Cybersecurity for small businesses

August 7, 2023

Small and medium-sized enterprises (SMEs) are the backbone of the world’s economies, accounting for almost 90% of businesses and over half of all employment, according to the World Bank.¹ As many SMEs rapidly digitized in response to the challenges of Covid-19, an unfortunate side effect has been an equally rapid rise in their vulnerability to cybercrime.

SMEs are key targets of cyberattacks since they have limited resources and are unable to invest in robust security systems. Breaches of SMEs grew 152% in 2020 and 2021 compared with the prior two years—a figure twice as big as that of larger companies over the same period.² Equally challenging is that post-breach remediation is disproportionately more expensive for SMEs relative to their size than for larger businesses.³

Breaches of SMEs grew 152% in 2020 and 2021 compared with the prior two years.

A combination of economic importance and vulnerability to cybercrime make SMEs an important focus for governments. Whether it is through risk identification & quantification, risk management tools, or education, governments can ensure a more resilient ecosystem by strategically investing resources that bolster the security and resilience of SMEs. To that end, governments can play a coordinating role in this ecosystem, where they act as the central node with interconnected lines running between SMEs.

Evolving notions of cybersecurity demonstrate how the concept of ecosystem resilience is evolving from a “me versus them” mentality to a collective “us”, establishing a financially efficient herd immunity across governments and businesses. The concept derives from how a sprawling payment network secures the connected members of its ecosystem. Payment networks add value to their participants by managing cybersecurity across the network, an approach that governments, should look to replicate for the SMEs driving their economies.

While the perpetrators, including state-sponsored hackers or private criminals, and the aims, such as state-wide disruption or financial gain, may differ based on target, the attack techniques on governments and SMEs are largely the same. The tools already exist for governments to deploy advanced cybersecurity solutions to protect themselves. The next step is to share that protection across SMEs by harnessing the collective security of a payment network, leveraging the technology expertise and ensuing economies of scale.

The impacts of Covid-19 on customer interactions and daily operations drove many SMEs to shift all or most of their business operations online (figure 1):

Figure 1: Percentage of SMEs reporting to have shifted all or most of their businesses online since the onset of Covid-19 (source: Ipsos 2022)⁴

The shifts were often a question of survival and were not without challenges. Gaps in digital capabilities impeded many SMEs from efficiently serving customers and securing their digital infrastructure. With ramifications going beyond individual SMEs to affect entire economies, government assistance was often provided:

• SMEs in Ireland with up to ten employees and annual revenues of less than €2 million were eligible to receive grants of up to €2,500 to develop e-commerce or online trading platforms to help digitize and expand internationally. More than 2,000 SMEs benefited from the program and reported average increases of 20% in sales and 80% in sales leads. Three in five participating SMEs began to export for the first time, and 35% reported an increase in employment.⁵ Based on the success of the program, the government conducted a second round of the program in 2022.⁶
• As part of a $250M commitment to support SMEs through the pandemic, Mastercard launched the Digital Doors program in partnership with the Asian Business Association of San Diego, the New York City Department of Small Business Services’ Black Entrepreneurs NYC (BE NYC) initiative, the New Orleans Business Alliance, and the St Louis Development Corporation.⁷ Digital Doors provides SMEs with diagnostic tools to help them assess the digital preparedness of specific areas of their operations, such as payments capabilities and cybersecurity.

Government support through these and many other programs was critical to keep SMEs and the economy afloat during the peak of Covid-19’s impact, but there is more work to be done. Governments and SMEs need to continue to work together to secure this new digital infrastructure. Without a joint, coordinated, scaled effort, the impact of increasing cyberattacks may be severe.

The number of cyberattacks per company is increasing globally: 31% year-over-year in 2021, according to one estimate.⁸ And 69% of respondents to a 2021 global survey of C-level executives noted a significant increase in cyberattacks following digital transformation at their companies.⁹ The rapid rise in digitization during the pandemic has widened organizations’ points of vulnerability, with SMEs as frequent targets.

Top attacks on SMEs (2022 to mid-2023)

1. Phishing
2. Malware to steal data or gain backdoor access to systems
3. Ransomware to encrypt or exfiltrate data and hold it hostage
4. Credential access attacks via brute force or compromised usernames
5. Supply-chain attacks mainly via third-party software

The top three attacks on SMEs from 2022 to mid-2023 were phishing, malware to steal data or gain backdoor access to systems, and ransomware to encrypt or exfiltrate data and hold it hostage. Perhaps most alarming is the rise in use of ransomware by organized crime groups and by individual “blackhats” who rent usage via ransomware as a service (RaaS). The focus until a few years ago was “big game hunting” (BGH) on the assumption that larger businesses would pay out more. In 2021, governments started noticing the attacks occurring on SMEs as well.¹⁰

Around 70% of SMEs responding to a 2022 multi-country survey now expect the impact of a ransomware attack to be significant or worse.¹¹ Among them, 17% suggest it would be difficult to recover from one.

Third-party risk

The impressive speed with which many SMEs shifted online often came at the expense of updating security protocols. Innovative technologies are essential to business success, but most SMEs lack sufficient resources to effectively protect themselves.

The interconnectedness of businesses today also means SMEs need to pay as close attention as large organizations to their third-party providers. In addition to broader concerns for the national economy, governments have a vested interest since their third-party contractors are often SMEs themselves.

Unfortunately, third parties tend to be an afterthought in many cybersecurity policies, and fourth parties and beyond are often ignored entirely. The fifth most common attacks on SMEs between 2022 and mid-2023 were supply-chain attacks that mainly involved third-party software.

Prime target or easy target, a breach affecting seemingly innocuous data can rapidly infect other data and spread into other organizations. Better protected SMEs can help large businesses and the overall economy as well by contributing to a more resilient ecosystem with reduced third-party risk.

1. Risk quantification

Governments must find partners that can help them mitigate the cyber risks in their economies and build ecosystem resilience. This can be done by educating SMEs about the risks involved with increased digitization and how to respond systematically. Instead of inefficient manual approaches, SMEs can stay ahead of perpetrators with ongoing cycles of quantifiable risk identification. The quantifiable self-assessments may be customized internally for specific business needs and contextualized externally based on ever-evolving threats. Government entities can use the outputs to elevate the overall cyber resilience of the broader business ecosystem.

Regional views and sector-by-sector benchmarks can identify high-risk sectors, perform benchmark analyses for potential exposures and risk, and assess individual organizations’ assessment results. Cyber Quant, Mastercard’s online self-assessment platform tailored for SMEs and governments, empowers users to understand their cyber risks as a first step toward greater ecosystem security. It works in combination with Mastercard’s Cyber Insights, which elucidates the who and why, or attribution and motive, of ongoing and future threats.

2. Risk management

Breach & attack simulations, such as those offered by Mastercard Cyber Front, may then follow risk identification with risk detection by copying cyberattacks before perpetrators even have the chance.

The concept isn’t new; wargame simulations have formed part of military strategy for years. But cost-effective cybersecurity versions have been unaffordable for businesses until recently. The simulations then create virtuous loops by providing enhanced data for risk identification that in turn feed the simulations. Further inputs come from automated detection of third-party risks associated with web presence.¹² A solution such as Mastercard’s RiskRecon conducts third-party risk management non-invasively to enable proactive engagement with vendors around custom risk remediation.

Bavaria uses Mastercard’s RiskRecon solution as part of a project to assess over 1,000 businesses.¹³ The project enables businesses to understand potential cyber threats and helps raise awareness around how the Bavarian government can promote cybersecurity for SMEs in Bavaria and in surrounding municipalities.

3. Risk education

A third fundamental component critical to SME resilience is risk education to establish a common understanding and knowledge of the cybersecurity ecosystem. Some of that education may be directed toward the providers of cybersecurity to ensure a consistent approach, but the principal focus is on the SMEs themselves to rally them around a unified approach.

Several global and regional initiatives follow that approach:

Curated online resources and tools can also help lay out how organizations can defend their critical assets and reputations. For example, the Mastercard Trust Center offers centralized access to free education, tools and offers guidance around related services, such as cyber insurance.