- 09/02/2017
- Category: Commentaries
Introduction
Cyber security is an ever-growing concern in this digital era. Our reliance towards computers for business, governance and other aspects of life have opened up new passages which criminals can exploit. The significance of cyber-attacks is paramount and should not be overlooked, particularly with the fact that these kinds of attacks have increased over the years. In 2015, an estimated 430 million new types of malware spread through the Internet, which was 40% higher than the previous year.[i] The World Economic Forum listed cybercrime as one of the top global risks and warned that industrial-scale cyber-attacks are proliferating.[ii]
Cyber-attacks are popularly known to target the government, public infrastructures, banks and large corporations with the aim to bring political change, disrupt public services, or steal large sums of people’s money. Here we see that cyber-attacks are an apparent threat because of the negative impact towards society. However, it has become an even bigger threat recently with the increase of cyber-attacks and breaches towards small and medium-sized enterprises (SMEs).[iii] This increase means that another sector of people’s lives is being hacked, which extends the threat that cyber-attacks already have towards society. Therefore, it is interesting to see why a lot more cyber-attacks are being directed towards SMEs nowadays.
The Extent of Cyber-attacks towards SMEs
Cyber-attacks conducted towards SMEs have risen over the years. According to the Government Security Breaches Survey by the UK Government, nearly 74% of SMEs in the UK reported a cyber security breach in 2015, an increase from 2013 and 2014 (60%).[iv] Furthermore, according to Symantec’s 2016 Internet Security Threat Report, 43% of global cyber-attacks targets small businesses, which has risen steadily from just 18% in 2011.[v] These statistics shows how vulnerable SMEs have become towards cyber threats.
According to Cyber Streetwise, the major cyber threats to SMEs are: ransomware – where a hacker uses virus software to encrypt all of the data on the company’s network until a sum of money is paid; hack attack – where the hacker manages to gain access to the company’s network and data; Denial-of-Service (DoS) attack – when a company’s website is flooded by immense volumes of data that disrupts their services; and spear phishing – where hackers poses as a senior member of the company and convinces someone with financial authority to make a payment.[vi]
For businesses with a limited amount of revenue such as SMEs, cyber-attacks could result in great economic loss for them. In the United States, 50% of SMEs have been victims of cyber-attacks.[vii] What is concerning is that over 60% of those attacked went out of business and that they do not realize their company has been attacked until it is already too late. The cost to repair the damage or recollect stolen information could be far beyond their financial capabilities. When these businesses do get attacked, nearly 80% of them have no capacity to respond, and they resort to buying incident response support services after an attack, which only adds up to the amount of loss and expenses.[viii]
Businesses such as Code Spaces—a Software-as-a-Service provider—and Nirvanix—a cloud storage service provider—had to cease operations after hackers stole and erased the companies’ data and backups.[ix] The hackers demanded a large ransom to resolve their issues, but Code Spaces and Nirvanix didn’t have the financial capacity to pay. This means that without the data, these two companies need to start their business again from scratch. Instead, they declared bankruptcy because of how damaging the cyber-attack already was towards their finances and reputation.
Behind the Increase of Cyber-attacks towards SMEs
The threat that cyber-attacks poses towards SMEs are real, and it is steadily growing. Because of this issue, experts concluded that SMEs had become a favored target for cyber-criminal activity.[x] The reason why hackers are increasingly targeting them lies in the SMEs’ digital assets and cyber security. Although these businesses seem like they don’t have anything worth stealing compared to larger enterprises, they still have valuable customer data, such as credit card number, passwords, and personal and family information which could be used for other malicious purposes. The data acquired are often traded on the deep web, which is why SMEs attract cyber-criminals looking for profit.
Furthermore, the vulnerability of SMEs cyber security system provides an added incentive for cybercriminal activity. These businesses are easier to penetrate than big companies, due to their low cyber security and threat intelligence systems. According to a report by Towergate Insurance, 97% of SMEs do not prioritize improvement to online security.[xi] The report also added that such decision was driven because of misleading belief from 82% of SMEs that their company is not a target for attacks and from 32% of them that believed they won’t suffer any lost revenue. Even though some SMEs have a well-prepared cybersecurity system, many still underestimate the threats that cyber-attacks could pose towards their company. Therefore, the prevention of cyber-attacks is still not maximum, with only 10% of SMEs prepared to detect sophisticated attacks, according to a survey by Recorded Future.[xii] These flaws present an opportunity for cybercriminals to exploit.
A particular hacking method that can only be applied to SMEs is by putting malware on its system, which could still be easily done since the company’s cybersecurity level is still low. The malware can stay dormant in the system for several years, then activated when the company eventually become a big business with higher capital to steal. Furthermore, cyber criminals view SMEs that are contracting with larger organizations as a route to a ‘bigger prize.’[xiii] They can avoid penetrating the large organization’s advanced security and the risk of being detected, but rather steal what they need from them indirectly through the SME.
Conclusion
In sum, the reason why cybercriminals are attracted to SMEs is that these businesses have more digital assets to steal than individual customers have, but less security than larger companies. With the number of digital businesses growing, along with more input of personal and private information that could be as worthy as those from larger enterprises, it is no wonder that the number of cyber-attacks towards SMEs have risen recently. Therefore, cyber attacks have further proven to be a large threat towards society in this digital era. SMEs need to adapt to the digital transformation of today, not only in their businesses operations but also in ensuring security; in this case, cyber security. For instance, installing a security operations
Picture: pexels.com
[i] MacDonald, E. (2016) Cyber Attacks on Small Businesses on the Rise. Available at: http://www.foxbusiness.com/features/2016/04/27/cyber-attacks-on-small-businesses-on-rise.html (Accessed: 3 February 2017).
[ii] Cann, O. (2016) What are the top global risks for 2016? Available at: https://www.weforum.org/agenda/2016/01/what-are-the-top-global-risks-for-2016/ (Accessed: 3 February 2017).
[iii] Smith, M. (2016) Huge rise in hack attacks as cyber-criminals target small businesses. Available at: https://www.theguardian.com/small-business-network/2016/feb/08/huge-rise-hack-attacks-cyber-criminals-target-small-businesses (Accessed: 3 February 2017).
[iv] UK Government (2015) Government urges business to take action as cost of cyber security breaches doubles. Available at: https://www.gov.uk/government/news/government-urges-business-to-take-action-as-cost-of-cyber-security-breaches-doubles (Accessed: 3 February 2017).
[v] Symantec (2016) Internet Security Threat Report 2016. Available at: https://www.symantec.com/content/dam/symantec/docs/reports/istr-21-2016-en.pdf (Accessed: 3 February 2017).
[vi] Smith, M. (2016) Huge rise in hack attacks as cyber-criminals target small businesses. Available at: https://www.theguardian.com/small-business-network/2016/feb/08/huge-rise-hack-attacks-cyber-criminals-target-small-businesses (Accessed: 3 February 2017).
[vii] LeClair, J. (2015) Small Business, Big Threat: Protecting Small Businesses from Cyber Attacks. Available at: http://smallbusiness.house.gov/uploadedfiles/4-22-2015__dr.__leclair__testimony.pdf (Accessed: 3 February 2017).
[viii] Barrette, G. (2017) Threat intelligence by the numbers (Infographic). Available at: https://www.recordedfuture.com/threat-intelligence-statistics/ (Accessed: 3 February 2017).
[ix] PRO OnCall Technologies (2014) 3 companies that failed due to a security breach. Available at: https://prooncall.com/3-companies-went-business-due-security-breach/ (Accessed: 6 February 2017).
[x] Card, J. (2015) Hackers are ahead in the cyberwar – businesses need to wake up. Available at: https://www.theguardian.com/small-business-network/2015/mar/24/hackers-cyberwar-businesses-cybercrime (Accessed: 3 February 2017).
[xi] Towergate Insurance (no date) SMEs and Cyber-attacks – what you need to know. Available at: https://www.towergateinsurance.co.uk/liability-insurance/smes-and-cyber-attacks (Accessed: 3 February 2017).
[xii] Barrette, G. (2017) Threat intelligence by the numbers (Infographic). Available at: https://www.recordedfuture.com/threat-intelligence-statistics/ (Accessed: 3 February 2017).
[xiii] Smith, M. (2016) Huge rise in hack attacks as cyber-criminals target small businesses. Available at: https://www.theguardian.com/small-business-network/2016/feb/08/huge-rise-hack-attacks-cyber-criminals-target-small-businesses (Accessed: 3 February 2017).
