As a small or medium sized business (SMB), the last year has likely been a struggle to survive, with all hands focusing on reimagining operations in a pandemic world.As a small or medium sized business (SMB), the last year has likely been a struggle to survive, with all hands focusing on reimagining operations in a pandemic world.

Now, as things finally start to ease back to “normal” a new type of plague is spreading: – cyber-attacks. 

From Colonial to SolarWinds, there seems to be weekly assaults on American industry, with SMBs paying an ever-increasing price.
It is not unusual for a SMB to go out of business after a cyber-attack. The average Phishing attack costs a SMB $1.6B. The average Ransomware attack costs a SMB $713k.

Cyber insurance is in vogue BUT it does not do what most people think it does and it can potentially make you more of a target. In the world of Risk Management, insurance is a treatment to transfer risk. It does nothing to mitigate. You essentially pay someone to help offset some of the cost. Worse yet, we know hackers target organizations they know to have insurance because those organizations are more likely to pay a ransom. In our experience many organizations are disappointed to learn how much is actually covered during a cyber event.

Whether it is as one of 30,000 or so direct victims exposed to theft or ransomware, or with collateral damage like higher prices for products or services caused by rising fuel costs, the SMB bottom lines shrink with every new cyber breach.

In this new “cyber” normal, SMBs are facing a special problem. Few companies can afford to prepare to defend against this novel onslaught of cyber threats and regroup from the pandemic. 

With “keeping the doors open” operations taking priority, this often means cuts to IT or simply cyber status quo, and hope that each day ends without being part of a headline.

SMBs shouldn’t have to decide between reconstituting their livelihoods and information security. And with the right cyber strategy, they won’t have to. 

While we have longed been engaged in a cyber arms race, attempting to invent our way out of cyber risk, many are starting to realize that human talent and experience are what ultimately make the difference.

Our adversaries’ ability to defeat technology is largely based on a pesky human capacity to adapt and overcome. Their people are the ones driving the machines, while most modern defense strategies largely strive to get the human out of the loop, as we tend to want our “intelligent” defense mechanism to act autonomously.

As this approach continues to fail spectacularly, some are revisiting the wisdom of Alexander the Great:
“I am not afraid of an army of lions led by a sheep; I am afraid of an army of sheep led by a lion.”

In this case, “sheep” are our rather weak system and security appliances, and the lion is a highly skilled, nation-state level cyber operator.
For the SMBs, it is better to invest in a cyber “gunslinger” of sort, who can organize your people, set your defenses, and lead in a time of crisis, than by wasting money on services and tools proven to disappoint.

Not only will you gain more bang for your buck, but this option is often cheaper in the long run than security products and services that are designed with a profit motive. And besides, most SMBs are still very personal endeavors that live off customer service and “regulars.” Shouldn’t your security feel the same?

A few things to look for when selecting your lion:
• experience protecting against the most serious threats imposed by nation-state and terrorists
• a true systems thinker comfortable with the technology and the core principles of corporate governance
• a technical or engineering background
• an ability to articulate a clear vision for securing your crown jewels and keeping you operational (mission focused)

While some might not think they can take on an extra cost in these lean times, a change to this philosophy will likely cost less than your current solutions, and save you tremendously in the event of an attack. Can you afford a “down” day or week during this period of recovery?

As we all look forward to a reopening this summer and fall, let’s also rethink how we defend our systems before it’s too late. For SMBs, it can be as simple as one hire to turn a weakness into strength and avoid ever having the word “victim” associated with your business.

For more information on finding the right lion or implementing this strategy, please contact Talon Cyber Tec at 714.434.7476.

Written by John Callahan

Ron Williams
United States Secret Service-Retired
CEO
Talon Companies