In a noticeable shift in threat actor behavior, small and medium-sized businesses (SMBs) are increasingly finding themselves targeted by cyber threats. This may be caused due to the complexity of threats and increasing difficulty for SMBs to protect against them. No matter the reason, SMBs are more concerned about cyber attacks than ever, with 78% saying they fear cyber attacks could shut down their business. As there are no signs of this trend slowing down, members may wish to review the common challenges facing SMBs and what to do about them.

SMBs face all sorts of common cybersecurity challenges including limited resources, lack of awareness and training, sophisticated threats, regulatory compliance, incident response and recovery, third-party risks, technology obsolescence, lack of cybersecurity strategy, and vendor management to name a few. Addressing all of these challenges can seem overwhelming, but by taking reasonable steps toward basic cyber best-practices, SMBs can significantly lower their chances of being involved in an incident.

Reasonable actions SMBs can take to significantly bolster cybersecurity:

• Implement security awareness training, particularly around phishing awareness
• Require strong passwords
• Require multifactor authentication
• Regularly apply software updates

One resource utilized by many SMBs are Managed Service Providers (MSPs). As the above-mentioned challenges continue, MSPs are becoming a more and more necessary tool for SMBs as they allow these organizations to leverage more sophisticated security tools and techniques that may be otherwise unattainable for them. Members may wish to review criteria to consider when evaluating an MSP to make sure it’s the right thing for them. For more details on this topic, visit SecurityWeek.

Additional WaterISAC Resilience Shares:

• Cyber Resilience During National Small Business Week | April 30
• Security Awareness – The Importance of Adapting Phishing Training Methods | May 9
• Cyber Resilience – 4-Steps to Mapping and Securing Organizational Critical Assets | May 28 
• Ransomware Resilience – NCSC Shares Guidance for Organizations Considering Payment in Ransomware Incidents | May 14
• Ransomware Resilience – Strategies for Improving Attack Outcomes | June 4
• Ransomware Resilience – Utilize CISA’s Ransomware Vulnerability Warning Pilot (RVWP) | May 2