Almost half of UK businesses have a basic cyber security gap that is leaving them exposed, according to a new UK government report.
This stark reality was revealed in a report from the Department for Digital, Culture, Media and Sport (DCMS). It found that the people responsible for cyber security in 48 per cent of UK businesses lack the confidence to carry out basic tasks and are not receiving support from external cyber security providers.
So, if your inhouse person isn’t confident in doing basic security tasks and you’re not seeking support, just who is checking that your business systems are secure, and your data hasn’t been compromised?
“Many SMEs are unprepared for the cybersecurity threats lurking online, believing they are too small to be a target,” said Nick Denning, CEO Policy Monitor. “The reality is that almost half of UK businesses suffered a cyber security breach or attack in 2019/2020). Most cyber criminals are looking for a quick payday. If an attack has worked well, they will keep repeating it. That is why phishing scams, where attackers send fraudulent messages to trick a person into revealing sensitive data, remain the most common type of attack that organisations face, with 90% of all data breaches involving phishing.
“SMEs need to understand that cybercrime is an organised and profitable business, albeit an illegal and morally bankrupt one. Cyber criminals want a swift financial return on their activities and purposely go after soft targets. SMEs are seen as easy victims because they are less likely to have sufficient security in place to protect their systems and data. Hackers are after the information that SMEs store on their customers and suppliers, such as credit card numbers, bank account details etc. They will either use this themselves or sell it on the dark web to the highest bidder.”
Credit card, identity and cyber fraud is costing the UK up to £190bn a year. According to UK think tank the Royal United Services Institute (RUSI), fraud has reached epidemic levels and should be seen as a national security issue. While the profits keep rolling in, cybercriminals will continue their attacks and the sooner SMEs understand this, the sooner they can get serious about security and start protecting themselves more effectively.
The most common cyber security skills gaps identified in the report are in: Configuring firewalls, Performing patching, Storing or transferring personal data and Detecting and removing malware.
Cyber security tasks are laid out in the government-endorsed Cyber Essentials (CE) scheme which was designed to help protect UK organisations from the most common cyber threats. These fundamental tasks are the foundation to good security.
The scheme sets out basic technical controls for organisations to use. It also lays the foundation to developing policies and procedures to mitigate against threats that can impact business operations. The benefit to being CE compliant is that it mitigates 80% of the risks faced by businesses such as phishing, malware infections, social engineering attacks and hacking.
