Christian Goelz

Christian Goelz

Riela Cyber Director

Share this article to start the conversation on SME cyber security:

Share on facebook
Share on twitter
Share on linkedin

Unlike many larger enterprises, Small and Medium Enterprises (SMEs) often do not have the resources available to hire dedicated cyber security specialists. Often, they also rely on outsourced IT support to local managed service providers (“MSPs”). They look after all things IT, and cyber security is just part of IT, right?

Not quite.

Small business cyber security model
Figure 1: Cyber Security complements Information Technology and should form part of a company's Risk Management and Business Community frameworks (click to enlarge)

With a background in accounting, finance or law, directors often don’t appreciate that cyber security requires trained specialists which even your best local MSP may not have in-house. Good cyber security also requires specialist software and bespoke management by the specialists to ensure the software tools are fit for purpose for a company’s particular IT environment.



Sounds quite technical?



That is because it requires constant attention, development, and improvement, since malicious actors aka “hackers” constantly try, and succeed, to find new ways to compromise a system. They attacked on average every 14 seconds a day in 2019 and are expected to attack every 11 seconds by 2021.



At an expected $6 trillion by 2021, cyber-crime is a profession 26x larger than the entire cyber security industry which is worth only $230 billion in comparison!



Putting this size into perspective, cyber-crime would be:


1. The fourth largest economy in the world, after only the US and China, as measured by GDP.

2. 2.5x bigger than the US covid-19 stimulus.

3. As big as the 5 largest companies in the world, by market cap.

4. 12x larger Walmart, the world’s largest company, as measured by revenue.

5. Larger than the global drug trade.



By understanding the size of the industry, it is no longer a stretch to see that relying on basic antivirus and firewall alone is no longer sufficient for any company. These systems can only block the “known knowns” whereas “hackers” are professionals working and learning 24/7 to look as unsuspicious as possible (“unknown unknowns”) – after all, they wouldn’t be very good hackers if they were stopped by a lookup database and a set of pre-defined static rules. 

Identification and Awareness
Figure 2: Cyber Security Quadrants - internal; adapted from Johari Window (click to enlarge)

These systems are only effective at preventing unintentional threats from causing damage, but they are not sufficient at protecting a corporation from an intentional attack.

The unknown SME cyber security gap
Figure 3: The unknown Cyber Security gap makes it easier for malicious actors to compromise a system (click to enlarge)

An attack can have serious consequences to a business and its survival. Often, compromised businesses are forced to close within 6 months of detecting a cyber-attack, which often go undetected for 280 days, and take another 30 or so days to recover. The severity of losses and costs associated with an attack are often in the millions, regardless of the size of the company.


Each day an attack goes unnoticed it increases the loss to the company and the cost to recover the systems. IBM expects the average saving from containing a breach in less than 200 days vs. more than 200 days at $1 million per breach. IBM estimates the potential savings in cost of a data breach for companies that have a cyber security solution at $3.58 million compared to companies that do not use any cyber security service . According to the Ponemon Institute, 66% of SMEs experienced a cyber-attack in the last 12 months and 63% experienced a data breach. The survey indicated that these companies spent an average of $1.2 million because of damage or theft of IT assets and infrastructure in addition to $1.9 million because of the disruption to their normal operations. Most worryingly, one third of the companies did not even know how their systems were breached, let alone having adequate defences in place to stop a breach. Most of these breaches could have been prevented or mitigated with a simple cyber security solution.


While it is too late for these companies, it isn’t too late for other SMEs – Cyber defence can start today! And it doesn’t cost the world.


A simple cyber security setup should be based around at least these three pillars:

1. Awareness
2. Protection
3. Insight


Awareness focuses on educating and training staff about the cyber risks and how staff can help preventing malicious actors compromising company assets. Technology can only do so much, in the end staff must know when something looks suspicious, be it phishing emails, malicious documents or bank details, and how to act responsibly with company resources. Big improvements in a company’s cyber security posture can be achieved by segregating company laptops and phones from private ones, allowing only multifactor authentication using an approved authenticator app (see here for more) and only allowing strong and secure passwords (more on passwords here). Together with awareness around suspicious emails and what to download or open, a company can make significant progress in securing some open doors. Company IT departments or their MSPs should also block suspicious URLs, disable certain downloads, and ban access to unprotected public Wi-Fi with company assets. Research shows that staff cause 60% of all cyber security incidents, making staff awareness a crucial part of any cyber defence strategy and a low-cost start to securing your company. Cyber awareness and training don’t have to be boring, making it interesting and engaging can significantly improve acceptance by staff members. Some training programs are app based so staff can even run them on their mobiles or tablets. One low-cost training software example can be found here.



Knowing that your company’s firewalls are the first line of defence only highlights why you should always have the best solution for your budget. Your first step in protecting your company’s networks should thus be multiple managed enterprise-grade firewalls rather than a single firewall. A firewall blocks unauthorised content with controls, such as denial of known malicious IP addresses, and rules of what traffic to allow. Each additional firewall increases the level of security as each level can be set up to block different types of malware traffic from entering your systems. Managed enterprise-grade firewalls also use sophisticated artificial intelligence to improve your security and learn about traffic over time. 



Protecting your company’s laptops and mobile devices, known as endpoints, which are amongst the most vulnerable entry points to a network is crucial. Companies should always protect these endpoints with the latest state-of-the art endpoint management software, rather than just simple antivirus software. Endpoint management software, unlike antivirus programs, actively scans, monitors, and blocks malware using a constantly updated threat database. Since endpoint management software sees traffic that made it through the firewalls, your endpoints are your last line of defence so this should be the best software you can get your hands on.



Since a large proportion of threats comes from malicious emails, using (several) of the latest email security tools is one of the most important and easiest ways to reduce your risk. Each email security tool will add additional security as each provider uses different databases and different algorithms to detect and block malicious emails.



In addition, update or patch management software ensures that all your devices on your network are on the most up to date software as soon as software updates are released by the vendors. Malicious actors expose vulnerabilities in old or previous software versions which can make an organisation unknowingly susceptible to a threat or attack (try a Google search for ‘server vulnerabilities’). By automating your patch management, you can ensure that there are no apparent open doors in your endpoints. Finally, an organisation should always ensure that you have an incident response plan (IRP’s – find out more here) and that all systems and data are fully encrypted and backed-up for a worst-case scenario. Dedicated software will ensure you can recover your backed-up data quickly should it get lost or compromised. These are fairly standard and available at little cost.



The motto “you can’t protect what you can’t see” is more important than ever when it comes to cyber defence. Even with the most sophisticated systems blocking most malicious activities, companies cannot know whether they are secure if they can’t see the data traffic on their systems. The secure endpoint, email and firewall software all need to communicate to a central Security Information and Event Management (“SIEM”) software which collates the information from the systems on a network to identify and correlate suspicious activities which are often designed to be subtle and under the radar Advanced analytics tools are best placed to identify these activities. Only by ‘seeing’ suspicious activity early can you protect your business from an attack compromising or destroying everything you have built – one of the keys to contain an attack or data breach successfully is the time it takes to detect and stop such an incident. The longer a malicious actor is going through system, the more privileges and access he will gain, making it harder and more expensive to stop and recover from the breach. Most experts believe that a cyber-attack is a matter of ‘when’ and not ‘if’ so being protected and ready for an attack will not only make it harder for anyone to compromise your systems, i.e. reducing the likelihood, and ensure that you can detect, respond and recover from an attack quickly, i.e. reduce the severity and cost of an attack meaningfully.

to conclude...

The increase in cyber-crime and its sophistication should make cyber security a key risk for every company’s board. The first step is to understand a company’s current setup through a cyber security assessment. Any specialist cyber security company can provide these at a fairly low cost. You can reach out here to make a start today.

Once the environment is known, a relatively simple solution (for experts anyway) including staff training, software and network improvements to your system, depending on your budget and risk appetite, can create a fairly comprehensive cyber security setup which makes your SME significantly more cyber secure. This will considerably reduce both the likelihood and severity of data loss or system compromise. 

So, is this setup more expensive than your current basic IT setup? Yes, but only somewhat. Are these tools unaffordable for your SME budget? Not at all. Are they too expensive given the increasing risk of a cyber-attack, not to mention the cost of a GDPR breach, recovery time, reputational damage, regulatory cost, or even total loss of your business? Never. You are probably looking at less than £100 per month per employee for a small business, with the cost per employee reducing as you grow. That’s a small price to pay to protect your business from cyber-criminals.



Start today. Protect your Business. Be Cyber Secure.

Share this article to start the conversation on SME Cyber Security:

Share on facebook
Share on twitter
Share on linkedin

Subscribe to our newsletter

Stay updated with our latest blogs and company updates.


Share on facebook
Share on pinterest
Share on twitter
Share on linkedin