SMEs Risk Data Breach by Underfunding and Understaffing Cybersecurity

Information technology (IT) professionals in small to medium sized enterprises (SME) are concerned about protecting customer data. That’s what nearly 75% of the IT professionals surveyed at these organizations by software-as-a-service (SaaS) company, EIQ Networks said. However, a shockingly large number of them allocated less than 10% of the total IT budget to cybersecurity causing security experts to be left scratching their heads in disbelief.

The CEO of EIQ, Vijay Basani noted in a press release about the survey that “Without the IT security resources and expertise necessary to continually monitor, detect, and respond to security incidents, SMEs are simply exposing themselves to loss of revenue, brand equity, IP, and customer data on a daily basis.”

 A separate survey from marketing firm Manta found that of the 1,420 small business owners it surveyed, 45% either were or believed they were breached at least one time in 2017 and 56% feel that their organizations are unprepared to deal with a security incident, should one occur.

Companies are not only underfunding their IT security efforts, but they are also understaffing them. In the EIQ survey, 75% said they employed between zero and two IT security staff at their organizations.

What are these small companies doing with respect to security? According to Manta’s information:

• 17% use anti-virus software
• 16% use firewalls
• 14% use anti-malware software
• 14% use spam filtering

However, less than 15% of the IT professionals asked by EIQ said they were confident with the technology they do have implemented to detect and respond to a cybersecurity threat or attack.

More budget funds in cybersecurity are needed to protect SMEs from the threats that lurk out there from cybercriminals. Unfortunately, a data breach can be far more harmful to one of them than to a larger organization. Symantec’s 2016 Internet Security Report found that total online security breaches increased 2% in 2016. While not shocking on its own, it could mean the difference between sink or swim to an SME.

Some other considerations:

• Per a Kaspersky Lab study in 2015, the average cost of a data breach to small businesses is $38,000, not including indirect expenses or cost to reputation.

• The Ponemon Cost of a Data Breach 2016 report listed the average cost per record lost due to a data breach is $221.

• The same study found that 39% of total external costs of a data breach is due to business disruption, including the cost of lost employee productivity.

However, with incident response plans, use of encryption, multifactor authentication, strong passwords, and awareness training and education, the risk of a breach occurring in the first place and cost to mitigate it is reduced.