The role of partners in SMB Cybersecurity

Due to the cybersecurity skills gap, many SMBs lack the resources and time to actively maintain a strong security posture across siloed network ecosystems, making it easier for cybercriminals to bypass basic controls and gain access to their networks.

SMB customers’ concerns regarding cyberattacks are warranted, especially as Verizon’s 2018 Data Breach Investigations Report found that 58 percent of all breaches in the past year occurred at small businesses – exceeding those at large corporations. Today’s cybercriminals are leveraging a variety of sophisticated cyberattacks across the kill chain. These complex capabilities — which move at rapid, machine speeds — have the potential to cripple small- and medium-sized businesses. To actively address your SMB customers’ unique needs, partners must understand the modern threats targeting these organizations.

In our Global Threat Landscape Report, we identified several notable threats that have the potential to seriously affect SMBs. To successfully secure your customers, it’s important to be aware of the following risks:

Threat development continues to be a priority: Modern cybercriminals are no longer gauging the merit of their attack capabilities based solely on their effectiveness at breaching network security. Instead, they’re also weighing attack capabilities against the overhead required to develop, modify and deploy them. The threat landscape’s growth is the result of cybercriminals continuing to focus on effective, affordable and scalable attack methods. In the third quarter of 2018 alone, unique malware variants grew a staggering 43 percent, with unique, daily malware detections rising 62 percent. These unique variants, combined with the 32 percent increase in malware families, demonstrates continued experimentation and capability expansion by modern cybercriminals.

Mobile and the IoT are the primary threat vectors: As SMBs continue to engage in digital transformation, a myriad of mobile, IoT and BYOD devices are being rapidly introduced to network infrastructures. While these devices allow your customers to better meet the demands of their customers, unless properly secured, they also open up a variety of threat vectors that cybercriminals are keen to exploit. For example, our third-quarter threat data indicated that 26 percent of all detected malware was mobile-based. Moreover, we’ve identified malware targeting and compromising IoT devices such as cameras, printers, routers, etc., that are then being used as botnets with command and control infrastructures that allow them to rapidly expand across networks.

Evolving cryptojacking: Given the rise in IoT and mobile device adoption, it makes sense that we’ve also seen an increasingly sophisticated variety of cryptojacking capabilities enter the threat landscape. Now, modern crypto attacks – which have risen 38 percent since our last report – have the ability to disable existing security solutions, exposing networks to attack from other sources.

Exploits are focusing on encrypted traffic: As more and more SMBs shift to SSL-encrypted traffic, cybercriminals have begun to capitalize on the general assumption that because traffic is encrypted, it is inherently secure. As a result, we’ve seen a dramatic increase in the Pushdo botnet, which is used to spread DDoS attacks across networks leveraging SSL-encrypted traffic.

Modern Challenges Facing SMB Cybersecurity

As cybercriminals continue to shift their attack capabilities to capitalize on weaknesses found across the attack chain, partners must understand the unique challenges facing their customers and how these expanding cyberattacks aim to take advantage of these challenges. In doing so, partners will be better equipped to provide the tailored cybersecurity recommendations that address these threats and challenges. With this in mind, consider the following SMB-focused cybersecurity challenges:

The cybersecurity skills shortage: While the cybersecurity skills gap is a growing trend affecting organizations of all sizes, SMBs are particularly impacted. Unlike organizations at the enterprise level, SMBs often lack the resources needed to hire a full-fledged network security team. As a result, IT professionals looking for openings often focus their attention towards larger-scale organizations that have greater resources available to them.

Point product and legacy solutions: With limited resources and staff, many SMBs still rely on legacy and point product solutions to conduct their threat analysis, identification and mitigation. However, these solutions require individual analysis, patching and updating to maintain relative effectiveness. Due to the cybersecurity skills gap, many SMBs lack the resources and time to actively maintain a strong security posture across these siloed network ecosystems, making it easier for cybercriminals to bypass basic controls and gain access to their networks.

Less training and less strict cybersecurity hygiene: SMBs often assume that their comparatively small size leaves them at less risk for cyberattack. As a result, many don’t invest in adequate training. While larger organizations may have resources to train IT professionals and can emphasize the importance of maintaining proper cybersecurity hygiene, many smaller organizations do not. This leaves many SMB customers open to common human-error related attacks such as phishing, baiting and other cyber scams.

The role of partners in SMB Cybersecurity

For SMB organizations that do not have devoted IT and security teams, the process of evaluating the components of their distributed network, determining where security risks exist, prioritizing those risks, and then selecting and deploying the appropriate tools to mitigate those risks is daunting. Without a proper understanding of where their network is weakest, it is likely that these SMB organizations will end up deploying a patchwork of isolated point solutions. While deploying security tools across each potential entryway has the right intention, the lack of integration can actually reduce visibility and leave gaps in security.

When it comes to security management even large organizations that have devoted IT and security teams still have difficulty monitoring the network to keep track of which devices are connected, who has access to data, where that data is stored, and what resources applications and workflows need to access—in addition to responding to security events. For SMBs, managing all of this with limited IT resources is nearly impossible.

Another significant vulnerability associated with an SMB customer is that of poor threat intelligence. By equipping customers with the latest threat intelligence, partners can ensure effective security postures that account for the unique network ecosystems of their customers while addressing the threats and challenges facing SMBs today.

Partners have a huge business opportunity in addressing the security concerns of SMBs helping them to leverage threat assessments, provide expertise, streamline onboarding, and help in centralization and management to reduce the complexity of the process and inbuild shared threat intelligence to help enhance their security posture to grow their business.

Rajesh Maurya
Regional Vice President, India & SAARC, Fortinet.