Kevin McMahon, CEO of Cyjax Limited, discusses the ever-looming threat of cyberattacks facing small and medium-sized businesses today.
In March 2021, an important new report on national defence and foreign policy in the UK was published – ‘Global Britain in a Competitive Age’.1 While in the report there is a focus on traditional forms of defence and the promise of an increase in spending, there is a noticeable emphasis on the cyberthreats the UK faces.
These cyberthreats now include the development of adversarial nation-state cyber capabilities along three prongs. Firstly, exploitation and attacks which target and paralyse national critical infrastructure – specifically, ransomware and data destruction attacks which inflict devastating financial costs on corporations and the insurance industry. Secondly, hostile nation states will continue to support long-running cyber espionage operations focusing on the theft of government and commercial information. Finally, significant capabilities creating and propagating highly influential and damaging disinformation campaigns aimed at destabilising the political system have been observed.
Russia and China were identified in the report as posing the greatest threats to the UK. It is no coincidence that these two countries were singled out. State-sponsored threat actors from both nations have been engaged in offensive cyber-related activities for many years, carrying out well-documented and widely publicised cyberattacks against western organisations. Both have been accused of conducting hugely damaging campaigns against government and corporate websites worldwide.
The vulnerability of SMEs to cyberattacks
At the start of 2020, there were nearly six million small businesses (0-49 employees) in the UK, making up 99.3% of the total count of commercial companies. They account for three-fifths of UK employment and around half the turnover of the private sector. Small and medium-sized enterprises (SMEs) employ 16.8 million people and have a turnover estimated at £2.3tn. Cyberattacks are putting many jobs, as well as economic activity, at risk.2
Given this global threat, one can quickly see that SMEs are firmly in the crosshairs of cybercriminals equipped with nation-state capabilities and sheltered by hostile governments who protect and mentor these malicious actors. In a speech to the Chatham House thinktank, Lindy Cameron, Chief Executive of the National Cyber Security Centre (NCSC), said: “Cybercriminals from Russia and neighbouring states are behind the majority of online extortion conducted against businesses and other organisations in Britain.” She added that ransomware “presents the most immediate danger” of all cyber threats faced by the UK.3
Nothing underscores this situation more than the devastating combined impact of the COVID-19 pandemic travel restrictions and a ransomware attack on the currency exchange firm Travelex. Having suffered a ransomware attack which caused a month of disruption, the firm fell into administration six months later, was forced to restructure and make over 1300 staff redundancies.4
An alarming situation
The current cyber situation facing the engine of the UK economy – the SME – is both alarming and dire.
According to Arctic Wolf’s research, “Three quarters (73%) of UK small and medium-sized business leaders think their workforces lack the capability and expertise to withstand a cybersecurity attack.”5
The Department for Digital, Culture, Media & Sport’s (DCMS) latest data shows that “Four in ten businesses (39%) and a quarter of charities (26%) report having cybersecurity breaches or attacks in the last 12 months.”6 Admittedly, there has been a slight improvement in the numbers DCMS reported in 2020; however, this is strong evidence that there is a long road ahead to secure our digital future and recovery from the pandemic.
The question is, what investment do SMEs need to make to reduce the odds of appearing as another breach statistic in DCMS’s forthcoming 2022 report? But, even more specifically, if your business is targeted by cyber criminals, how would you even know before your data is encrypted and the inevitable demand for a ransom payment is made? What is the solution? Even these questions are constrained by the economic reality: the average annual cost for SMEs that have lost data or assets after breaches is only £8,460 – a small number for large enterprises, but impactful for many small firms.7
Unfortunately, that £8,460 does not address any of the potential long-term costs associated with a data breach event, especially if the reputational damage is severe enough to cause an important customer or supply-chain partner to abandon your company and seek products and services elsewhere.
Cyjax researchers have identified several cybercriminal groups that buy data from breached organisations on the dark web to utilise it to conduct scams and frauds using stolen documents and identities.
Cyjax believes in taking a more budget-friendly, proactive approach to SME organisational cybersecurity – one that is intelligence led. Generally, threat actor behaviour is predictable: phishing emails, credential compromise and automated attacks against your organisation’s infrastructure are all part of the cybercriminal’s toolkit. The information is online if you know where to look for it.
How Cyjax can help you
The problem in cybersecurity is not that there is not enough information. It is, in fact, the opposite: there is an overwhelming amount of it out there. In simple terms, ‘information’ + ‘context’ = intelligence. Cyberattacks happen all over the world in the tens of thousands per minute. We believe what you need to know about are the attacks that are dangerous to your business and put your organisation at risk. We have built something that can solve that problem.
Cyjax was formed in 2012. Working closely with the financial sector, we developed technologies and methodologies to help stem the advance and danger of cyberthreats impacting banks and consumers around the world. We quickly established ourselves as a leading provider of cyberthreat intelligence capabilities across all industry verticals – a journey we continue today.
CyberCheck® is Cyjax’s state-of-the-art cyberthreat intelligence service. It is our latest offering – and is designed specifically for the SME. It provides real-time attack monitoring and alerting, automated phishing attack takedown, and credential and supply-chain compromise warnings, all in a simple, easy-to-understand format.
You can find more details here: www.cyjax.com/cybercheck
About the author
Kevin McMahon is a co-founder of Cyjax and became CEO in June 2018. He has spent most
of his time working as a technical solution architect and engineer with specialist experience in delivering SaaS and IaaS products. With 22 years of relevant industry experience, he is a member of the academic advisory board at the Centre for Doctoral Training in Cyber Security at Oxford University and a strong supporter of the information security community.
References
2. www.openaccessgovernment.org/smes-need-to-confront-the-threat-of-ransomware/113594/
4. www.theguardian.com/business/2020/aug/06/travelex-falls-into-administration-shedding-1300-jobs
6. The Department for Digital, Culture, Media & Sport’s (DCMS) latest data shows that “Four in ten businesses (39%) and a quarter of charities (26%) report having cyber security breaches or attacks in the last 12 months.”
Please note, this article will also appear in the eighth edition of our quarterly publication.
