87% increase in data stolen during cyber attacks on UK businesses
The cost to businesses of data breaches resulting from cyber attacks has risen in the last year, with the number of records stolen increasing by 87%, according to research by online security analysts the Ponemon Institute. The average total cost of a cyber attack on an SME is over £1m ($1.32m), and the number of records stolen has risen from 5,000 last year to over 9,000 this year, according to the reports. More than half of those who responded to the survey reported that the main cause of such breaches was poor password security by employees.

The overwhelming majority of cyber attacks on small to medium-sized enterprises (SMEs) result from poor password management, a study of 1,000 UK and US SMEs by the Ponemon Institute shows.

Despite this fact, SMEs are doing very little to boost visibility into the password practices of their employees, according to the study sponsored by password management firm Keeper Security.

The study report said employee negligence is the top root cause of successful data breaches.

“Survey respondents believe cyber attacks are becoming more targeted, more severe in terms of consequences, and more sophisticated,” said Larry Ponemon, chairman of the Ponemon Institute. “So you would think things would be getting better in terms of protecting themselves, but they are really trending to worsening.”

According to the survey – 61% of respondents reported a cyber attack, up from 55% a year ago – while 54% reported a data breach, up from 50% a year earlier.

Ransomware attacks were reported by 52% of respondents, with 53% of those reporting they were hit by more than one ransomware attack.

The total costs associated with successful cyber attacks on SMEs now total well in excess of £1m, meaning a single attack could bring an SME to its knees financially.

Amount of stolen records on the increase Not only has the cost of data breaches risen to an average of just over £1.2m including all attack mitigation and business disruption costs from £717,909 a year ago, but the average number of records stolen has soared from just over 5,000 per attack last year to 9,350 this year – an 87% increase. While 54% of respondents say the root cause of the attacks are negligent (not malicious) employees, a full third of the companies surveyed could not even determine the root cause. An ongoing lack of attention to password usage underlies much of the cyber security woes at SMEs, the study said, referring to the latest Verizon Data Breach Investigations Report, which noted that 81% of all cyber attacks result from poor password management practices. Read more about SME security SMEs are failing to address cyber threats despite the risks.

The UK government has announced initiatives aimed at boosting SME cyber security, promoting the cyber security profession and supporting cyber security innovation projects.

SMEs typically face the same threats as bigger organisations, but lack the same level of expertise and other security resources.

The London Digital Security Centre has been set up by the Mayor’s Office for Policing and Crime as part of the mayor’s business crime strategy. The latest Ponemon research shows that 59% of respondents said they have no visibility into their employees’ password practices, which is unchanged from a year ago. Among the bad practices cited are using the same passwords for access to multiple accounts and servers; sharing passwords in highly insecure ways; and failing to use strong passwords, settling instead for 123456 or other very easily compromised passwords. Less than half – 43% – of SMEs surveyed have any sort of password policy in place. And of those that do have such a policy in place, 68% (up from 65% last year) said they either do not strictly enforce the policies or are unsure if they are enforced. “SMEs can respond to this overall situation by quickly establishing mobile device and BYOD [bring your own device] internal control policies,” said Darren Guccione, Founder and CEO of Keeper Security. “Then implement software that controls the information being protected and transacted via these and other devices. The combination of password management software and enterprise mobility management tools can mitigate up to 80% of the cyber risk those devices pose,” he said.

Greater data protection implementation needed According to the study, SMEs need to implement greater data protection beyond the “traditional” protection tools, with two-thirds of respondents reporting cyber attacks that evaded the company’s intrusion protection defenses, up from 57% a year ago, and 81% reporting such attacks evading traditional antivirus defences, up from 76% last year. The Ponemon study shows that the top barriers to adopting better cyber defences are: a lack of trained security staff (73%) and inadequate budget (56%). However, the report said given the enormous costs associated with a data breach, failing to protect against today’s dynamic threat environment could prove disastrous, and the costs associated with doing so may not be as high as imagined. “There is more great protection software targeting SMEs today than ever before,” said Guccione. “The cost-to-benefit spread in terms of value to what the real risks are, and in consideration to how productivity can actually be enhanced with the right software solutions, puts better protection well in reach of SMEs.” For example, he said, by implementing a comprehensive password management system, many organisations have experienced a marked decline in helpdesk calls related to lost or forgotten passwords.

SMEs targeted through phishing The Ponemon research into the rising incidence of ransomware attacks on SMEs noted earlier found the attacks were unleashed 79% of the time through phishing or other social engineering, most notably burying harmless looking clickable URLs into a scam email. A prime defense against this, said Guccione, can be ongoing phishing simulations to try to educate negligent employees. Organisations polled also exhibited high levels of concern over security breaches caused by internet of things (IoT) devices. They notoriously lack security mechanisms and typically come with no mandate or set of requirements regarding password length or strength or whether they should have single or two-factor authentication. Nearly a quarter of respondents reported an IoT-related data breach, with two-thirds reporting feeling “concerned or very concerned” about their lack of security. In fact, 56% said IoT and mobile devices represent the most vulnerable endpoints in their organisations. London is taking the lead in the UK by helping to make the city’s small businesses, which number more than one million, safe from cyber crime through the London Digital Security Centre (LDSC). The centre was set up as a not-for-profit organisation in 2015 by the Mayor’s Office for Policing and Crime (Mopac) and is run as a joint venture between the mayor of London, the Metropolitan Police and the City of London Police. The LDSC provides a free cyber security assessment and improvement programme for SMEs and created a “marketplace” of selected products and services to help London’s businesses protect themselves.