3 Ways SMBs Can Enhance Their Cybersecurity

Small-and medium-sized businesses (SMBs) make up over 99 per cent of businesses in Australia, yet they generally have far fewer resources than large enterprises to combat cybercrime. But there’s plenty they can do to protect themselves.

Given that small businesses with up to 19 employees form the vast majority of SMBs in the country, according to government figures, it seems somewhat perverse that they are, by and large, the least likely to have the time, money and inclination to tackle cyber threats.

That’s a problem, especially when you consider that 92.6 per cent of cyber incident reports to the government in 2021-22 were from small businesses, according to the Australian Signals Directorate’s Cyber Threat Report 2022-2023. Moreover, the average cost of cybercrime per report is $46,000 for small businesses and $97,200 for medium businesses.

While large enterprises in Australia may be targeted by cybercriminals based on the view that they can be extorted for large sums of money, despite superior defences, smaller businesses may be perceived as having lower cyber security maturity, making them popular targets.

But it doesn’t have to be that way. Here are three key measures SMBs can take to level the playing field and protect themselves against cyber threats:

1. Understand your attack surface

Even a small business can have a big attack surface. For instance, Trend Micro’s telemetry data has revealed that 3.9 per cent of devices among businesses using our solutions registered a high-risk score — the most of any asset category. Out of nearly 18.5 million devices, some 620,000 were considered high risk, clearly demonstrating the need for endpoint security.

This is according to our Intercepting Impact: 2024 Trend Micro Cyber Risk Report, which also showed that account security represented another key source of high-risk assets. Specifically, old and inactive user accounts, accounts with disabled security controls and sensitive data being sent outside the network are notable risk events with high event counts.

Likewise, cloud services and solutions are another major source of high-risk assets. In the first half of 2024, for example, users accessed cloud applications with a high-risk level based on historical application data, known security features and community knowledge an average of 821 million times.

The first step to combatting such vulnerabilities in the potential attack surface of a business is to recognise them. Once you’ve done this you can begin protecting it by disabling risky accounts or resetting them with a strong password and enabling multi-factor authentication,  while also educating users of corporate solutions, especially as businesses rely more on cloud services.  

2. Fortify internally to firm-up defences

Smaller businesses certainly have their strengths when it comes to cyber defences. Small businesses, and to a lesser degree medium-sized businesses, can act quickly and, on average, usually take a much shorter amount of time to patch software vulnerabilities compared to enterprises. This makes sense, since a smaller attack surface is usually easier to manage. 

This is one area where SMBs can play to their strengths. Poor cybersecurity hygiene is not uncommon among SMBs, for example, but the work involved in improving such hygiene when the business claims only a small number of employees is far easier than trying to achieve it with a workforce of thousands, as large enterprises typically need to do.

With that in mind, SMBs should look to fortify their defences by prioritising cybersecurity hygiene measures and guidelines, cyber awareness training, the remediation of misconfiguration within digital systems, regular software updates, prompt patching and investigating risky events quickly — a task that is significantly aided by automated systems that can identify threats as they occur.

3. Embrace a risk-based approach

A business system is only as safe as the people who can access it and use it. This is something that big enterprises tend to understand well, given the large numbers of workers they usually have to manage, but SMBs are less so. Who needs to minimise risks when you only have a few dozen workers? Most SMBs, it turns out. This is where a risk-based approach is important.

A risk-based approach shifts an organisation’s strategy from being reactive to proactive, which means enabling continuous risk assessment and management within the business. This is easier than it sounds, thanks in part to the latest generation of Ai-powered cybersecurity tools that can automatically calculate actual risk and provide mitigating controls advice.

Other simple steps to adopt a risk-based approach include simply cultivating a proactive culture and backing it up with technology to foster awareness and centralise visibility across the attack surface. Additionally, proactive cyber risk management depends on operationalising elements of a zero-trust strategy, an extension of the principle of least privilege where everything is suspect.

With SMBs increasingly in the cyber firing line, the time is ripe to reassess and strengthen their cybersecurity posture by gaining a solid overview of the attack surface, enhancing situational awareness internally through education and solutions that continuously discover, assess and mitigate threats and adopting a risk-based approach to actively anticipate threats.

These steps may sound complex, but businesses don’t have to do it alone. Australia has a rich ecosystem of integration partners that can help businesses of all sizes tackle complex cybersecurity systems, and many specialise in the SMB market. For example, Trend Micro has hundreds of partners in its Australian ecosystem alone. This means that SMBs can get expert advice and ongoing support, regardless of their cybersecurity knowledge.

Chris Zamagias is Channel & Alliances Director – ANZ at Trend Micro.

Last Updated on December 16, 2024 by Chris Zamagias