Long before the unfortunate term “COVID-19” entered the global vocabulary, small and mid-sized businesses (SMBs) were racing to the cloud. And the reasons for this accelerated adoption were and remain clear: leveraging the cloud drives cost savings, collaboration, scalability, backup and disaster recovery, integration with other systems and apps in the environment, and of course, remote working. Indeed, 57% of SMBs that were forced to pivot from on-site to remote working due to the pandemic have said they will continue supporting a remote workforce for the long-term, even after it is safe for people to return to the office.
However, despite the significant — and for many SMBs, essential — advantages of migrating to the cloud, there is a potential drawback that must be considered: security vulnerabilities.
Why the cloud is stronger
To start with, it is important to point out that cloud security today is much stronger than it was in the past. For example:
- Cloud service providers monitor security 24/7, and they conduct ongoing penetration testing — which is a level of scrutiny that most SMBs with limited budgets cannot achieve, especially given the massive ongoing cybersecurity skills shortage.
- Unlike on-premises systems that rely primarily on firewalls to block hackers, cloud systems deploy multiple layers of security.
- Cloud security uses AI and machine learning to anticipate and eliminate threats.
- Cloud systems store data in multiple locations, which safeguards data against hardware failure and corruption.
- Storing data in the cloud can reduce the frequency and severity of insider threats.
In addition to the above, there has been another major step forward in terms of security: a growing number of cloud service providers are developing strong, customized threat assessment models to detect potential leaks proactively. On top of that, some of the more transparent and security-focused vendors have established “Bug Bounty Programs” to encourage and incentivize white hat security researchers to escalate vulnerabilities and bugs privately, so they can be patched before the bad guys exploit them.
What SMBs need to do
While the cloud is much stronger today than it was in the past, this is absolutely no time for SMBs to let their guard down. Hackers are increasingly attacking SMBs because, compared to many larger enterprises, they often have weaker cybersecurity defenses. As discussed above, leveraging the cloud is a smart way to close the vulnerability gap. But SMBs need to go further to protect their data, their customers, and their reputations, especially given that the average cost of a cyberattack on SMBs has surpassed $200,000 per incident, and 60% of SMBs are forced to shut down within six months of being hacked.
Specifically, here are five practical and pivotal things that all SMBs should do, regardless of the size or extent of their cloud footprint at this time:
- Implement multi-factor authentication (MFA). This is an extra layer of security that requires end-users to enter their login credentials plus another piece of information, which can be: something they have (e.g., smartphone or token), something they know (e.g., the answer to a secret question or a PIN), or something they are (e.g., fingerprint or retina scan).
- Establish a Privileged Access Management (PAM) program that includes auditing all accounts to determine which ones require privileged access and which do not; auditing all users to determine who requires privileged access and who does not; and monitoring all account access and using reports/logs to enforce compliance.
- Establish a process to offboard departing end-users properly. For example, a workflow can be set up in human resources where IT is immediately notified when an end-user is scheduled to leave the company.
- Implement single sign-on (SSO), enabling end-users to log in once using a single set of credentials and access approved apps and websites. This is especially vital because each time an end-user logs into an application, a gateway is opened through which hackers can attack. Fewer gateways mean a smaller attack surface.
- Use a cloud-based password manager, allowing end-users to store and manage passwords in an approved and secure manner (instead of spreadsheets, emails, etc.). This also allows SMBs to create shared vaults to store passwords for privileged accounts.
The bottom line
The work landscape is chaotic right now, but we can say with certainty that two trends will dominate in the months and years ahead: more people will work remotely, and more organizations — especially SMBs — will use the cloud. Adopting all five of the recommendations described above will go a long way to ensuring that the future for SMBs is safe and rewarding, instead of stressful and costly.
This guest article has been prepared by Maxime Trottier, VP Sales & Marketing at Devolutions. Thank you, Maxime!
Photo credit: The feature image has been done by Tomas Kirvėla. The photo in the body of the article was taken by Casey Otto. The picture of the author is owned by himself.
Source: Esther Shein (TechRepublic) / Jon Oltsik (CSO) / Wikipedia / Help Net Security / Scott Steinberg (CNBC) / Joe Galvin (Inc)
