One of the constant complaints heard in cyber security is that most security solutions are built for the Enterprise, with very little thought about how to cater for small and medium businesses. But why not give every business whether they are 10 users or 100,000 users the same capabilities? That was one of the challenges we wanted to solve in order to be truly effective against phishing today when we applied for the GCHQ Cyber accelerator. After being successful in a tough selection process, we have able to bring phishing solution to market having been guided by UK Government and Cyber Intelligence agencies – a world first.
It’s no secret that cyber criminals make the headlines when their attack on a large business is successful, and in the last few years high-profile enterprises have been falling foul of the criminals’ collective efforts at an alarming rate. It is true that devastating cyber attacks on a smaller enterprise will not garner anywhere near the degree of publicity that follows on from the hacking of an international corporation. Still, this doesn’t mean there aren’t consistent and successful attacks against small businesses on a daily basis. Nearly one million SMEs suffered a cyber attack in the last year, which is no surprise considering that SMEs host customer data, IP, and other prized assets in exactly the same way as the enterprise.
One of the biggest threats to SMEs are phishing emails, where hackers pose as trustworthy entities, such as suppliers or colleagues, and ask for sensitive information to be sent. These easy to deploy and risk free attacks must not be underestimated. There’s lots of independent research to show that between 90-95% of all successful attacks against business start with a phishing email. These email threats continue to evolve and at the spear phishing end of the spectrum are very convincing. To expect the average employee, whose key skill will not be cyber security, to stay vigilant, and yet productive is, as the breach figures above suggest, a failing strategy.
Machine learning automation in contrast, allows 30 – 40 individual checks to be done instantly, on each email going to an employee’s own mailbox. By alerting to those deceptive emails identified as a likely threat, SME’s can both reduce the risk of a malicious link being clicked, and at the same time train a employee on why this particular email is deceptive. This is the future, and it’s here and available now. To give an idea how difficult it can be to spot spear phishing, without this tech, the example of of Facebook and Google is worth knowing. Despite being a couple of the richest and technologically advanced companies in the world, both were tricked over the course of three years, into wiring over $100 million each to a cyber criminal. In other words, even with the near infinite IT resources, and access to the best cyber experts, they could not stop deceptive emails targeting and socially engineering their staff to do the “wrong thing”.
It’s important to remember that, these days, cyber crime is an industry in and of itself. Within the dark web, crime as a service (CAAS) has grown year on year. Anyone, with small amounts of money can hire out the services of sophisticated cyber criminals and rent any type of crime service they need. This as a service model has had the effect of lowering the technology bar allowing mass participation of low tech or non tech criminals.
In some ways the cyber crime industry has arguably taken inspiration from SMEs themselves. Both have adapted to a highly pressurised and competitive environment by adopting a similarly lean and agile approach. Unfortunately, though, the criminal world has twisted the now-familiar lean business principles, renowned for giving SMEs an edge, and mutated them to create a contemporary criminal network that is, regrettably, highly effective. As such, whether a business is large or small, if it holds something of value, it could be a target. Previously, sophisticated security defence technologies have traditionally been the reserve of big businesses with well-funded budgets, leaving smaller players exposed to threats. In essence, SME offerings need the same capabilities as the highly skilled security operations found in well run large enterprises. This is where the benefits of cloud-hosted protection becomes most apparent. In turn, this will move the needle for businesses of all sizes and budgets, as it affords customers the ability to purchase the expertise they require. This leaves their own teams to focus on their own jobs, and other higher value activities where knowledge about the IT environment and business is needed. The specialised cyber work can be automated, meaning people don’t need to constantly look over a product for alerts. What’s more, this technology is available within mere minutes of being deployed, so business leaders can act swiftly. At the end of the day, businesses can no longer afford to have staff distracted from their other, vital responsibilities. At the same time, it’s imperative that they bolster their detection and response capabilities, and cyber defence products utilising machine learning are especially good for doing this. All of this is especially important, given the important roles played by many SMEs in the complex supply chains that power the economy. Cyber criminals target SME businesses not only because of their own corporate identity and data, but also because of which other businesses and key individuals they have access to. The famous Target hack, which gained access to target’s network by first stealing credentials from a third party heating and ventilation company is a stark lesson on the risks. The breach would cost Target, $420 million in costs, and eventually the CEO Gregg Steinhafel resigned. SME’s must have access to economically viable cyber security protection, which is simple to deploy and easy for end users to understand and work with. By doing this they save not only themselves from the perils of an attack, but also much bigger enterprises further up the chain, protecting a whole host of staff and consumers in the process. With GDPR and the NIST directive already in force, it’s creating a trickle down effect from Enterprise customers with new contracts to ensure that SME’s supplying them have additional cyber protection in place.
When all’s said and done, technology should benefit everyone, rather than just those with big cyber budgets. Putting powerful technology that is easy to deploy, easy to understand, and at price points that all businesses can afford, is ultimately, this is what all businesses deserve. The massive growth in O365 and G Suite migrations is allowing specialist phishing protection to be deployed easily from the cloud, giving maximum protection without the usual installation disruption. With nine out of 10 breaches caused by phishing it’s the obvious way to protect against this flow of threat into your business.
To find out more about how Cyber Business Support can help defend your organisation from fraudulent email and phishing attacks, please get in contact. Why not email us at info@cuberbusinesssupport.com now!