Cyber Attacks on SMBs Are Once Again on the Rise, According to New Ponemon Report

There has been an upward trend in cyber attacks on small-to-medium size businesses (SMBs) for some years now. Slowly but surely, SMBs have found themselves on a roughly equal footing with their larger counterparts in terms of likelihood of experiencing an attack.

A new study from the Ponemon Institute indicates that attacks on SMBs have been sharply on the rise in the past year in particular regions of the world. While the overall number of attacks on global SMBs stayed roughly even from the previous year, attacks in specific regions (such as the United States) jumped as much as 21%.

The Ponemon 2019 State of Cybersecurity for SMBs Report

The annual Ponemon survey of SMBs is important as it looks specifically for targeted attacks. One would expect SMB attack numbers to grow across the board as indiscriminate automated hacking tools become more prevalent, but the attacks logged in the survey are sophisticated and involve actions such as targeted email phishing of an employee or a focus on obtaining specific company data.

While roughly 2/3 of the world’s SMBs are now experiencing cyber attacks, 45% still feel that their cybersecurity posture is “ineffective.” 39% still do not have an incident response plan in place.

Ponemon’s annual SMB survey has been conducted since 2016 and is commissioned by Keeper Security. This year’s survey included 2,391 IT security professionals and decision makers from companies located in the United States, United Kingdom, and throughout Europe. The companies range from 100 to 1,000 employees in size and the data was collected in August and September.

New attacks appear to be focusing on SMBs in specific regions, with the United States getting the worst of it. The overall number of global SMB attacks stayed fairly steady, perhaps even decreasing slightly (moving down from 67% in 2018 to 66% in 2019). This comes after years of steady and significant growth, however; from 55% in the inaugural study in 2016 to 61% in 2017.

Before you continue reading, how about a follow on LinkedIn?

76% of SMBs in the United States reported a cyber attack this year, compared to only 55% in 2018. Additionally, 82% of these respondents have now experienced a cyber attack in their lifetime. In spite of all of this, 88% of these companies spend less than 20% of their IT budget on cybersecurity.

Attacks in the United Kingdom also increased at a smaller but still significant rate, up from 55% to 65%.

Smarter cyber attacks

These attacks are increasing not just in frequency, but in quality as well.

The most common global attack type is phishing, something that 57% of global SMBs fell victim to this past year. Stolen and compromised devices (33%) and credential theft (30%) are also common avenues of attack.

Data loss is the most common result of cyber attacks on SMBs. 69% of the companies in the United States that responded lost some sort of sensitive personal information belonging to employees or customers. That’s a 50% increase since the first Ponemon survey was conducted in 2016.

New technologies appear to be one of the major factors driving these attacks. Relatively recent developments such as Internet of Things (IoT) devices, biometrics and the use of personal mobile devices for work have been quickly and broadly adapted by SMBs. But security technologies and practices tend to lag behind in these areas.

Companies appear to be aware of this, yet feel they cannot do anything about it. 49% of respondents felt that the use of mobile devices with business-critical applications weakened the organization’s security posture, even though 48% reported doing this exact thing at their companies. 80% felt that unsecured IoT devices could lead to a catastrophic security incident, yet only 21% of these companies are actively monitoring these devices.

75% of the respondents have implemented biometrics into their security profile or intend to do so soon. While biometrics is intended to be an enhanced layer of security against threat actors, the recent incident with Suprema’s Biostar 2 shows that vulnerabilities around the system can turn all of that authentication data into another massive liability.

Trouble in the UK?

The United Kingdom was just about on par with the global rate of SMB cyber attacks, but experienced a significant regional increase. Confidence also slipped somewhat, with 4% fewer of these companies reporting that they felt their security was “very effective.”

Interestingly, web-based attacks (49%) slightly outpaced phishing (48%) in this region. General malware attacks (42%) also made notable gains.

Unique conditions elsewhere in Europe

Possibly due to the influence of the General Data Protection Regulation (GDPR), various regions of Europe reported greater confidence in their security posture and contended with fewer cyber attacks in the past year.

The DACH region (Austria, Germany and Switzerland) has the best IoT security posture at present, though the overall numbers are still concerningly low. DACH led all other parts of the world with 27% of their SMBs conducting IoT security training for employees and vendors, and 25% actively monitoring the IoT devices used in the workplace for data breaches. However, these companies also expressed the least concern about employee passwords with only 58% responding that it was a significant endpoint security issue for them.

The Benelux Union (Belgium, Luxembourg and Netherlands) had one of the lower rates of cyber attacks targeting SMBs at 56%. This region had a high rate security emphasis on strong passwords (68%), and led the respondents in implementation of biometrics (51%).

New Ponemon report shows #phishing to be the most common #cyberattack method hitting 57% of global SMBs this past year. #respectdata

Click to Tweet

Scandinavia struggled more than these other regions, with 64% of SMBs experiencing cyber attacks and 71% of these reporting that malware or exploits managed to get through their security. This region was more likely than others to identify mobile devices as a risk to critical infrastructure (56%), however. Scandinavia was also the only region that had a majority focus on protecting intellectual property, whereas other regions prioritized protecting customer data.

SMB security challenges

These annual investigative reports make clear that if there is a vulnerable target out there, there will be a hacker interested in it no matter how small it might seem to be. While SMBs do not face the same risk profile that the enterprise-scale large organizations have to deal with (such as special attention from state-sponsored “advanced persistent threat” groups), they now clearly face enough cyber attacks that a prevention and response plan is vital.

Comments are closed.