Small and medium businesses (SMBs) have been sprouting up worldwide, owing to the fact that they are often innovative and can be established by pretty much anyone. From 2000 to 2020, there was an increase of over 50% in the number of SMBs worldwide.

Although news outlets often focus on cyberthreats targeting nation states and large enterprises, it is important to consider the many threats facing SMBs because in reality, they also bear a fair share of the brunt of cybersecurity attacks. When threats are directed at SMBs, several factors, such as the threat of regulatory fines; a lack of security capability and process maturity to prevent, defend against and respond to threats; as well as a limited amount of funds available can exacerbate the effect an attack can have on the business operations of an SMB.

More recently, hybrid working—and the ever-intensifying digitalization of SMBs—has contributed to an increased need for data protection, yet SMBs still lag behind in understanding and implementing needed improvements to security.

SMBs: Small in size but still big targets
A common way to distinguish between SMBs and large enterprises is by the number of seats. While ESET considers a company an enterprise if it exceeds 1,000 seats, there are markets—that are not at all remote—where the metrics are quite different. In Canada, an enterprise comprises 500 or more seats, meaning that by ESET’s standards, many of the country’s enterprises may benefit from ESET products configured for SMBs.

In Canada’s economy, which is the ninth largest in the world by nominal gross domestic product, SMBs make up almost 99% of its businesses. Among these, nearly 45% of employees believe their company is at risk of a cybersecurity attack. Employees and management are both right to have concerns. Regardless of classification, attacks on businesses of this size can result in serious impacts to business continuity, revenue and reputation. Furthermore, the technology employed by attackers is considerable, as it has been honed on enterprises and then redeployed on SMBs.

Why are SMBs such desirable targets?
To understand why SMBs are the target of so many cyberattacks, we also need to look at large enterprises. Because they expect to be attacked, enterprises typically aim at maintaining a high level of prevention, monitoring and mitigation capabilities. Enterprises not only have the budget—and the will—for improved security, but they also have the IT staff to dedicate to security. Unlike large enterprises, SMBs tend to not have the resources (budget and people) to prioritize cybersecurity—even though they should.

In addition to a lack of resources, SMBs often believe they are not in danger because they’re not as interesting to cybercriminals as larger enterprises. In reality, SMBs, just like large enterprises, handle sensitive data and can become stepping stones for cybercriminals whose end target is large enterprises, since an SMB might be part of a supply chain servicing such enterprises.

Protecting the hybrid workplace
Prioritizing cybersecurity may seem like a difficult and costly task, but is worth it in the long run. The new hybrid work environment has added considerable complexity for IT admins across the spectrum of business sizes (as well as for home admins) to proactively address security challenges. Large enterprises and SMBs alike need to invest in implementing a Zero Trust model of security to better handle the risks precipitated by the new era of the hybrid workplace.

With hybrid working becoming the new normal, employees increasingly turn to productivity tools, such as Teams, SharePoint and Outlook, which also poses a security risk. A product like ESET Cloud Office Security (ECOS) adds immediate protection to these highly popular tools. ECOS provides security for Microsoft 365, including OneDrive and Exchange Online, and is easy to implement and manage for both SMBs and enterprises.

On top of that, ECOS protects employees from dangerous emails. A Microsoft report shows that malicious emails, including phishing emails and business email compromises, are still on the rise. ECOS adds an important layer of security on top of the built-in protection in Microsoft 365 to scan incoming emails and attachments in Exchange Online for spam, phishing and malware.

ECOS isolates suspicious emails and can automatically trigger an email notification to allow admins to take immediate action, or admins can set up ECOS to automatically delete detected items or move them to junk or trash folders. This is critical as malicious email attachments account for the lion’s share of threats facing business networks.

In addition, ECOS integrates with OneDrive to scan all files for malware. Every file uploaded to OneDrive, or shared via SharePoint, is checked using the powerful malware detection engine. If the engine detects a dangerous file, it is placed in quarantine, where it is only accessible to administrators, while the user remains protected. This feature helps businesses lock down malware before it can spread across the environment and disrupt business.

TRY THE INTERACTIVE DEMO OF ECOS

At the end of 2021, ESET upgraded ECOS by integrating a powerful enterprise-grade tool, ESET Dynamic Threat Defense (EDTD), that can detect new and previously unknown threats by running them in a cloud sandbox. New threats arise every day, and quickly detecting them the first time they are encountered often requires more processing power and memory than is readily available on employees’ machines. EDTD offloads the task of detecting such threats from employee machines to more powerful machines in the cloud. Once these samples are in the cloud sandbox, they can be subjected to multiple machine learning models and robust detection techniques to classify them as clean, suspicious or malicious.

Prioritizing security

SMBs need to act now to improve their cybersecurity defenses. However, many IT departments are overwhelmed with work and need a simple and elegant security solution. Especially in a market like Canada’s that is buttressed by SMBs, companies face the need for considerable security improvements. A host of security technologies are available, including cloud-based services and data and endpoint protection solutions, that offer a balance between detection and prevention capabilities with ease of deployment and use.

“I believe that in the rapidly growing business environment in Canada, IT security based on prevention and detection needs to be the number one focus of our businesses,” says Bob Bonneau, country manager for ESET Canada. “With threats, regulation and complex technology integration evolving every day, the need for security is stronger than ever. ECOS+EDTD is the solution here,” he adds.