Matthew RosenquistFounder & CISO Advisor, Cybersecurity Insights · CISO, Cybersecurity Strategist, & Industry Advisor

What SMBs Need to Know About Cybersecurity

8 Mar 2021 · 4 min

Watch on YouTube

3:42

In this advisory video, the speaker warns that small and medium businesses (SMBs) are increasingly targeted by cyberattacks despite a common belief that they are too small or unimportant to be of interest. Citing surveys that show nearly half of SMBs have experienced an attack and that 60% of those hit do not survive beyond two years, the talk emphasizes the potentially devastating consequences of ransomware, data breaches, denial‑of‑service attacks, fraud and extortion. The speaker then outlines practical, low‑cost steps SMB owners can take to improve their security posture. The first step is to consult free government resources such as the UK’s National Cyber Security Centre (NCSC) and the US Cybersecurity and Infrastructure Security Agency (CISA), which provide guidance, infographics and tools. Core cyber‑hygiene measures are highlighted: malware protection, regular patching, strict access controls, strong passwords, multi‑factor authentication for privileged accounts, secure backups and device configurations. The importance of educating employees and contractors to avoid phishing and other human‑error risks is stressed, as is the need for a ready‑to‑use crisis response plan to limit damage when an incident occurs. The overall message is that modest, proactive effort now can significantly protect SMBs and preserve their business continuity.

Chapters

Small and medium businesses aren't paying attention when it comes to cybersecurity, and that's a problem because they are being targeted. And some surveys are showing that almost half have reported either being attacked or breached. Yet small and medium businesses, they tend to fall into this misguided thinking that they're either too small or they don't have anything of value, they're not going to be targeted, or cybersecurity is going to be too are too complex, and so they don't even go down that path. Now, the impacts can be devastating, whether it be ransomware or data breaches, denial of service attacks, asset thefts, fraud, extortion. 60% of small and medium businesses that suffer an attack aren't around after 2 years. It just craters these companies. So it's important for these types of businesses to be smart, and there are tools available and basic practices that can really help, and many of them are free. So if you are a small and medium business owner, be sure to go out. Now, there's a couple of different places to start. And I would start with these two, although there are many resources. Start with government websites that offer free information, tools, and resources. And I'll give you two. The first one is the National Cybersecurity Center, and it's actually hosted by the government in the UK. And there's another one here in the US, and it's the Cybersecurity Infrastructure Security Agency, the CISA. And I'll put the links in the bottom there. And basically they provide advice and infographics and even some tools to help small and medium business owners understand what should they do. And a lot of it is focused just on basic hygiene and industry best practices. They're going to talk about things like making sure you've got some level of malware protection, um, making sure your systems are updated and patched, controlling access, uh, and making sure that you're using things like strong passwords, and for very sensitive information or valuable information, making sure that you're using second-factor authentication or multi-factor authentication, especially for admin accounts. Secure backups and configurations of devices, and definitely making sure that the employees and the, the contractors, that they've got a good amount of cybersecurity education. Right, it's those behaviors of the people within the organization, those trusted employees, right, making sure that they're not inadvertently clicking on things or installing malware or releasing information or data that could be of detriment to the organization. And lastly, they're going to talk about making sure you have a crisis response plan, something you can pull off the shelf when something bad happens. Why? Because it will reduce the amount of impact and loss when something unfortunate, occurs. Now, in reality, a little effort now can go a long way to protect small and medium businesses, but they have to take an active role. So do what's right. Protect what is most important to you.