Phishing most common Cyber Incident faced by SMEs

Small and medium-sized enterprises (SMEs) are considered to be the backbone of Europe’s economy. 25 millions of SMEs are active today in the European Union and employ more than 100 million workers.

The report “Cybersecurity for SMEs” ENISA issues today provides advice for SMEs to successfully cope with cybersecurity challenges, particularly those resulting from the COVID-19 pandemic. As a result, traditional businesses had to resort to technologies such as QR codes or contactless payments they had never used before. Although SMEs have turned to such new technologies to maintain their business, they often failed to increase their security in relation to these new systems. Research and real-life experience show that well prepared organisations deal with cyber incidents in a much more efficient way than those failing to plan or lacking the capabilities they need to address cyber threats correctly.

Juhan Lepassaar, EU Agency for Cybersecurity Executive Director said: “SMEs cybersecurity and support is at the forefront of the EU’s cybersecurity strategy for the digital decade and the Agency is fully dedicated to support the SME community in improving their resilience to successfully transform digitally.”

In addition to the report, ENISA also publishes today the leaflet: “12 steps to securing your business”. The short cybersecurity guide provides SMEs with practical high-level actions to better secure their systems, hence their businesses.

Based on an extended desktop research, an extensive survey and targeted interviews, the report identifies those pre-existing cybersecurity challenges worsened by the impact of the pandemic crisis.

Key findings

85 % of the SMEs surveyed agree that cybersecurity issues would have a serious detrimental impact on their businesses with 57% saying they would most likely go out of business. Out of almost 250 SMEs surveyed, 36% reported that they had experienced an incident in the last 5 years. Nonetheless, cyberattacks are still not considered as a major risk for a large number of SMEs and a belief remains that cyber incidents are only targeting larger organisations.

However, the study reveals that phishing attacks are among the most common cyber incidents SMEs are likely to be exposed to, in addition to ransomware attacks, stolen laptops, and Chief Executive Officer (CEO) frauds. For instance, with the concerns induced by the pandemic, cyber criminals seek to compromise accounts using phishing emails with Covid-19 as a subject. CEO frauds are other decoys meant to lure an employee into acting upon the instructions of a fraudulent email displayed as if sent from their CEO, and usually requesting a payment to be performed in urgency under business-like circumstances.

The report unveils the following challenges SMEs are faced with:

Low awareness of cyber threats;
Inadequate protection for critical and sensitive information;
Lack of budget to cover costs incurred for implementing cybersecurity measures;
Availability of ICT cybersecurity expertise and personnel;
Absence of suitable guidelines tailored to the SMEs sector;
Moving online;
Low management support.

How to address those challenges?

The recommendations issued fall into three categories:

People

People play an essential role in the cybersecurity ecosystem. The report draws the attention to the importance of responsibility, employee buy-in and awareness, cybersecurity training and cybersecurity policies as well as third party management in relation to confidential and/or sensitive information.

Processes

Monitoring internal business processes include performing audits, incident planning and response, passwords, software patches and data protection.

Technical

At the technical level, a number of aspects should be considered in relation to network security, anti-virus, encryption, security monitoring, physical security and the securing of backups.

Target audience

The report intends to deliver actionable guidance to the owners and employees of SMEs. In addition, this work can be of use to other entities involved in the SME ecosystem, such as SMEs national and European associations, policy makers and implementers, SME ICT providers and others.

Background

For nearly 15 years, the EU Agency for Cybersecurity has been pushing forward cybersecurity initiatives to assist SMEs to integrate cybersecurity into their digital environments. Starting in 2006 and 2007, the Agency published two Information Package for SMEs reports, providing risk assessment and management methodologies for SMEs. In 2010, the Agency published the Business Continuity for SMEs report to help facilitate IT knowledge transfer to SMEs. In 2015, the Cloud Security Guide for SMEs report was released to assist SMEs understand the security risks and opportunities regarding cloud services. Two years later, the Agency published the Guidelines for SMEs on the security of personal data processing.

The EU Agency for Cybersecurity released last year a series of tips to help businesses face the rapidly changing digital sphere during the pandemic: Tips for selecting and using online communication tools; Tips for cybersecurity when buying and selling online; Tips for cybersecurity when working from home; Top ten cyber hygiene tips for SMEs during covid-19 pandemic. The EU Agency for Cybersecurity and the National Cyber Security Alliance published a joint checklist for SME in November 2020, offering businesses on both sides of the Atlantic a basic guide to maintaining digital security.

Further Information