Cybersecurity for UK SMB and the IT Channel

In this blog we will explore Cybersecurity, the current threat landscape, and the impact on UK companies. We will pay particular attention to the Small and Medium Business sector and the Managed Service Providers that provide IT products and services to those businesses. We will suggest actions that IT Service Providers can take along with links to information sources that will be helpful.

Cybersecurity is a subject that is as old as the IT Industry itself. The focus on this topic has increased significantly due to a number of factors:

• Increased Number of endpoints: Staff are working across a broader range and number of devices including Laptops, Desktop PCs, Tablets, and increasingly mobile phones. Applying consistent security to each device with different operating systems and use cases is a challenge.
• Increased mobility of staff: Mobility is a long-term trend, accelerated by the Pandemic. The days of most staff only accessing sensitive data via a secured Desktop PC in the Office Premises is long gone. Securing staff devices and ensuring staff are security conscious in their behavior is a greater challenge in their home office or coffee shop environments.
• A lack of skilled IT staff: A shortage of skilled IT staff and particularly Security specialists is affecting businesses from the largest enterprise to the micro business and Managed Service Providers that service them.
• Increased complexity and number of IT solutions used: The number of IT solutions used by businesses is increasing, partly driven by the ease of deployment through Public Cloud Services. This is particularly true of Small Businesses who can deploy solutions such as Microsoft 365 without the on-site requirements for installation and management. A positive for smaller companies is that their IT systems are more likely to be up to date compared to the larger enterprises that tend to run older software versions as the cost to refresh and test against all their other applications is prohibitive for frequent updates.
• Increase in the number and type of Cyber Attacks: The number of Cyber Attacks is growing, driven by many elements. Sophisticated malware is available on the Dark Web and criminals can effectively rent this to run profitable Ransomware attacks with little technical knowledge. There is also an increasing number of attacks from large groups including those sponsored by. Ransomware in particular, has made cyber-attacks so profitable that large enterprises have formed to specialize in extracting money from cyber-attacks. Many of these are backed by Organized Crime and in some cases Government funding. AI is likely to have a dramatic impact as Security Companies use it to create better security solutions and bad actors use it to circumvent traditional security solutions.

A recent report identified April 2023 as having the highest number of hacks and data leaks for the last three years of data. (1) There is no doubt that Cyber Security and in particular Ransomware is a major and increasing threat to businesses.

It would be comforting to think that the UK is not a major target for the global criminal gangs and state actors that present the greatest cyber security threats. However, a top ten economy by GDP we present a significant opportunity for Cyber Criminals. A 2022 report identifies the UK as a top 5 target country, with only the USA and Canada having more attacks. (2) . From a consumer perspective the ONS estimate that 80,000 individuals in England and Wales responded to a phishing attack in the previous 12 months. These individuals could be the customers or employees of UK companies exposing them to risk. (3) A Russian cyber-attack group even compromised the computer of the former head of M16 demonstrating that the UK is clearly a target and that attacks have a very high level of sophistication and potentially, state backing (4)

The news frequently reports incidents of Ransomware attacks against the large companies that we have all heard of which could mean that smaller businesses are not at risk. The truth is that the media is more likely to report attacks by companies with a newsworthy name. Nordlocker data shows that when measured as attacks per employee, businesses with between 11 and 200 employees have the greatest number of cyber-attacks (2). When launching Defender for Business, Microsoft quoted US Government statistics showing that there had been a 300% increase in Cybercrime attacks in 2022 with over half aimed at SMB. (5)

It is clear that Cyber Security is an increasing threat, a trend that looks set to continue and all businesses are at risk, from micro business up to the largest corporations. As a supplier of IT goods and services, those in the IT channel will be expected to have their house very much in order with rigorous Security in place. With such a customer demand and security skills in limited supply there is a clear business opportunity for IT Service Providers that are not already offering managed security solutions to their customers. Our suggestions for those in the IT Service Provider community are:

• Educate yourself on the current threat landscape and solutions, we have provided some relevant links to Government and commercial articles that will help at bottom of this article.
• Audit the IT solutions and processes that you use internally and train your staff in the Social Engineering tactics used by hackers.
• Asses the companies that you work with in partnership, to fully secure your eco-system.
• Consider how you would handle a security breach; some breaches are inevitable and how you deal with those is vital to the security of your customers and your reputation.
• Pay close attention to areas like Public Cloud where you are managing Customers Solutions on their behalf. This includes proper use of Zero Trust solutions like Granular Delegated Admin Privileges for Microsoft 365 and Microsoft Azure.
• Develop a set of professional services based on your internal learnings to offer customers the advice and support on top of the hardware and software that you provide them.

Cyber Security presents a clear risk and a clear business opportunity for those in the IT Services market. A government survey identified price as still the major consideration for MSP selection (6) this is based upon an assumption that robust security is in place. With the continued increase in the number of attacks, IT Service Providers must ensure that they are prepared to protect their own business and also the data of their customers. With the rapid pace of progress with AI, we are likely to see the speed and sophistication of IT Security attacks jump to a new level which will catch the unprepared off guard and could do great damage to some businesses. A deliberate and considered approach to IT Security is essential for any business, those providing IT Services have an even greater obligation to do so and a clear opportunity to expand their business through offering customers solutions and services to bolster their IT Security.

• Small & medium sized organisations – NCSC.GOV.UK
• 10 Steps to Cyber Security – NCSC.GOV.UK
• NCSC_A5_Small_Business_Guide_v4_OCT20.pdf
• CyberVersed Podcast – National CRC Group
• Cyber Security Breaches Survey 2022 – GOV.UK
• Cyber security: advice for small businesses – GOV.UK
• Global Data Protection Index Report | Dell UK
• Gartner Identifies the Top Cybersecurity Trends for 2023