Cyber-security on a budget

Jay Ryerse at ConnectWise explains what SMEs need to know about information security

 

For small and medium sized enterprises (SMEs), the major shift to remote and hybrid working has significantly raised the cyber-security stakes. Now more than ever, small IT teams must often wear multiple hats, tasked with ensuring networks and IT systems to perform without problems while keeping data safe from a broadening range of complex cyber-threats.

 

Adding to the challenge are the current economic uncertainties, meaning that despite the increasing workload and the number of risks to manage, many IT budgets have remained flat or have even decreased. For many under-resourced SME IT teams, it’s extremely difficult to ensure that their enterprise’s cyber-security is effectively addressed on a full-time basis.

 

Cyber-security challenges

The cyber-crime stats make alarming reading for SMEs. According to Accenture’s Cost of Cybercrime Study, 43% of cyber-attacks in 2022 were aimed at small businesses, but only 14% of those businesses were prepared to defend themselves.

 

Part of the problem is that it’s not just the activities of hackers that are putting them at risk, there is also an additional range of issues that can exacerbate any shortfalls in resourcing or leadership.

 

One key challenge comes from the rapidly growing and complex tech stacks that small and medium organisations tend to use. For instance, the shift towards cloud-based storage, the growing need for virtual team collaboration and the wide array of applications now in use have added unprecedented levels of complexity to managing cyber-security.

 

Each IT tool not only requires secure deployment across the business but also demands continuous optimisation to stay up-to-date with the latest security patches. This process is not only time-consuming but carries the risk of ’alert fatigue’, bringing an increased possibility that critical threats will be overlooked simply because there are too many to deal with.

 

Then there are the obligations set out by increasing detailed compliance regulations. All IT teams, irrespective of the business size, should be in a position to ensure that all deployed devices, applications and services adhere to the relevant cyber-security regulatory standards.

 

However, maintaining the required certifications for every component of the tech stack while keeping abreast of the frequent changes in regulatory standards places a heavy burden on already overstretched IT teams. What is also sometimes overlooked is that compliance isn’t just about box ticking – there are generally very sound reasons for ensuring that minimum standards are met.

 

Adding to these issues, many SMEs must work with outdated and even obsolete hardware and software. Clearly, budget constraints often force businesses to continue using antiquated systems, the problem being that these outdated technologies can create major security vulnerabilities, particularly when vendors no longer offer security support. In this situation, SMEs are particularly susceptible to cyber-attacks.

 

Even for those businesses that can resource their IT and cyber-security teams, the challenges don’t end there. For the last several years, the cyber-security sector has been working against a skills shortage that disproportionately impacts SMEs.

According to Cyber-security Ventures, for instance, the number of unfilled cyber-security jobs now stands at 3.5 million worldwide, presenting a formidable challenge for SMEs competing for talent in an increasingly fierce market.

 

One of the main alternatives – continually training existing teams to recognise and counteract emerging threats – can quickly prove prohibitively expensive for many SMEs, given their limited IT budgets.

 

Building better defences

So where does this leave SMEs in the battle against cyber-crime? One of the main available options is to build or outsource a Security Operations Centre (SOC) to gain access to the personnel, processes and technology for monitoring and addressing today’s cyber-security issues.

 

An effective SOC can dramatically improve an organisation’s cyber-security capabilities. The most advanced use predictive algorithms to analyse IT infrastructure and systems to ensure early detection and mitigation of vulnerabilities and potential risks.

 

By delivering 24/7 monitoring, coupled with the ability to prioritise threats, a SOC can optimise the allocation of cyber-security expertise and other resources while also ensuring the organisation remains compliant with all relevant regulations.

 

Rather than building their own SOC, SME IT leaders also have the option of working with a Managed Service Provider (MSP) in a ‘SOC-as-a-service’ partnership. This approach offers the same benefits as an internal SOC, such as 24/7 monitoring, but without the same level of staff and maintenance costs. As such, it represents an established and cost-effective alternative for SMEs.

 

In addition to establishing or outsourcing a SOC, it’s crucial for SMEs to stay informed about cyber-security trends and best practices. Engaging with a community of cyber-security experts and IT professionals offers great access to a diverse set of subject matter experts who can help with everything from specific industry issues and regulatory oversight to emerging threats and best practices. 

 

The cyber-security challenge isn’t going away anytime soon. As attacks continue to escalate, SMEs can look to MSPs as their trusted advisors: offering the necessary support and services such as ‘SOC as a Service’ capabilities to ensure that their enterprise’s cyber-security is effectively addressed. 

 

---

 

Jay Ryerse is VP of Global Security Sales at ConnectWise

 

Main image courtesy of iStockPhoto.com