Riela Cyber Director
Share this article to start the conversation on SME cyber security:
Unlike many larger enterprises, Small and Medium Enterprises (SMEs) often do not have the resources available to hire dedicated cyber security specialists. Often, they also rely on outsourced IT support to local managed service providers (“MSPs”). They look after all things IT, and cyber security is just part of IT, right?
Not quite.
With a background in accounting, finance or law, directors often don’t appreciate that cyber security requires trained specialists which even your best local MSP may not have in-house. Good cyber security also requires specialist software and bespoke management by the specialists to ensure the software tools are fit for purpose for a company’s particular IT environment.
Sounds quite technical?
That is because it requires constant attention, development, and improvement, since malicious actors aka “hackers” constantly try, and succeed, to find new ways to compromise a system. They attacked on average every 14 seconds a day in 2019 and are expected to attack every 11 seconds by 2021.
At an expected $6 trillion by 2021, cyber-crime is a profession 26x larger than the entire cyber security industry which is worth only $230 billion in comparison!
Putting this size into perspective, cyber-crime would be:
1. The fourth largest economy in the world, after only the US and China, as measured by GDP.
2. 2.5x bigger than the US covid-19 stimulus.
3. As big as the 5 largest companies in the world, by market cap.
4. 12x larger Walmart, the world’s largest company, as measured by revenue.
5. Larger than the global drug trade.
By understanding the size of the industry, it is no longer a stretch to see that relying on basic antivirus and firewall alone is no longer sufficient for any company. These systems can only block the “known knowns” whereas “hackers” are professionals working and learning 24/7 to look as unsuspicious as possible (“unknown unknowns”) – after all, they wouldn’t be very good hackers if they were stopped by a lookup database and a set of pre-defined static rules.
These systems are only effective at preventing unintentional threats from causing damage, but they are not sufficient at protecting a corporation from an intentional attack.
An attack can have serious consequences to a business and its survival. Often, compromised businesses are forced to close within 6 months of detecting a cyber-attack, which often go undetected for 280 days, and take another 30 or so days to recover. The severity of losses and costs associated with an attack are often in the millions, regardless of the size of the company.
Each day an attack goes unnoticed it increases the loss to the company and the cost to recover the systems. IBM expects the average saving from containing a breach in less than 200 days vs. more than 200 days at $1 million per breach. IBM estimates the potential savings in cost of a data breach for companies that have a cyber security solution at $3.58 million compared to companies that do not use any cyber security service . According to the Ponemon Institute, 66% of SMEs experienced a cyber-attack in the last 12 months and 63% experienced a data breach. The survey indicated that these companies spent an average of $1.2 million because of damage or theft of IT assets and infrastructure in addition to $1.9 million because of the disruption to their normal operations. Most worryingly, one third of the companies did not even know how their systems were breached, let alone having adequate defences in place to stop a breach. Most of these breaches could have been prevented or mitigated with a simple cyber security solution.
While it is too late for these companies, it isn’t too late for other SMEs – Cyber defence can start today! And it doesn’t cost the world.
A simple cyber security setup should be based around at least these three pillars:
1. Awareness
2. Protection
3. Insight
Awareness focuses on educating and training staff about the cyber risks and how staff can help preventing malicious actors compromising company assets. Technology can only do so much, in the end staff must know when something looks suspicious, be it phishing emails, malicious documents or bank details, and how to act responsibly with company resources. Big improvements in a company’s cyber security posture can be achieved by segregating company laptops and phones from private ones, allowing only multifactor authentication using an approved authenticator app (see here for more) and only allowing strong and secure passwords (more on passwords here). Together with awareness around suspicious emails and what to download or open, a company can make significant progress in securing some open doors. Company IT departments or their MSPs should also block suspicious URLs, disable certain downloads, and ban access to unprotected public Wi-Fi with company assets. Research shows that staff cause 60% of all cyber security incidents, making staff awareness a crucial part of any cyber defence strategy and a low-cost start to securing your company. Cyber awareness and training don’t have to be boring, making it interesting and engaging can significantly improve acceptance by staff members. Some training programs are app based so staff can even run them on their mobiles or tablets. One low-cost training software example can be found here.
Knowing that your company’s firewalls are the first line of defence only highlights why you should always have the best solution for your budget. Your first step in protecting your company’s networks should thus be multiple managed enterprise-grade firewalls rather than a single firewall. A firewall blocks unauthorised content with controls, such as denial of known malicious IP addresses, and rules of what traffic to allow. Each additional firewall increases the level of security as each level can be set up to block different types of malware traffic from entering your systems. Managed enterprise-grade firewalls also use sophisticated artificial intelligence to improve your security and learn about traffic over time.
Protecting your company’s laptops and mobile devices, known as endpoints, which are amongst the most vulnerable entry points to a network is crucial. Companies should always protect these endpoints with the latest state-of-the art endpoint management software, rather than just simple antivirus software. Endpoint management software, unlike antivirus programs, actively scans, monitors, and blocks malware using a constantly updated threat database. Since endpoint management software sees traffic that made it through the firewalls, your endpoints are your last line of defence so this should be the best software you can get your hands on.
Since a large proportion of threats comes from malicious emails, using (several) of the latest email security tools is one of the most important and easiest ways to reduce your risk. Each email security tool will add additional security as each provider uses different databases and different algorithms to detect and block malicious emails.
In addition, update or patch management software ensures that all your devices on your network are on the most up to date software as soon as software updates are released by the vendors. Malicious actors expose vulnerabilities in old or previous software versions which can make an organisation unknowingly susceptible to a threat or attack (try a Google search for ‘server vulnerabilities’). By automating your patch management, you can ensure that there are no apparent open doors in your endpoints. Finally, an organisation should always ensure that you have an incident response plan (IRP’s – find out more here) and that all systems and data are fully encrypted and backed-up for a worst-case scenario. Dedicated software will ensure you can recover your backed-up data quickly should it get lost or compromised. These are fairly standard and available at little cost.
The motto “you can’t protect what you can’t see” is more important than ever when it comes to cyber defence. Even with the most sophisticated systems blocking most malicious activities, companies cannot know whether they are secure if they can’t see the data traffic on their systems. The secure endpoint, email and firewall software all need to communicate to a central Security Information and Event Management (“SIEM”) software which collates the information from the systems on a network to identify and correlate suspicious activities which are often designed to be subtle and under the radar Advanced analytics tools are best placed to identify these activities. Only by ‘seeing’ suspicious activity early can you protect your business from an attack compromising or destroying everything you have built – one of the keys to contain an attack or data breach successfully is the time it takes to detect and stop such an incident. The longer a malicious actor is going through system, the more privileges and access he will gain, making it harder and more expensive to stop and recover from the breach. Most experts believe that a cyber-attack is a matter of ‘when’ and not ‘if’ so being protected and ready for an attack will not only make it harder for anyone to compromise your systems, i.e. reducing the likelihood, and ensure that you can detect, respond and recover from an attack quickly, i.e. reduce the severity and cost of an attack meaningfully.
The increase in cyber-crime and its sophistication should make cyber security a key risk for every company’s board. The first step is to understand a company’s current setup through a cyber security assessment. Any specialist cyber security company can provide these at a fairly low cost. You can reach out here to make a start today.
Once the environment is known, a relatively simple solution (for experts anyway) including staff training, software and network improvements to your system, depending on your budget and risk appetite, can create a fairly comprehensive cyber security setup which makes your SME significantly more cyber secure. This will considerably reduce both the likelihood and severity of data loss or system compromise.
So, is this setup more expensive than your current basic IT setup? Yes, but only somewhat. Are these tools unaffordable for your SME budget? Not at all. Are they too expensive given the increasing risk of a cyber-attack, not to mention the cost of a GDPR breach, recovery time, reputational damage, regulatory cost, or even total loss of your business? Never. You are probably looking at less than £100 per month per employee for a small business, with the cost per employee reducing as you grow. That’s a small price to pay to protect your business from cyber-criminals.
Start today. Protect your Business. Be Cyber Secure.
Stay updated with our latest blogs and company updates.
Kurt Schrauwen is a Director of the Riela Group of companies which includes Riela Yachts, Riela Cyber and Riela Tech.
Kurt brings more than 20 years of leadership experience having been an early part of the global success of Microgaming in becoming a market leader. Kurt was responsible for the commercial, contractual, and technical sales for Microgaming and with this experience will complement the company’s growth strategy.
Kurt is passionate about business optimisation and prides himself in having an intrapreneurial outlook to maximise staff potential, reduce inefficiencies as well as identifying and maturing revenue growth opportunities.
Paul Cocker joined the Riela Group in late 2021, after spending just under 20 years with his previous employer.
Paul is responsible for the Riela Tech service levels, working on both the dispatch function and SLA management. Paul carries out a variety of duties across the Network Operations Centre and works closely across the wider team to deliver professionally tailored solutions for our Riela Tech clients.
Something isn’t Clear?
Feel free to contact us, and we will be more than happy to answer all of your questions.
Murat Guner joined the Riela Group in the Summer of 2021 as an Infrastructure Engineer.
Murat began his career in Turkey as a computer teacher for primary and secondary schools before migrating his skills into IT infrastructure. After honing his IT experiences throughout a colourful career path, Murat gained numerous qualifications which he is now excited to apply to the management of our Riela Tech infrastructure.
Andy is a qualified Network Engineer with in-depth knowledge of architecting, implementing and supporting networking solutions in the SMB, Enterprise and Service Provider environments.
He has over 20 years of experience working across multiple vendor operating systems, including Cisco, Juniper, Linux and Microsoft, and has also been responsible for implementing a variety of large scale network services deployments, taking projects from design to rollout and support.
Andy also has experience of deploying and migrating a range of virtualisation technologies including VMWare, Hyper-V and KVM based systems.
Email: andy@riela-cyber.com
Marc is our Group’s Infrastructure and Managed Services lead with over 18 years’ experience in delivering infrastructure projects across multiple industry verticals and international jurisdictions. From projects in Aerospace and Engineering through to Banking and Insurance, from Europe, China, Africa and Australia.
This experience is matched with a varied list of certifications from leading industry vendors such as Hp, Cisco, Microsoft, Ruckus, CompTIA and more. As a qualified technical trainer Marc is comfortably able to take complicated technical concepts and deliver them in simplistic terms to key decision makers and end users alike.
Most of Marc’s experience has been gained working for managed service providers, both large and niche and as such is able to take real world experience and blend it with industry standards to help align our service delivery with our clients values and processes.
As a Marketing Executive, Alex is responsible for all marketing duties spanning the Riela Group.
Alex joined the Riela Group in August 2020, shortly after graduating with a Psychology degree from Nottingham Trent University.
With past work experience in content marketing, event management and web design, Alex is able to apply her creative and analytical skills into the Riela strategy.
As the Head of Group Sales at the Riela family of companies, Matthew leads the company’s sales strategy, execution, and growth.
Matthew has a successful record building trusted client relationship and delivering upon set expectations. An accomplished sales leader, he delivers a sales process that provides clients with the information and support they need to make the right decisions for their organisations and their constituents.
Matthew has significant experience within the maritime industry having previously worked across various sectors including insurance, security, satellite communications and managed IT. Matthew’s most recent experience encompasses almost 5 years spent with the leading satellite communications and managed IT provider in the maritime industry, focusing on their superyacht clientele.
Christian is involved across the Riela family of companies with particular attention to the technology businesses, Cyber and Tech.
Christian gained a postgraduate Master in Finance degree at the University of Neuchatel, Switzerland and completed his MBA at the University of Chicago Booth School of Business.
Before joining us, Christian worked for six years at Argosy Capital, an Isle of Man-based private equity and venture capital business focusing on early-stage growth businesses. At Argosy, he focused on managing investment companies, research and financial analysis and served as a director on several boards.
Robert Tobin is the Managing Director of the Riela Group of Companies and is responsible in overseeing our business operations, our people and driving excellence in all we do.
Rob brings over 25 years’ of successful leadership and entrepreneurial experience across a range of industries including Family Office, corporate services, construction engineering, Superyachts, cyber security and information technology development to our Group, and to our customers.
In the past 15 years Rob has gained a prominent reputation within the Superyacht industry for his passion, integrity, innovation and achievements to date.
“Being part of an awesome, capable and forward thinking team that have a shared passion for Superyachts, people and the environment is the highlight of my career and puts a smile on my face and a spring in my step everyday”.
Peter is an experienced technology consultant with a demonstrated history of working in the IT and cyber security industry. Skilled in Search Engine Optimization (SEO), IT Strategy, Start-ups, Regulations, and Online Gaming. Strong consulting professional with a DPhil focused in Natural Sciences from ChristChurch, Oxford.
Tim Bliss, Managing Director of Riela Tech since the company foundation in 2015 and Director of Riela Cyber, brings over 20 years’ of successful leadership experience across a range of industries including finance and banking, software development, and manufacturing, as well as cyber security and information technology. Prior to forming the company he led the technology for Manx Financial Group PLC, where he was instrumental in business systems transformation.
“It is our hugely capable team of experts that drives our business – it is fantastic and rewarding to be able to use technology, intelligence, and great customer service to help make our clients’ business and staff progressively more efficient resilient and secure”
