Small and medium businesses are falling behind on cyber security governance at a time when serious incidents have risen sharply, a leading expert has warned.
It comes as the number of attacks is running at an average of 1,589 per week for UK organisations, as recorded in June this year – up 34%, double the global growth rate.
Roy Shelton, Group CEO of managed services provider Connectus Business Solutions, commented: “The average UK organisation is having to fend off a huge number of attempts to breach their cyber defences every week, yet official figures show that smaller firms are going backwards.
“Fewer small businesses are carrying out risk assessments, maintaining a cyber security policy, or planning how they’d keep trading after an attack. It’s a dangerous time in terms of world security and the UK is the top European target for ransomware gangs.
“Cyber compliance is not about box-ticking. Cyber Essentials certification means covering the basics that will stop most attacks but just 12% of businesses hold it and only 25% have a formal plan for recovering from a cyber breach.
“Criminal gangs are well aware of these gaps. Big brands that get hit make the headlines, but it’s smaller businesses that are least able to absorb the damage.”
The government’s own figures show that nationally serious incidents, as reported by the National Cyber Security Centre, rocketed from 89 to 204 last year.
To get the fundamentals in place, Mr Shelton recommends:
Multi-factor authentication – also known as two-factor authentication, this is where you have to confirm your login with a code that’s often displayed on a phone app or sent by text message. It adds another layer of security and will greatly enhance your defences against hackers attempting to access systems.
Prompt patching – Unpatched software is a top attack vector for hackers exploiting known vulnerabilities. Enable automatic updates on all devices and servers. Regularly review and retire unsupported systems. Maintain an inventory of all hardware and software to track patch status.
Staff awareness – Staff are your first line of defence. Regular training helps them spot phishing attempts and social engineering tactics before damage is done.
Incident response plan – have a clear, tested plan for how your business would respond to a breach.
Mr Shelton added: “Attack remediation can begin immediately and the incident managed professionally, if a business uses a reputable managed service provider (MSP) or security partner to monitor and respond to threats.
“Connectus clients are covered by Cyber Essentials Plus and ISO 27001 certification so the baselines are covered.”