Written by BARR’s partner, Electric
The cybersecurity threats faced by small businesses evolve every day. As cyberattacks become more sophisticated and prevalent, the consequences for organizations also become more severe. Even minor breaches have the potential to quickly snowball, leaving sensitive data, customer relations, and business continuity at risk.
A recent study by Electric found 47% of small businesses in the U.S. have fallen victim to a cyberattack. Worryingly, 67% of those organizations have experienced more than one breach. Keep reading to discover the most common gaps we identified in small business cybersecurity, and what you can do to protect your company in 2023.
1. A lack of cybersecurity expertise
A lack of cybersecurity knowledge is one of the greatest vulnerabilities in small businesses. Just one third of Electric’s survey respondents had access to dedicated cybersecurity specialists, while over half said they assign security duties to their IT team. While this can seem like a scrappy solution in growing organizations, IT professionals often don’t have the expertise (or time) to adequately manage cybersecurity alongside their day-to-day tasks.
Understandably, many small businesses don’t have the budget for specialized cybersecurity resources in-house. Unfortunately, this is also one of the reasons they are such attractive targets for cyber criminals. As a cost-effective alternative to hiring a team of experts, it often makes sense for small businesses to outsource this responsibility to specialist providers. With an external partner, you can access all the knowledge you need, without the associated labor costs.
2. Insufficient cybersecurity documentation
It may seem like unnecessary paperwork for busy teams, but documented cybersecurity policies and strategies go a long way toward keeping your organization safe. Unfortunately, just 59% of small businesses have an employee cybersecurity policy, while only 46% have a cybersecurity strategy. Disaster recovery plans and Bring Your Own Device (BYOD) policies are even less commonplace (35% and 29% respectively).
In the event of an attack, your ability to contain a breach comes down to organizational readiness. Employees should be familiar with the escalation process for flagging suspicious activity, and all stakeholders should have a clearly defined role to play during an attempted attack. Don’t underestimate the importance of putting these steps to paper so your entire team is prepared to respond.
3. Unstructured employee training
Employee error is the leading cause of breaches in small businesses, with mistakes like clicking on a phishing email accounting for 52% of attacks. Risk awareness and your team’s ability to identify suspicious activity are crucial. Yet, 18% of survey respondents said their organization never conducts cybersecurity training for employees, while 14% said they only do so once a year.
Employees are one of your most important lines of defense against cyberattack. In addition to documenting guidelines for appropriate use of company devices and resources, you should also conduct regular training on these rules, and demonstrate the importance of adhering to them. Incorporate cybersecurity awareness in your onboarding process for new employees and continue to reinforce best practices frequently.
4. Inadequate cybersecurity measures
Of course, training and documentation only go so far. Ultimately, the strength of your cybersecurity is heavily dependent on your access to the right software and technology. While Electric’s study found antivirus software and firewalls are now commonplace in most small businesses (used by 70% and 65% of organizations respectively), other layers of protection are often lacking.
In the context of today’s remote and hybrid work environments, there is a worryingly low uptake of VPNs and Mobile Device Management software – used by 32% and 25% of small businesses. Similarly, Endpoint Protection Programs (EPP) and Endpoint Detection and Response (EDR) are only in place at 24% of organizations. As employees access sensitive company data from increasingly distributed locations, businesses must take advantage of protective software to ensure they can work securely.
Gaps in Cybersecurity Leave Your Business Exposed
Cyber attacks against small businesses are on the rise, and leaders can no longer afford to overlook critical gaps in their defense. A full scale breach can have catastrophic consequences for your organization, ranging from financial penalties to complete business closure. Fortunately, small businesses don’t have to go it alone. If in-house resources are beyond your budget, get in touch with Electric to learn more about our centralized, done-for-you cybersecurity management.