Technology & Innovation

Terror-bite: Small companies come under attack

November 20, 2013

Global

November 20, 2013

Global
James Chambers

Former senior editor

James is Bureau Chief for Monocle, Hong Kong. Prior to this he worked as a Senior Editor with The EIU's Thought Leadership team for over three years researching business, technology and cities. He has also written about business and technology for The World In 2015 and economist.com. James has previous experience from IR magazine, a finance publication, where he was research editor in London and Shanghai. Additionally he contributed to Legal Week, a weekly legal magazine, and worked on the FT Innovative Lawyers Awards in the US and Europe. James is an English law-qualified solicitor (currently non-practising) and holds post-graduate legal qualifications from BPP Law School and an LLP in Law from the London School of Economics.

Smaller businesses are traditionally considered to be less of a target for cyber-attacks and consequently less prepared for these threats.

Smaller businesses are traditionally considered to be less of a target for cyber-attacks and consequently less prepared for these threats. During a study of Austrian organisations, Stefan Fenz, a researcher at the Vienna University of Technology, found that size of a business is much more of a useful indicator of preparedness levels than industry or sector.

Certain characteristics may, however, mean that smaller companies become more of a risk, including operating in a highly specialised area or being a key supplier to a larger organisation—acting as a kind of “back door”. What is more, any complacency here about the levels of the risk could be misguided. “What you’re seeing now is the attackers going down the supply chain because SMEs are an easier target,” says Marcus Alldrick, the chief information security officer (CISO) at Lloyd’s of London, a marketplace for insurance.

Smaller businesses currently report much lower levels of awareness about information risk across the organisation than larger businesses. Yet there are solid business reasons to support the adoption of a more mature approach to information risk. For one thing, it can facilitate, or at least act as a prerequisite for, entry into supply chains with bigger customers—a commercial justification for allocating limited resources to this area. In extreme cases, it can also be a matter of business survival.

Early in 2013 Efficient Services Escrow Group, a California-based provider of escrow services, was put out of business following a US$1.5m cyber-heist. The attack began in December 2012, when a fraudulent wire transfer diverted US$400,000 to a bank in Moscow. The remaining US$1.1m was diverted to banks in Heilongjiang Province in China. Although the money wired to Moscow was recovered, Efficient Services was unable to recover the money remitted to China and, as a result, was forced out of business.

There are signs, nonetheless, that small and medium-sized enterprises (SMEs) are taking information risk management more seriously—beginning with the allocation of more resources. Currently the CEO is much more likely to have responsibility for information risk management at smaller companies than at larger ones - this is the case at just over one in four (27%) SMEs and less than one in 20 (3%) at larger firms. But Gram Ludlow, an information security professional, says that there is a trend towards SMEs recruiting CISOs. “I’m seeing companies as small as a couple of thousand employees and under a billion annual revenue, hiring CISOs,” says Mr Ludlow.

The impact of this, he says, is that over the next three to five years, the market for CISOs and other information risk management professionals is going to get very tight. However, he believes that the net outcome will be positive. “It’s going to increase the pipeline for CISOs because now you will have people who have security leadership experience from smaller companies, and there are far more of them,” says Mr Ludlow.

Enjoy in-depth insights and expert analysis - subscribe to our Perspectives newsletter, delivered every week