A 2018 study revealed that small to medium businesses increasingly face the same cybersecurity risks as enterprise and well-known corporations, but only 28 percent of SMBs rate their ability to mitigate threats and attacks as “highly effective.”
The quantity of breaches and attacks, including malware, phishing attempts and ransomware attacks is steadily rising — with 67 percent of SMBs experiencing a cyber-attack, and 58 percent experiencing a data breach in the last year. Despite that, nearly half of respondents (47 percent) say they have no understanding of how to defend their businesses from these attacks.
As this vulnerability increases, the risk of employees, vendors, and outside contractors causing data breaches or being inadvertently complicit in these attacks is simultaneously increasing — 60 percent of study respondents cited a negligent employee or contractor as being the root cause for a breach, compared to 37 percent pointing to an outside source. Still, 32 percent of survey participants stated that they could not determine the root cause of a breach or attack they experienced in the past 12 months.
40 percent of respondents say an attack occurred with the compromise of employees’ passwords in the past year, with the average cost of each being $383,365. Accordingly, 19 percent more IT and security professionals consider password protection and management to be increasingly critical in 2019 as compared to 2018.
Part of creating an environment that is vulnerable to outside attack is a failure to use strong passwords, two-factor authentication and unique passwords for every website, application and system. These steps are often inconvenient, but have stopped attacks from occurring, limited the intrusion that occurs, and even notifying of a breach before it can actually occur. In this vein, respondents indicated their two biggest password-related pain points are having to deal with passwords being stolen or compromised (68 percent) and employees using weak passwords (67 percent). Almost certainly, this is cause and effect at work. Often, human memory and/or insecure spreadsheets are used to store and protect passwords. Only 22 percent of respondents say their companies require employees to use a password manager. Of the 74 percent of respondents who say password managers are not required, more than half say their companies rely upon unreliable methods to protect passwords.
SMBs, by nature, do not necessarily have the funds or the expert staff to have effective security, and as a result 74 percent of respondents note this as a huge obstacle. The remaining 26 percent of respondents who believe they are ‘highly effective’ at mitigating vulnerabilities and attacks state that the reason for this belief is due to a higher investment in both personnel and funding to adequately face these threats. These companies also dedicate a higher percentage of their IT budget to cybersecurity efforts.
As time progresses and technology evolves, cyber criminals are often ahead of the curve, and companies, no matter how big or small, are only as strong as their weakest link and their ability to react to an ever-changing security landscape. Staying ahead of threats in this area pays untold dividends by fostering a healthy respect for security and the responsibility of being good stewards of consumer data.