Best Practices for Dealing with Cyberattacks Targeting SMEs

Table of Contents

• Introduction
• GDPR, a cybersecurity challenge
• The different threats
• The pillars of security
• Best practices to adopt

This article is drawn from the webinar "Cybersecurity: how to protect my organization from threats?" which you can find here

Introduction

• In 2019, 60% of attacks and data breaches in 2019 concerned an SME.
• 93% of SMEs that lost their data for 10 days or more filed for bankruptcy within the year of the disaster.
• Increase in cyber attacks since the 1^st lockdown due to remote working and the use of poorly protected IT tools (personal computer, non-use of VPN, etc.).

# GDPR, a Cybersecurity Challenge The GDPR, a cybersecurity challenge

GDPR compliance enables companies to have better knowledge of the data being used, as well as storage locations and retention periods. Thus, only data essential for data processing operations is retained.

The GDPR also requires the implementation of mandatory procedures. In particular, the data breach procedure. The latter enables response according to the severity of the data breach (leaks, loss, alteration of data):

• Maintaining the data breach register
• Notifying the supervisory authority
• Informing data subjects of the data breach

Being prepared in case of attack is an essential point, as it strengthens the trust of employees and customers by demonstrating that procedures are in place.

# Threats

There are several types of threats that can originate from different sources, such as cyberattacks (DDoS, Cryptovirus, viruses, malware), social engineering like phishing, or espionage.

The pillars of security

IT security is based on 4 pillars:

• Availability: data is accessible and usable by its authorized recipient at the intended place and time.
• Integrity: data is modified only by authorized persons and according to an established procedure.
• Confidentiality: Data is accessible only to authorized persons.
• Traceability: maintains records of the state and movements of information. It is this last pillar that allows us to know whether the other 3 characteristics have been applied.

Good Practices

Certain best practices concern employees such as awareness training: not responding to suspicious emails, performing double verifications for important operations (emails + telephone).

This can also include the implementation of so-called "strong" passwords and a policy of changing them every X days.

The use of a distinct password for each application is strongly recommended.

Backups and BCPs (business continuity plans) must also be implemented. Network monitoring through security devices makes it possible to identify unexpected events.

Find other best practices on our webinar here