According to a recent report by security software firm Symantec, India ranked third among the countries with the highest number of cyber threats detected and second in terms of targeted attacks in the year 2017.

While there is a common myth that cyber attackers are more interested in going after the big fish, a survey by Verizon says that 58% of all cyber attacks are targeted towards SMEs.

Several experts have cited the urgent need for SMEs to secure their online premises, however, many SMEs do not go beyond installing a basic anti-virus solution. Given the fact that the same Symantec report elucidates on how complex cyber attacks (ransomware and network attacks) have increased in India in terms of global percentage, SMEs need to implement stronger solutions.

The five top tips that SMEs should follow to secure their online presence:
Robust governance framework: It is essential to define a governance framework for your company’s information systems. A good framework will include enterprise-wide information security policy, which should encompass internal security priorities, company’s mission and objectives. Every industry sector has its own separate laws and policies and regulatory compliances that the internal company policy need ..

Since India does not have a cyber security law, it falls on the companies to create their own framework. A good place to start is the National Institute of Standards and Technology’s cyber security framework, a globally recognised framework.

“It all may sound heavy for SMEs, but unless you have a strong governance framework, it does not matter how much you spend on tech products or solutions. Over the time we have seen it not working because when the company reaches a high altitude, the deeper their drop is,” explains Verizon Enterprise Solutions, Managing Principal (APAC), Ashish Thapar.

Thapar adds that SMEs can even baseline their framework with ISO 27001, an IT standards management system, which demonstrates that the company is following information security best practices.

Implement strong network security measures: Network security entails managing access to your company’s cyber network and preventing entry of unauthorised persons. This involves putting in place email gateway filter, web browsing or proxy gateway filter, and DNS (Domain Name System) security safeguards. DNS bundling attacks are on a rise because DNS is the main underline traffic of the entire internet communication.

Security hardening of systems: Hardening, in computing, translates into securing a system by limiting its surface of vulnerability; the more functions a system performs the more open it becomes and therefore, more vulnerable to possible attacks. The SMEs can follow the global, free of cost, security benchmarks created by organisations like Centre for Internet Security. These standards can be ascribed to for hardening existing systems and ensuring that the systems run only those  ..

The hardening of systems can be performed on all systems run on internet, including web servers and network security devices.

“A lot of companies have also invested in technology like Internet of Things (IoT) which falls under operational tech systems and not necessarily, IT but the companies need to do a lot of patching and hardening in here as well,” says Thapar.

Regular log reviews: Maintaining log reviews are essential to detect suspicious activities at the earliest. Enable adequate log in and ensure log reviews are done on a regular basis. It gives you visibility which helps in understanding the activities in your internet infrastructure and tells you which system is talking to which, where is the traffic flow happening, and such.

“Unless you have baseline of your typical and usual communication, you will not be able to find out the anomaly. This makes a company entirely dependent on your anti-viruses, which are signature based tech and can only take you so far,” says Thapar.

Two-factor authentication: While having a strong password is the first step to secure your data; however, passwords will not be of any help in case of a keylogging attack. A keylogger is used to monitor and record each keystroke typed on a specific computer’s keyboard. In case of such attacks, the strength of the password is made ineffective and it is easy for the attacker to steal your credentials. “Enabling a two-factor authentication helps in mitigating this risk to maximum e ..

It is a must for ensuring the safety of a company’s critical systems and applications

These five tips are most beneficial if implemented in the company inception stage itself. So, while you are brainstorming on the kind of business you want to get into and its requirements; do not ignore cyber security. “It may be difficult to implement in the design stage, however, the effort of implementing it later only becomes exponentially higher,” warns Thapar.

The India Risk Survey 2017 report ranks ‘Information & Cyber Insecurity’ as the biggest risk facing Indian companies. Indian organizations, both public and private, had witnessed over 27,000 incidents of security threat, from January 2017 till June 2017 alone.

Phishing, scanning/probing, website intrusions and defacements, virus/malicious code, ransomware, Denial of Service attacks, and data breaches are some ways in which hackers attack business websites, which can cause operational disruptions and potentially steal sensitive information. Small and medium businesses (SMBs), unfortunately, have been seeing rising incidences of cybercrime. In fact, 70 percent of cyberattacks occur at organizations with lesser than 100 employees.

Forewarned is forearmed
In the words of Arne Josefsberg, Chief Information Officer of GoDaddy, “Perhaps the most important thing is to treat security threats seriously and to proactively assess your security measures. Many companies do not take security seriously enough until something bad happens. It is generally a lot more expensive to clean up after a security breach, than addressing it proactively.”

Let’s look at some must-have cyber security measures for SMEs:
Cyber hygiene: Basics still matter and are some of the best defenses against viruses, malware, and other online threats. Assess the assets that are most at risk – data, servers, network – and ensure that the systems are updated with the latest security software, web browser, and operating system. Implement firewall security and run antivirus software after each update.

Cyber security culture: Human vulnerabilities play as important a role as software loopholes. Mandate basic security practices and policies for all employees, such as 2-factor authentication, internet use guidelines and create and enforce rules on handling and protecting sensitive data. Conduct frequent training to sensitize employees about opening suspicious emails, encrypting their data, using strong passwords on their devices, installing security apps, and limiting activity

Business continuity plans: Ensure regular backup of all critical data – whether stored in-house or on the cloud. Run scheduled attack drills and stress tests to identify vulnerabilities and ensure that data restoration and business continuity are executed as planned.

Cyber insurance: After the WannaCry ransomware incidents, small businesses have learnt the potential harm and legal ramifications of an attack. Consider investing in cyber liability insurance to help cover liabilities arising from theft, loss of data, breach of security and privacy.

Vendor management: With many of a businesses’ assets either being hosted or managed by external service providers – be it your web hosting service or cloud hosting service – working closely with your vendors on a comprehensive plan for risk mitigation is critical. Take the time to understand the vendors’ security certifications, encryption measures, business continuity plans, emergency contact information, etc., to know exactly the level of risk your business is exposed

Constant Vigilance
Even as the boundaries of business assets blur with anytime, anywhere digital access, constant vigilance has to become the mantra of all entrepreneurs and small business owners. Cyber security needs to be brought out of the domain of ‘IT’ to make it a strategic focus area, right up there with the growth and development of the core business, to help ensure a long term stability of the business and its reputation.