The more a company\u2019s infrastructure grows, the more weak spots it has. And that\u2019s true for all companies \u2014 from large corporations with deep pockets that are able to invest more in their defenses, to small and medium-sized businesses. And despite their more modest capabilities, smaller companies are just as tempting a target for attackers.<\/p>\n
Cloud platforms, remote access, and AI help businesses scale up and get more done. But they also give attackers extra ways to get into corporate infrastructure. For example, remote employees\u2019 personal devices have become a foothold that\u2019s hard to control. And thanks to AI, phishing emails are almost impossible to tell from real ones: users can no longer spot a scammer by their spelling mistakes.<\/p>\n
There\u2019s another reason why new threats keep appearing: companies are slowly learning how to handle the old ones. Take backups. Just a few years ago they were sold as a cure-all against ransomware. Now they\u2019re less effective, because at some point attackers started stealing data and demanding payment not for decryption, but for not making it public. What\u2019s at stake here isn\u2019t just business processes, but the organization\u2019s reputation too. We wrote about this scheme in more detail in a separate blog post<\/a>.<\/p>\n The scariest part is that an attacked company\u2019s problems don\u2019t end on the day of the incident. The next few days (or even weeks) are often much harder. This is when the team needs to quickly deal with the aftermath of an attack and to make sure another can\u2019t happen again. Growing companies often have to throw their entire small IT force at the problem, so getting back to normal work can take a long time.<\/p>\n According to the Global Kaspersky B2B Market Pulse survey<\/a>, most SMBs only think about security when circumstances force them to; for example, after an incident, when expanding their infrastructure, or when a potential partner asks them to strengthen their perimeter before signing a contract. Yet only a handful treat continuous cybersecurity monitoring as a core part of running their business.<\/p>\n When a company finally decides to get serious about security, it runs into three constraints: people, processes, and technology. Let\u2019s look at each one.<\/p>\n So small and medium-sized businesses become easy targets for attackers not so much due to their size, but because they don\u2019t pay enough attention to the key building blocks of cybersecurity. As to what this can lead to, and how the tables can be turned in a company\u2019s favor \u2014 read on for a real-world case that demonstrates this.<\/p>\n Let\u2019s look at a real-world attack on a company with 450 employees. When the incident happened, the company was migrating its ERP system to the cloud. The data had already been moved, but the protection hadn\u2019t been set up yet. And that limbo state is exactly what let the attackers pull off their campaign.<\/p>\n The attackers used a fairly simple tactic. Posing as an external ERP integrator, they sent the finance department a file with an \u201cadjusted invoice\u201d. When an employee opened the attachment, the malicious code inside it exploited a vulnerability in a local application, and the attackers took control of the device. There they found saved credentials that let them log in to a support account and get administrator rights on the cloud ERP server. With that account, they got into the server and stole the company\u2019s confidential data.<\/p>\n We analyzed the mistakes that made this incident possible, and came back to the same formula: people + processes + technology. The company did provide employee training, but it was mostly a formality and did nothing to help people learn to spot email phishing. Security updates weren\u2019t installed right away either, which is why the computer had an unpatched vulnerability. On top of that, privileged credentials were stored right on the employee\u2019s device, which gave the attackers a direct path to administrator access. Finally, the workstations had no EDR, and the cloud ERP server had no workload protection.<\/p>\n The best way to start is with the three key areas we covered above. And this isn\u2019t about simply throwing money at security. What\u2019s needed is a clear, step-by-step plan that makes the most of the resources the company already has.<\/p>\n Employees are a business\u2019s first line of defense, so it\u2019s especially important to help them form safe cyberhabits. Many companies understand this and duly run computer literacy training; however, often employees show up in droves, yet they keep on making the same old mistakes.<\/p>\n The problem is that most training isn\u2019t relevant to the people taking it. People in the finance department know that attackers can send phishing emails, but what does that have to do with their job? To head off questions like that, we recommend combining<\/a> cybersecurity theory with simulations of real cyberattacks. That way, employees can safely step into the shoes of an attacker\u2019s target. Start by training employees who have privileged access to systems, and also those who handle confidential information.<\/p>\n To keep training from becoming a formality, track progress regularly. For example, send employees suspicious test emails from time to time, and measure how fast and how well they react: how many recipients click the link, and how many report the threat.<\/p>\n Set up clear priorities for installing updates and patches. This helps avoid two extremes: running for months with open gaps in the infrastructure, or rushing to fix every vulnerability without asking how critical it is for specific business processes. Setting up centralized vulnerability management also helps, which we explained how to do in a separate post<\/a>. Don\u2019t rush to expand the infrastructure or move it to the cloud until the company has proper protection and monitoring in place.<\/p>\n Another key point: assign an owner to every process. Someone should be personally responsible for regular cybersecurity training, installing updates, and the timing and methods of incident response. That way, security tasks get done on time \u2014 even when the IT team has limited resources.<\/p>\n It\u2019s impossible to build reliable business protection without specialized products, but buying everything at once won\u2019t help either. New solutions should match the needs of the infrastructure<\/a>. A good approach is to add tools as the need to do so comes up; for example, to prioritize vulnerabilities more effectively or to strengthen the security of email or cloud environments. One way to tailor security to the company\u2019s needs is to use our Security Modules <\/a>, which work with Kaspersky Next Optimum \u2014 a solution for growing SMB and mid-market businesses.<\/p>\n Another option is to move to a more advanced solution as the infrastructure grows. The foundation of cybersecurity can be laid with Kaspersky Next EDR Foundations<\/a>, which provides basic endpoint protection and control. Then, when needed, the company can move up to solutions with a broader range of capabilities, from Kaspersky Next EDR Optimum to Kaspersky Next XDR Optimum, or straight to Kaspersky Next MXDR Optimum. Our most comprehensive offering \u2014 Kaspersky MXDR Optimum<\/a> \u2014 combines advanced detection and response that goes beyond endpoints and adapts to the needs of a growing business, 24\/7 monitoring, and proactive threat hunting and investigation by Kaspersky experts.<\/p>\n\n","protected":false},"excerpt":{"rendered":" People, processes, and technology: if a company has gaps in its defenses, they most likely come from one of these three areas. We walk through a real-world breach, and explain how to stand up to attackers without hiring a huge team or needing to vastly increase the security budget.<\/p>\n","protected":false},"author":2782,"featured_media":26184,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1318,1917],"tags":[1457,1768,2893,2894,192,2895,1229],"class_list":["post-26183","post","type-post","status-publish","format-standard","has-post-thumbnail","category-business","category-smb","tag-business","tag-endpoint","tag-kaspersky-next-edr-foundations","tag-kaspersky-next-optimum","tag-protection","tag-security-modules","tag-smb"],"hreflang":[{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/smb-cybersecurity-people-process-technology\/26183\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/smb-cybersecurity-people-process-technology\/31149\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/smb-cybersecurity-people-process-technology\/30990\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/smb-cybersecurity-people-process-technology\/56571\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/smb-cybersecurity-people-process-technology\/36895\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/smb-cybersecurity-people-process-technology\/36565\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/me-en.kaspersky.com\/blog\/tag\/smb\/","name":"SMB"},"_links":{"self":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/26183","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/2782"}],"replies":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=26183"}],"version-history":[{"count":0,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/26183\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/26184"}],"wp:attachment":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=26183"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=26183"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=26183"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Three Achilles\u2019 heels at once<\/h2>\n
\n
Case study: ERP system breach<\/h2>\n
How SMBs can strengthen their defenses<\/h2>\n
Hands-on training<\/h3>\n
Structured processes<\/h3>\n
Gradual rollout of security solutions<\/h3>\n