SMBs Will Become Bigger Targets For Cybercriminals in 2016- Sophos

In the ever changing and increasingly complex landscape of cyber security, Sophos experts offer their top predictions for 2016 one of which is that Small and Medium ‎Businesses (SMBs) will become top targets for cybercriminals

According to the Sophos lab report made available to Nigeria CommunicationsWeek ‎throughout 2015, the focus has been on the big glamorous hacking stories like Talk Talk and Ashley Maddison, but it’s not just big businesses that are being targeted.

A recent PwC report revealed that 74% of SMBs experienced a security issue in the last 12 months, and this number will only increase due to SMBs being perceived as ‘easy targets’.

Sophos pointed out that ransomware is one area where criminals have been monetizing small businesses in a more visible way this year.

Previously, payloads – such as sending spam, stealing data, infecting websites to host malware – were far less visible so that small businesses often didn’t even realize they had been infected. Ransomware is highly visible and has the potential to make or break an SMB if they do not pay the ransom.
‎
This is why, of course, criminals are targeting SMBs. Expect to see this ramp in 2016.

Lacking the security budgets of large enterprises, SMBs often apply a best-effort approach to security investments, including equipment, services, and staffing.

This makes them vulnerable as hackers can easily find security gaps and infiltrate the network. On average, a security breach can cost a small business anywhere up to £75,000 – a significant loss for any business. It’s important therefore that SMBs take a consolidated approach to security.

This requires a thoughtfully planned out IT strategy to prevent attacks before they happen. Installing software that connects the endpoint and the network will mean a comprehensive security system is in place where all components communicate, and ensure there are no gaps for hackers.

Data Protection Legislation Changes Will Lead To Increased Fines For The Unprepared

In 2016, the pressure on business to secure customers’ data will increase as the EU data protection legislation looms closer. In future, business will face severe penalties if data isn’t robustly secured. This will have a far reaching impact for how businesses deal with security, including the high risk area of employee personal devices.

Two major changes will be the EU General Data Protection Regulation (GDPR), and the Investigatory Powers Bill in the UK.

The EU Data Protection regulation will come fully into force across Europe by the end of 2017, so companies need to start preparing in 2016.

It has numerous components, but one key takeaway is that European businesses will now be held responsible for the protection of the data they process, including cloud providers and other third-parties.

In the UK, the Investigatory Powers Bill will modernise laws surrounding communications data. This will give the police and other intelligence bodies the ability to access all aspects of your communications on ICTs, whether you are suspected of a criminal offence or not.

As this is due to go ahead in 2016, it will be interesting to see how this bill is shaped and shifted, and if people will start prioritising data security.

In the US, data protection is complicated by the fact there is no single overarching law. This has the effect that data protection tends to be less strict than in Europe, which has led to issues around the Safe Harbor agreement.

Over time the US and Europe will hammer out their differences, but it seems unlikely that we will see a new agreement any time soon.‎