Cyber Security and SMEs: Controls and Exposure

Small to medium-sized enterprises (SMEs) face unique challenges when it comes to cyber security. This article outlines the essential cyber security controls for SMEs and examines their cyber exposure, leveraging insights from recent studies and practical tools like the Hiscox Cyber Exposure Calculator.

Changes in Cyber Security Insurance

The cyber security insurance landscape in the UK has undergone significant changes, as highlighted in a study by Camillo (2017). These changes positively impact UK companies and the cyber insurance industry by providing better coverage options and more tailored solutions for businesses.

Guidance for SMEs on Cyber Security

National Cyber Security Centre (NCSC) Guidance

The NCSC offers comprehensive guides for larger businesses, such as the “10 Steps to Cyber Security,” which are regularly updated to address current challenges and solutions. For SMEs, the NCSC provides tailored guidance to help them manage their specific cyber security needs.

Specific Guidance for SMEs

1. Backing Up Data: Regular data backups ensure business continuity in case of a cyber incident.
2. Protecting Against Malware: Implementing robust anti-malware solutions to prevent malicious software attacks.
3. Securing Smartphones and Tablets: Ensuring mobile devices used for business are secure.
4. Implementing Strong Passwords: Using complex and unique passwords to protect accounts.
5. Avoiding Phishing Attacks: Educating employees on recognizing and avoiding phishing scams.

Cyber Essentials for SMEs

Introduction to Cyber Essentials

Cyber Essentials is a self-assessment toolkit designed to help SMEs evaluate and improve their cyber security measures. It provides a framework for basic cyber hygiene.

Certification

SMEs can achieve ‘Cyber Essentials Plus’ certification, demonstrating their commitment to cyber security to partners and customers. This certification involves a more rigorous assessment, including external testing.

The Role of Hiscox Cyber Security Exposure Calculator

Tool for SMEs

Hiscox offers a Cyber Security Exposure Calculator that helps SMEs understand their potential financial exposure due to cyber incidents. This tool uses industry data to estimate the financial impact of various cyber threats.

Assumptions and Estimates

The calculator makes assumptions about an SME’s cyber security posture based on average industry data. It provides estimates of potential losses, which can vary depending on the specific circumstances of cyber incidents.

SME Cyber Exposure Examples

Hypothetical Scenarios

The lecture discusses hypothetical scenarios for SMEs in different industries, focusing on revenue size and risk levels. For example:

• Education: An education SME might face significant risks due to the sensitivity of student data and reliance on digital platforms.
• Transportation: Cyber threats could disrupt logistics and supply chain operations.
• Healthcare: Patient data breaches could result in severe financial penalties and loss of trust.
• Telecom: Network outages or data breaches could lead to substantial financial losses and reputational damage.

Sensitivity Analysis for an Education SME

Scenario Analysis

The lecture explores how changing certain factors (protection, detection, recovery capabilities, threat level, and information assets) can affect an SME’s cyber exposure. For an education SME, a detailed breakdown of potential losses highlights the significant financial and operational impacts of cyber attacks.

Conclusion

This lecture provides a comprehensive overview of cyber security risks for SMEs, emphasizing the importance of proper risk management strategies and available tools to assess and mitigate these risks. The evolving nature of cyber insurance and the critical role it plays in enhancing SMEs’ resilience against cyber threats are highlighted.