CYEN: SMALL COMPANY WITH GLOBAL PERSPECTIVE

Cybersecurity and digital culture are the field in which CyEn helps small and mid-size companies through effective bespoke strategies and services. Iva Tasheva, co-founder of the small family enterprise, shares more on what cybersecurity looks like in 2023.

What's the most important thing SMEs need to know about their cybersecurity in 2023?

With 50% of SMEs going out of business 6 months following a data breach and 90% of 2021 data breaches due to human error, they are left on the top of the coin chance of survival unless cybersecurity awareness and training improve.

Google study found that 43% of SMEs acknowledge to have experienced a cyber attack in the last 2 years. Supply chain attacks continue to grow, and the discovery needs to improve. Currently, breach identification takes more than 212 days, with supply chain attacks taking longer.

With digital identities gaining traction and accessing more services, we expect the identity theft trend to grow.

If not secure, IoT devices could all be used in a massive cyberattack on any business. The progressive development and deployment of advanced technologies, such as cloud computing, AI, quantum computing, robotics and advanced manufacturing, create further urgency to develop technology with a cybersecurity-by-design approach.

Working-from-home cybersecurity continues to be a priority for businesses as personal IT devices lack the necessary level of security as office-based ones. Businesses pursuing a work-from-home business model will have to invest more in this in 2023.

Ransomware slowed down its exponential growth after the 2021 international law enforcement campaigns and arrests, yet the danger remains.

EU cybersecurity legislation could further incentivise private and government organisations to invest in cyber resilience. EU and national governments budgets will start fuelling cybersecurity investments through the Recovery and Resilience Facility.

What are the key steps a company needs to take to be sure of its cyber resilience?

Cybersecurity is about ensuring the confidentiality, integrity and availability of systems. Cyber resilience goes one step further, focusing on the ability to prepare for, anticipate, overcome and recover from a cyber attack.

Both are a journey, not a goal, or an end point. It is about risk management and it takes continuous investment, awareness and training, testing and improvement to become cyber resilient.

But only 20% of SMEs have a comprehensive cybersecurity strategy in place. Every company can go far by learning to manage its cybersecurity risk – from investing in intuitive cybersecurity measures to measurable actions, mitigating specific business risks. Managing third-party security risk is also part of improving organisations' cyber resilience. Testing, testing, testing and acting on identified weaknesses will enable organisations to move from protection to resilience.

Finally, there are clear paths to start, by implementing information security standards such as ISO27001. It focuses on risk-based approach and continuous improvement in five key processes: identify, protect, detect, respond and recover. By implementing industry standards, businesses can easily demonstrate their effort and excellence to partners and regulators. But while it is recommendable for all companies to adhere to a standard, knowledge and time restraints would mean not all companies – especially start-ups – would be able to implement it.

We at CyEn support our clients, from startups to government organisations, with the latest intelligence and bespoke advice protecting the business, process, people and technology, as well as meet client and regulator security needs.

What technical measures will it help better prepare for the challenges?

Technical and organisational measures would be different for the different SMEs and have to be proportionate to the risk they are exposed to. These measures also depend on the core business of the company. If it operates in the software business, the technical and organisational measures will be different from those of a carpentry company. This is why cybersecurity awareness trainings must be organised with a specific company or sector in mind. Multi-factor authentication is a good starting point for any business as it prevents 80% of data breaches. Other possible measures include strong identity and access management, system updates, encryption, network segmentation and regular data backup. Penetration testing and vulnerability management are also to be considered.

What are the most reliable ways to prepare teams and employees?

Regularly train all employees and request the same from third party suppliers/subcontractors, when critical. The best cybersecurity training is an opportunity to improve the understanding of the threats and to detect and remediate cybersecurity threats and vulnerabilities in their daily job. Employees need to know their role in improving the cyber resilience of their own company, which threats to keep in mind, and how to deal with cybersecurity risks and incidents.

As a professional with years of experience in cybersecurity, what is the most important lesson you've learned about reliable cyber defence?

The modern cybersecurity question is not whether, but how to improve our cyber resilience. The answer will define how we live. I would argue for transparent, diverse and inclusive cybersecurity solutions, developed with the EU values at heart and working for people, not against them. Fluid, integrated and developed by people of different backgrounds, security solutions work better.

Reliable cyber defence is also a measurable one. We need better integrated security and more transparency and quality in the cybersecurity solutions to assure reliability. Testing is a way to increase both transparency and quality. It is an industry best practice and progressively, a regulatory requirement to test the cyber resilience and vulnerabilities of solutions and organisations, at the development stage and at regular intervals after. CyEn created a partnership with a Bulgarian startup, SoCyber, to offer these testing services and thus, provide a full spectrum of cybersecurity solutions to our clients.

+32 493 405 612

iva.tasheva@CyEn.eu

www.CyEn.eu