Fatihah Ramzi, DigitalCFO Asia | 21 November 2022
Kevin Foo, Head of Cybersecurity at Exabytes
According to a survey conducted by the CyberRisk Alliance’s Business Intelligence Unit, about 2 out of 3 businesses in Singapore experienced at least 6 cyberattacks in 2021, with almost half of businesses not being able to respond within 24 hours. That delay in response is major too, as that delay caused these incidents to evolve into full on data breaches in almost 3 out of 4 cases.
As the world becomes more and more dependent on technology and information systems, cybersecurity has become critical for anyone to carry on with their daily lives. Despite that, most corporations are still clueless on how to manage cybersecurity, and are scrambling to prepare their defenses. Even big companies, such as Starbucks, Sembcorp Marine, and Samsung, are no longer safe from data breaches. And if these players, with their massive capital and resources, are having a hard time, what hope do small online businesses have?
To find out more about how SMEs’ can safeguard their data from cyber attacks, DigitalCFO Asia spoke with Kevin Foo, Head of Cybersecurity at Exabytes who believes that the best defense is to educate the public on cybersecurity and how to safely conduct business online. Hence, Exabytes wants to educate both its users and SEA as a whole on the dangers of cyberattacks, and what small startups, SMEs, and businesses can do to protect themselves.
Common Types Of Cybersecurity Threats That SMEs Encounter
SMEs commonly encounter cyber threats that hinder their ability to conduct business online, and can lead to severe disruptions of services. These types of cyber threats include:
- Malware Attacks, where malicious software (i.e. including worms, spyware, adware, and trojans) is uploaded into your system.
- Phishing attacks, wherein an attacker impersonates a contact and sends the victim fake mails to steal credentials, confidential information or trick victims to install malware.
- Ransomware attacks, where a type of malicious software is used to encrypt the victim’s files or disables basic system functions. Threat actors will then extort ransom payments in exchange for encryption keys to decrypt files or restore system functions.
- Distributed Denial-of-Service (DDoS) attacks, where attackers target systems, servers, or networks, flooding them with volumetric traffic to exhaust their resources and bandwidth. When this happens, online servers get overwhelmed, resulting in the business website either shutting down or slowing down.
Strengthening An SME’s Cybersecurity With All-In-One Business Cloud
As enablers for online businesses, it is crucial that service providers like Exabytes understand the cybersecurity needs of both users and the broader startup/SME community to develop solutions that can assist them, especially in this more tech dependent age. Exabytes, as an All-in-one Business, Cloud, Digital and Ecommerce solutions provider, has experience with cybersecurity products such as:
- Acronis Cyber Protect,
- Sucuri Website Security,
- SSL Certificate,
- SpamExperts
“We believe, with the right solutions and support, SMEs can be better protected against cyberattacks,” says Kevin Foo, Head of Cybersecurity at Exabytes.
It is essential that newer and smaller companies have the assurance to do their business online effectively and safely, without the threat of cyberattacks happening to them.
SMEs: Safeguarding Their Infrastructure & Continuity Of Operations With Minimized Threats
Regardless of market conditions, there are 2 important aspects of Cybersecurity that SMEs can look into to safeguard their infrastructure and ensure continuity of their business operations – human and technology.
Humans are always considered the weakest link in Cybersecurity. Considering that some cyberattacks hinge on social engineering, it is important to educate employees to create a risk-aware culture within the workplace and basic skills on Cybersecurity to protect themselves.
- Conducting training sessions will ensure that employees use only approved software and do not click a link directly from the email.
- Employees should not visit suspicious websites and always verify their legitimacy of a website by checking TLS certificate information.
- Ensure VPN is used whenever accessing company infrastructure.
SMEs can better protect themselves by adopting security technologies. Companies can enforce strong passwords with Multi-Factor Authentication (MFA) to further secure business accounts. On top of that, they should regularly update operating systems and applications, as that will eliminate vulnerabilities that hackers can exploit.
Additionally, they should implement layered protections to software and systems, such as endpoint protection software, firewalls, Web Application Firewalls (WAFs), intrusion prevention systems (IPS), email protection, access control, application security, etc. Companies should also consider deploying a data backup and recovery strategy and regularly testing on restoration to ensure business operational resilience. Protect data in transit with the use of encryption such as Transport Layer Security (TLS).
The First Line Of Action For SMEs Who Are Facing Security Breaches
A security breach occurs whenever any unauthorized user circumvents security control measures to access restricted systems or data.
“No one is spared from a security breach, no matter how strong your defenses are,” says Kevin Foo, Head of Cybersecurity at Exabytes.
Thus, it is important to learn how to handle security breaches. Below are just simple steps for reference:-
- Keep Calm
It is stressful handling security breaches, as there are stakeholders to be managed, and may potentially lead to financial losses for the company as a whole. Nonetheless, the incident should be managed in a calm and professional manner. Panicking will only make the situation worse.
- Identify what was breached and eliminate threats
When did the security breach happen? How did the threat actor get into the system? Was it financial data? Was it customer data?
These are some questions SMEs should ask after a security breach. It is essential to assess which system or data was breached. Systems should be secured or taken offline to prevent further security breaches. Remote access should be restricted and credentials should be changed.
- Keep information transparent
When a security breach happens, SMEs should not keep the breach a secret. Instead, it is critical to provide transparency on the breach. If notification to authority is required, SMEs should provide all the relevant information. Ideally, they should also create a team to handle the incident. This may involve lawyers, members of their human resources team, members of their communications department, as well as the SME’s management team.
- Get expert’s help or follow incident response plan
Typically, SMEs and startups have fewer resources and less sufficient technical expertise in handling security breaches. Thus, it is a good idea to seek external expert help (i.e. an Incident Response service) for proper incident handling. If an SME has an incident response plan, it is the time to put it into practice and update the plan accordingly as it will be a guide in the future.
- Enhance security controls
Restore the service with the vulnerability fixed, and work to continuously improve security controls or add layers of defense to better protect the system and data. This can further minimize the cyber threats.
