As the number of cyberattacks continues to increase year over year — in fact, the United Kingdom’s National Cyber Security Centre (NCSC) handled a record number of cybersecurity incidents last year) — it has never been more important for businesses to put cybersecurity at the top of their priority list, regardless of their size.
However large or small, all organizations remain a target for cybercriminals and are at risk of being compromised. The foundation of any company’s security infrastructure must be an educated and trained workforce who can detect, react to and mitigate a cyberattack.
Vulnerable Businesses of All Sizes
It is often the largest and most reputable organizations that make the headlines when hacked or breached by cyberattacks — for example, Microsoft, Estee Lauder and Wattpad. However, small and medium-sized businesses (SMBs) must not think that they are too small to target. According to research by insurance company Hiscox, around 65,000 attempted cyberattacks are aimed at small businesses in the U.K. each day, and approximately 4,500 are successful.
Regardless of company size, cyberattacks can be financially damaging and have devastating effects on business reputation and survival. Volunteer Voyages was a small business that fell victim to $14,000 in fraudulent charges when cyberattackers used its payment information. Maine Indoor Karting suffered a data breach when its owner clicked on a phishing email that appeared to come from his bank alerting him to unusual activity. These examples demonstrate that just like large enterprises, small businesses are at risk. By giving cybersecurity the same priority as other business goals and understanding the threats they face, SMEs can protect themselves and their assets.
Common Threats
Despite the rising number of cyberattacks taking place, both small and large businesses often do not have the right security measures in place. There have been a growing number of cases of increasingly sophisticated phishing and malware, which is only being accelerated by the COVID-19 pandemic, as hackers take advantage of vulnerable remote workers who are working on unsecured networks, away from the help of information technology (IT) teams. By having anti-malware and antivirus solutions installed across all devices, as well as deploying technology tools, organizations can spot any potential threats and act on them before it’s too late.
Human error remains one of the most common reasons for a cyberattack, with one analysis identifying it as the cause of 90% of data breaches in the U.K. in 2019. Employees play a key role in helping to protect company assets, but one mistake can have a devastating effect, whether it’s sending an email to the wrong person, attaching an incorrect document or clicking on a phishing link.
Organizations can significantly reduce risk by encouraging employees to become more educated and cyber-aware. But it is imperative that businesses choose the right solutions for adult learning — ones that use engaging, multimedia-rich content to build an ongoing training program that aids in the retention of best practice.
Security Training Programs
Organizations of all sizes have to accept they are not immune to cyberattacks and that digital tools cannot safeguard all operations. The key to understanding threats, how to identify them and, more importantly, how to prevent them from occurring, is to have an educated workforce. Eighty-one percent of small and micro-business workforces do not receive any training on cybersecurity. Without it, however, businesses cannot expect employees to stay ahead of the constantly evolving threat landscape.
While implementing an annual cybersecurity training program may fulfill an immediate need, it does not equate to a long-term defense from ever-evolving threats. Retention takes reinforcement. Businesses must deploy multiple training methods and sessions to reinforce key cyberthreat prevention messaging and ensure their workforce is up to date with the modern threat landscape, not only to protect the company but also to ensure their own cybersafety.
To change behavior and foster a strong security culture, organizations must consider the complexity of adult learning and ensure that the training they provide is relevant and relatable to their employees. With more companies moving to a remote work model, along with an expanding global footprint, security awareness training has to also span the globe and speak to all users. Traditional training content often lacks diversity and may not connect with a lot of audiences. Adding relatable scenarios and engaging users with varied content types like microlearning, virtual reality and simulations helps to reinforce the lessons learned in the courses — ultimately increasing the likelihood that employees will take the right course of action when faced with a cyberthreat.
Changing Mindsets
As well as being educated, it is important that employees understand their role and responsibilities when it comes to defending a business’ IT infrastructure. Typically, the responsibility of ensuring that adequate security processes and systems are in place falls on the IT team. However, many small businesses do not even have a dedicated IT department.
Addressing this challenge has never been more important than it is now. With social distancing measures in place, IT teams are not just a desk away to help employees with any concerns. Instead, organizations must reinforce responsibility throughout the whole organization, so that educated colleagues work mindfully on the front lines of defense. After all, the final decision to send secure information, click a link or download a file lies with them.
The report “The Forrester WaveTM: Security Awareness And Training Solutions, Q1 2020” stated that “organizations with strong security cultures have employees who are educated, enabled, and enthusiastic about their personal cyber safety and that of their employer.” By having a culture where employees are alert and empowered, with regular training, updated software and innovative tools, businesses can take advantage of a security-first approach.
