Big or small – Cyber Security is for all 

Jan Nel, Head of Information Security, QLink and QSure 

The cybersecurity landscape has experienced a significant surge in cyber threats, evolving attack methods, and new technologies. Attackers have become more sophisticated in their methods, leveraging automation, artificial intelligence, and machine learning to develop novel attack vectors. Organizations must ensure that they implement basic cybersecurity practices such as regular patching, multi-factor authentication, and strong password policies. Despite these controls, the human element remains the weakest link in cybersecurity, and attackers are increasingly targeting employees via social engineering tactics. 

There is a common misconception that only large corporations are at risk of cybersecurity breaches. However, smaller businesses are equally vulnerable and may, in fact, be at higher risk due to their limited cybersecurity budgets. With fewer resources, smaller businesses may not have adequate funds to invest in cybersecurity measures and become easy targets for cybercriminals. To protect themselves, smaller businesses need to focus on high-risk areas and adopt basic cybersecurity practices like user access control, vulnerability scanning, anti-virus, and email security. These practices, albeit not expensive to implement, can go a long way in mitigating cybersecurity risks. 

Top risks that businesses face in terms of cybersecurity depends on the nature of the business, the scale of operations, and the company’s risk appetite. The most vulnerable businesses are those that provide sensitive services or conduct transactions online, possess sensitive customer data, or operate in emerging economies with sophisticated cybercriminals. Some of the current top risks in cybersecurity include social engineering, security misconfigurations, malware, and ransomware. With social engineering, hackers use manipulation tactics with employees to gain access to systems and data while security misconfigurations occur when defenses are not properly configured. Malware and ransomware can take over a network or system, stealing important data or demanding a ransom. To mitigate these risks, it is important that businesses have robust security policies and procedures in place, such as regular employee training, effective IT controls, and disaster recovery plans. 

Common mistakes smaller businesses make in regard to cybersecurity are: 

1. Neglecting Anti-Virus and Anti-Malware Software: Smaller businesses often forego loading anti-virus and anti-malware software on every workstation and server. They assume such measures are only necessary for large companies, which leaves them open to attacks. 

2. Not Running Daily Scans with Anti-Virus and Anti-Malware: Just installing the software is not enough. These software programs must be applied daily to scan all workstations and servers for potential malware and spyware.  

3. Failing to Install Critical Security Updates: Businesses need to stay on top of the latest security updates and patches to ensure their protection against vulnerabilities. Hackers often exploit these vulnerabilities to gain access to systems and data.  

4. Cybersecurity Practitioners Not Staying Up-to-Date with Current Trends: Technology advancements are continually creating new vulnerabilities that cybercriminals exploit. Unfortunately, cybersecurity practitioners often fail to stay current with the latest security trends and threats. This can make it challenging to identify and mitigate emerging risks. 

The best approach to mitigate cybersecurity risks is to conduct IT Security Risk Management to understand the shortcomings within the environment. This process involves identifying potential threats and vulnerabilities that could compromise the security of the organization. Once the Security Risks and Gaps are identified, processes can be implemented to mitigate the risks. However, it is important to note that there is no silver bullet for cyber security. Organizations must proactively work to strengthen their security posture by implementing security best practices and continuously monitoring and testing their systems for vulnerabilities. Even with the best cybersecurity technology, humans remain the most significant factor with studies showing over 90% of cybersecurity breaches involve some kind of human error, making it crucial to understand the role of the human element in cybersecurity. 

One factor is social engineering, which is used extensively as an attack vector against businesses. These attacks are designed to exploit human behaviour or emotions, such as trust, fear, or shame, to trick people into handing over sensitive information, such as usernames, passwords, or credit card information. Typically, social engineering attacks are executed through phishing scams or tricking employees into installing malware on their computers. 

To mitigate the threat posed by social engineering, companies should focus on raising staff awareness levels of the risks and how to detect and respond to social engineering attempts. By providing proactive training and education, companies can reduce the likelihood of their staff becoming unwitting accomplices to these fraudsters. 

The landscape of cyber-risks has evolved as a result of changing work practices. With remote working becoming the new norm, cyber attackers could easily target remote users to exploit vulnerabilities in business security practices.  Organizations should invest in educating remote workers on security best practices, such as using secure passwords, avoiding public Wi-Fi, and spotting phishing scams. 

To mitigate cyber security risks, it’s essential to understand the cyber risk profile of the business. We must continuously monitor and assess the security controls in place and stay up-to-date on emerging threats. Without proper knowledge and awareness, you cannot fix what you don’t know.