By Craig Freer, executive head of cloud and managed services at Vox

In July, City Power was hit by ransomware resulting in customers unable to purchase prepaid electricity or access its website. This has again put the spotlight on cybersecurity and highlight how few organisations, irrespective of their size, are safe from an attack.

Security is no longer a luxury. It is something that must take top priority not just amongst large corporates, but small to medium enterprises (SMEs) as well. With more than 350 000 new global threats emerging daily, this is an ongoing concern that must be addressed at a board level and not left being ‘relegated’ to an IT decision-maker.

The statistics make for grim reading
70% of SMEs that pay after a ransomware attack will close their doors within 6 months of the breach. Those that don’t close still suffer reputational damage, loss of data, and exposed customer information that can potentially be distributed in the public domain.

For too long, companies have simply not invested properly in getting the right cybersecurity infrastructure in place. Those that do, ensure their systems are updated to factor in emerging threats. They also continually assess their ability to effectively deal with attacks.

Fluid state
Managing IT is a complex undertaking. This policy-led environment usually sees many changes occurring over time. It then reaches a point where someone could potentially make an adjustment that renders the entire organisation vulnerable. Cybersecurity at an organisation is therefore not a snapshot in time but evolves as the threat landscape changes. And it is in this evolution where systems must be monitored and protected.

The first phase of safeguarding the business entails getting the right tools in place. A company must ensure that employees understand the security policy and that it is tested regularly. Building from there, the next phase revolves around planning for the event of a breach.

If there is one thing those organisations that lead the way when it comes to cybersecurity have in common, it is the knowledge that no system is fail-safe. This means having a backup environment that mitigates the risk of losing data when ransomware or other malicious attacks occur. Sadly, most organisations do not have this in place. Best practice dictates that there needs to be three copies of data, two copies being on different storage media, with one copy located off-site.

Frighteningly, some of those organisations who perform backups keep them on the same server their other information is stored on. This means that when they get hit by ransomware, they lose their data and their contingency plan to restore it.

Understand the environment
Companies must go with a reputable cybersecurity brand in the market. While it might be tempting to opt for a more cost-effective solution, the long-term impact could be dire. Also, a business must ensure it has the right security skills in place, whether those are in-house or outsourced. Finally, they must have a proactive approach to security and evaluate their readiness on at least a quarterly basis.

Having proper backups in place means the business can restore mission-critical information with immediate effect. No company is immune to an attack. Whether it is a multinational like LinkedIn or Facebook, or locally such as Liberty or City Power, these attacks occur and will continue to take place even more frequently.

A company must, therefore, conduct an extensive audit of its entire IT environment. In our experience, most companies are not geared to repel any type of attack, much less recover effectively from one. It has become a case of businesses being sitting ducks.

Very few SMEs understand how best to do this assessment and how to really understand vulnerabilities. It is quite complex for them to secure themselves as best as possible. It really is a case of they do not know what they do not know.

Looking towards the future, SMEs (and larger organisations as well) must do more to educate themselves about the threats they face and take the necessary steps to protect themselves.