Protect Your SMEs Against Cybersecurity Threats

Small and medium-sized enterprises (SMEs) are significant and influential in our global economy. Per the World Bank Group, SMEs represent about 90 percent of all businesses and account for more than 50 percent of worldwide employment. Due in large part to the sheer volume of potential targets, combined with the higher likelihood of less-robust cybersecurity infrastructure compared to major corporations, SMEs have become much more common and attractive targets for damaging and disruptive cyberattacks. For companies of all sizes and within virtually every professional industry, it’s imperative to understand the role cybersecurity plays in the private sector.

“Failing to plan is planning to fail.” Cybersecurity incident response plans are essential for SMEs who can face catastrophic losses or even be driven out of business by a sophisticated and targeted attack. Creating a clear, focused, and easy-to-follow incident response plan is critical.

While large organizations typically have full-time, on-site dedicated cybersecurity teams, SMEs often rely on one individual, a small team, or a managed third-party cybersecurity and threat response contractor. Regardless of organization size, the main goal of any cybersecurity incident response is to limit the damage done or systems compromised within an IT environment in the wake of a cyberattack or data breach and restore full operations as quickly as possible.

A successful and effective incident response begins as a proactive, not reactive, process. Improving response capabilities relies on sufficient planning—the Swiss Cyber Institute lays out four steps for responding to a cybersecurity incident:

• Identify the Incident: For many organizations, this can be the most challenging part of the process. While some incidents can be easily spotted, others are nearly unfeasible to discern.
  • What networks or assets have been corrupted?
  • What is the scope of the incident or attack?
  • What information has been stolen?
  • What potential impact does the attack have?

• Examine the Situation & Determine Objectives: As soon as a cybersecurity incident has been identified, objectives for immediate response activities should be determined. Questions that may need to be answered can include:

• Take Necessary Action: This critical step involves containing the incident’s damage, keeping it from spreading and minimizing its immediate influence. The main objective is to make the greatest efforts to return to full functionality as normal.
  
  
• Recover Systems & Information: The last step is to restore all systems to normal operations. Make sure all elements of the incident have been exterminated, and conduct thorough penetration testing to ensure sophisticated cybercriminals can’t repeat or carry out further attacks.

Like any aspect of cybersecurity, Payment Card Industry Data Security Standards (PCI DSS) compliance is an ongoing, continuous process. Non-compliance can lead to data breaches causing costly financial losses, priceless loss of consumer trust, and a damaged reputation.

Updates are regularly published by the PCI Security Standards Council, which spotlights four ongoing steps to protecting payment account data with PCI DSS and what they entail for compliant SMEs:

• Assess
  Identifying all locations of payment account data, taking an inventory of all IT assets and business processes associated with payment processing, analyzing them for vulnerabilities that could expose payment account data, implementing or updating necessary controls, and undergoing a formal PCI DSS assessment.
  
  
• Remediate
  Identifying and addressing any gaps in security controls, fixing identified vulnerabilities, securely removing any unnecessary payment data storage, and implementing secure business processes.
  
  
• Report
  Documenting assessment and remediation details, and submitting compliance reports to the compliance-accepting entity (typically an acquiring bank or payment brands).
  
  
• Monitor & Maintain
  Confirming that security controls put in place to secure the payment account data and environment continue to function effectively and properly throughout the year. These “business-as-usual” processes should be implemented as part of an entity’s overall security strategy to help ensure protection on an ongoing basis.

• Best Practices for PCI DSS Compliance
  PCI DSS compliance can be complex, inspiring major changes in an SME’s security perspective, culture, and ideology or requiring the adoption of many new cybersecurity tools and solutions. The following steps include best practices organizations should employ to effectively implement and maintain PCS DSS compliance:

• Determine—and Minimize—Your Scope of Compliance
  Begin by identifying all infrastructure in your organization for storing, processing, and transmitting cardholder data, defining all payment channels, locations, and data streams. Minimizing your scope of necessary compliance coverage is crucial in streamlining and speeding up the implementation of PCI requirements. Network segmentation or tokenization methods can help narrow the necessary scope of PCI compliance coverage, minimizing an SME’s overall cardholder data environment (CDE).

• Separate Cardholder Data from Other Business Data
  By segmenting consumer cardholder data from the rest of an organization’s standard business data, it’s better protected and also helps limit the scope of a PCI audit. Cardholder data must be encrypted or masked as soon as it interacts with your payment platform, ensuring its future security when not in use and staying siloed in case other portions of an organization’s network are breached.

• Scan and Test, Early and Often
  If required to perform quarterly scans, use an approved scanning vendor (ASV) early in the quarter in order to give your team ample time to fix any issues or address any discovered vulnerabilities. Annual penetration testing is also among some companies’ PCI compliance requirements, although when performed more regularly can alert organizations to small, seemingly unimportant details that could become big threats or vulnerabilities for a CDE. Never overlook issues arising from security testing, take quick action to identify their causes, and retain all records generated during the process for any future audits or risk assessments.

• Continue Regular Risk Assessments
  The PCI DSS emphasize the importance of conducting risk assessments on a regular basis to better understand an organization’s likelihood of a breach or cyberattack and the extent of damage possible in order to determine if additional data protection measures are necessary.