMBs are more educated about the nature of the cyber-threats they are facing – no longer assuming they are too small to be of interest to online thieves. Criminals targeting smaller businesses aren’t as interested in stealing intellectual property and trade secrets – they’re going straight for the money. They may trick a business into paying them money, steal it from the business’ customers by obtaining their credit card data, or even take it directly from the company’s bank account. The financial and reputational impact from such an attack can be devastating for an SMB (more than half of SMBs fold within a year of a major breach).

Ransomware, phishing, and spyware are the most common types of threats. Many of these attacks are enabled or activated by unsuspecting employees using unsecure mobile devices or apps, or being tricked by social engineering attacks like phishing emails. In a recent survey, 84% of the experts polled said the employee threat was underrated. In addition to planting malware, cybercriminals can trick employees into handing over sensitive data to an imposter, or providing a point of entry via social media accounts.

SMBs are increasingly training employees to recognize social engineering attacks. But after years of evangelizing the importance of training, many industry leaders acknowledge that training and policies that are not backed up and enforced by active monitoring and remediation tools are simply ineffective. The growing recognition that awareness training by itself is a woefully insufficient response to such a complex onslaught of threat vectors, actors, and shared vulnerabilities, is leading to more meaningful investments in comprehensive security solutions. 

2. Adoption of More Comprehensive Protection

The mobile ecosystem (devices, apps, services) is really a wilderness at this point. The rapid proliferation of personal devices in the workplace (BYOx) has left IT admins at large enterprises racing to catch up with the accompanying security threats, and SMBs are certainly further behind. This is why perimeter security is no longer sufficient; mobile devices have made the network porous.

SMBs understand that their traditional approaches to security are no longer enough. Simply running basic desktop anti-virus software and a firewall device at the network edge may have been sufficient in the past, but not in today’s highly interconnected environment. SMBs are investing in a wider range of security technology solutions to ensure their stakeholders and customers are fully protected.

The focus of security solutions (and investments) has shifted to data and asset protection. Security solutions that scan endpoints to ensure system passwords are robust and changed frequently, critical data is backed up and encrypted, and web and email traffic is monitored for threats, are essential to mitigating attacks that originate inside the network perimeter.

If we can’t keep the bad guys outside the firewall, we have to concentrate resources on keeping data safe and unusable by hackers. Criminals of all kinds prefer low-hanging fruit. The less time, effort, and risk it takes to steal the goods, the more profitable their criminal activities. SMBs with comprehensive, layered protections in place—especially around valuable data—are less alluring targets for cybercriminals and more trusted partners in business.

3. Rapid Adoption of Cloud-Based Security Services

Cloud-based services and software of all kinds have been widely adopted by the SMB market. By eliminating the need for complex and expensive hardware and software installation and offering scalable, per user pricing, cloud-based platforms open access to services (like enterprise-class security) that were previously cost-prohibitive for many businesses.

Most SMBs have very little in-house IT expertise; they require solutions that are simple to set up, run, and monitor. Automated controls are key; a robust solution includes the ability to define and enforce security policies across vectors and form factors, manage what applications can be run by end-users and enforce acceptable use policies in real time.  

Multilayered, cloud-based security solutions cover essential security needs (including web security, anti-malware, data leakage protection, endpoint monitoring, and remediation) with a single service package from a single vendor. The security features are continuously updated to cover ever-mutating malware and vulnerabilities, are globally available, and incorporate all the requisite vectors and platforms including web sites, email, laptops, tablets, and smartphones.

Many SMBs are turning to managed service providers (MSPs) to deliver these turn-key solutions and carry out monitoring tasks on their behalf. This approach enables SMBs to immediately benefit from best-of-breed security technologies and security expertise, without deploying any in-house staff or infrastructure resources. A recent Canalys studyshows that 35% of total content security investment by small businesses (under 100 employees) went to hosted security services in 2014, and this is expected to grow substantially this year.

The ability to prove comprehensive protection—to both government regulators and enterprise partners—is one of many reasons to reduce risk exposure. Smaller businesses are vital to U.S. economic health. Increasing awareness of our shared vulnerabilities should drive the development and adoption of accessible, effective security solutions that SMBs can manage with small internal teams or through trusted MSPs.

We’re in an era of rapid-fire change and innovation powered by connected mobile devices, cloud computing, and social media, which has opened up the power of technology to everyone, including criminals. Those of using it for the right reasons have a collective responsibility to safeguard our shared resources. Making it easier for every type of organization to protect themselves, their customers, and their partners is good business indeed.

13886
Cloud Security General HIPAA PCI DSS Infosec Island Budgets Enterprise Security Policy Security Awareness Security Training General Impersonation Phishing Phreaking Breaches CVE DB Vulns US-CERT Privacy Vulnerabilities Webappsec->General General PDAs/Smart Phones
Post Rating I Like this!
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.