5 Questions to Help SMEs with Their Cyber Security

You may also have other assets that are critical systems your business couldn’t operate without. For example, you may have a computer controlled manufacturing system and would start losing significant revenue if it stopped working for more than a week.

This asset list is unique and personal to your business. This isn’t something that can be delegated or outsourced to an IT service provider. They will most likely be unaware of the assets you use, and will certainly be unable to assess their criticality to your business. By spending some time developing this asset register you will be in a better position to decide what needs protecting and to what extent.

Q2: Are Your Users' Accounts Being Protected?

Your employees need to be able to access your assets in order to do their jobs. You finance staff need to access financial data, and your marketing team needs to be able to work on their campaigns. But because they can usually access sensitive data, if those user accounts were hijacked this same data will be fully accessible to the bad actor as well. This is why its so important to reduce the likelihood that anyone other than a genuine user can access their account.

The basic starting point is to make sure that your staff choose difficult passwords, don’t share them with anyone else, and never use the same password for different services. These rules will largely rely on a policy that you educate your staff to follow. But the single greatest improvement you can make to this aspect of security is to enable Multi-Factor Authentication (MFA). Sometimes called Two Factor Authentication (2FA) or Two-Step Authentication, this forces the individual not only to enter their password but also a one-time code that they might get by text message or from an app on their phone. It means that they are confirming their identity not only with something they know – the password – but also with something they have – their phone that is receiving the text or has the app installed.

The measures described above will strengthen authentication, increasing the confidence that the correct person is using an account and that it hasn’t be hijacked. But it is also important to make sure people only have the permissions they need to do their job. Limiting access to sensitive information further reduces the risks that it will be compromised if an individual account is broken into.

While an IT service provider may be able to put some of the authentication controls. But controlling who can access or change what – the authorisation part of the equation – is a business decision. While the execution might be delegated the decision making cannot.

Q3: How Secure Are Your Devices?

Your devices should, obviously, have anti-virus or anti-malware software installed, and up-to-date, to reduce the likelihood malicious code can be loaded or be able to run. But it has been a long time since this alone was sufficient to keep you even moderately safe.

Any software will have defects. When an application consists of hundreds of thousands or millions of lines of code, it is inevitable that mistakes will have been made. Some of these defects are weaknesses or vulnerabilities that an attacker can exploit to gain illegal access or control of the system. Every day new vulnerabilities are discovered in software. Sometimes they are discovered and reported by honest people as a result of their research and testing. But frequently they are only uncovered when a bad actor has exploited them to cause damage to an organisation.

The good news is that as vulnerabilities are discovered, the more reputable software companies work hard to update the code to remove them. If you always have the most up-to-date software running on your laptops, mobile phones and other devices then the risk of being attacked via a vulnerability is reduced significantly. Some of can be set to update automatically. The operating system, most web browsers, and many other pieces of software will regularly check for new versions and install them. But you need to ensure this feature is enabled. You also need to ensure that any obsolete software that is no longer being supported is removed, because no updates will be provided for new vulnerabilities when they are discovered.

Some software vendors are better than others at addressing vulnerabilities. For this reason it is important to make a conscious decision about what applications people can install on their devices and use for business.

A lot of the tasks described in this section can be made easier, with automated warnings and reports, by using additional tools or services. For instance, a Mobile Device Management (MDM) service – such as Microsoft Intune or Endpoint Management in Google Workspace – can enable you to manage all of the devices in your business and ensure that they are configured correctly. Similarly, a Vulnerability Scanner running on devices will alert you when devices running vulnerable software.

If you outsource your IT then most of the tasks described should be the responsibility of your service provider. But the risk will ultimately impact on your business, so it is important to ensure they are following good practice.

Q4: What If Your Assets Are Stored in the Cloud?

Increasingly your assets will be stored and processed in cloud services. This might be a single-purpose Software-as-a-Service (SaaS) application, like HubSpot CRM or Xero financial management. Or it could be broader cloud service, like Microsoft 365 or Google Workspace. You might also have other suppliers who process your data or interact with your systems. Regardless of the scope and scale, you will first need to decide whether you trust the vendor to protect your information that is in their custody.

The level of trust you need should be proportionate to the value of the asset, just as it is in the physical world. When you hand your clothes over to a dry cleaner you might want confidence that they will not damage them in the process, but may be comfortable receiving compensation if they do. But when you are selecting a child-minder you are likely to conduct significantly greater due-diligence before entrusting them with your child because the consequences of failure are significantly greater and compensation will offer little comfort. Conducting appropriate due diligence over suppliers who are handling your data may not be simple, but where the impact of things going wrong is high then it is an important task.

With cloud services the responsibility for security is shared between the customer and the service provider. For instance, the service provider is responsible for ensuring there is a secure method for users to log into the system, and that your data cannot be accessed by someone who has not logged in with the correct rights and permissions. But as the customer, it is your responsibility to make sure you only give access and permissions to the people who need it. It is also your responsibility to ensure your users don’t choose a simple password, or share it with anyone, and to enable MFA if that is available. The diagram below outlines where responsibility falls for the majority of cloud services.