The Importance of SME Security in the Supply Chain

In Europe two out of every three employees are employed by SME organisations. However, when the topic of security and cybercrime is being discussed you would be forgiven for thinking that these businesses are in the minority, as the media (and to a large extent the vendors) focus on larger and wealthier enterprises.

It would be fair to say that for the majority of SMEs security issues do not feature heavily in their day-to-day thinking. After all, they are focused on running their revenue generating operations and why would they worry about issues that seemingly only ever happen to the ‘big boys’? And even if they do appreciate the risks, few have the time to keep abreast of the latest threat landscape and ways to safeguard against them.

The problem is however that cybersecurity is very much an issue for SMEs and the impact can be devastating. For one of those large organisations that hit the headlines it can inflict harm on their brand reputation if not managed correctly and it can cost many millions of pounds to resolve, as well as impacting the bottom line, but by and large they have the resources and infrastructure to bounce back. For a vulnerable SME a basic ransomware attack could spell the end of their business.

Of course, some of these attacks on high profile organisations are targeted, and the owner of an SME may counter with the question ‘Why would a cybercriminal be interested in me?’ To answer that question take a moment to think like a criminal. They specialise in finding weak links. Some, will be opportunistic and see an open door, or window, with a wallet left on the table unguarded.  Meanwhile, others will be far more calculated in their approach. Your business may not be the ultimate target but you may present the ‘open window’ through which they can get access to the organisation that is tempting them with a big score! You are just collateral damage. What is more, that organisation you are supplying certainly won’t thank you. 

Going after the weak link in the supply chain isn’t new (you may recall the now famous Lockheed Martin incident back in 2011). For this reason supply chain security has moved up the ICT agenda for large enterprises. So, for those SMEs who can demonstrate that they will not be the weak link, it could well be the point of difference that determines winning a major contract and losing out to a competitor.

Most SMEs do have a basic level of protection, but for many the only time it is mentioned is when the annual renewal of the anti-virus software comes around.

In today’s world of multiple always on, always connected devices it is the password that provides the first line of defence. Get hold of a password and all too often the cybercriminal has the keys to the candy store – confidential information, contracts and contacts, passwords and access to systems, and in some instances that can include third parties!

The challenge for an SME and especially those on the larger side of the spectrum is being able to manage passwords adequately. When someone creates a password they do so because they think they will remember it, not because they think it will be secure. Enforce more complex or so called ‘strong’ passwords and the cost of constant reset requests will go up. Worse still so does the likelihood that they will be written down on a Post-It note and stuck on the side of a monitor (insider attacks can and do happen). Ask them to change their passwords frequently and it will inevitably be a variation on the same theme so DavidSmith1! becomes DavidSmith2!

Large security conscious organisations (and I stress that not all of them are) invest in additional layers of security, such as key-ring tokens and even biometrics, but they introduce complexity, are expensive, are resource intensive to manage and out of reach for most SMEs. What is more, many of them will revert back to password-based authentication if they fail! However, thankfully there is a new breed of innovative and affordable software-based solutions on the market that can give small and large organisations alike the same calibre of first-line defence, replacing passwords without massive change, closing what has until now been an easy door to walk through for the determined cybercriminal.

If you would like to learn more about how to safeguard your supply chain visit: www.pingrid.com

Author: Steven Hope, CEO of Winfrasoft