Providing enterprise-level security to SMEs

It is a common misperception that cyber criminals tend to attack large enterprises due to the financial opportunities this presents. However, it is precisely because smaller and mid-market organisations lack the financial resources, dedicated IT staff and advanced tools of large enterprises that bad actors are increasingly targeting these smaller businesses instead.

In today’s world, cyber criminals have access to the kind of tools that allow them to undertake large-scale automated attacks, meaning that businesses of all sizes are susceptible to this type of random attack.

Demetrios Petropoulos, Chief Sales Officer at Orange Cyberdefense, notes that this means even small and mid-market businesses are facing sophisticated levels of attack. Failing to defend against such a scenario can cause the organisation to suffer data loss, customer information breaches, reputational damage and even the possibility of going out of business entirely.

“As an organisation comprised of ethical hackers, we are aware that companies in this market space can’t really rely on just the cyber security basics anymore. It is for this reason we have developed a five-step programme, which is easy to implement and will allow smaller organisations to move past the basics,” he explains.

“The ultimate aim here is to deliver enterprise-level security in a manner that is affordable and able to protect these businesses the same way that enterprises protect themselves, without needing a large team of experienced security experts, or requiring the management of multiple systems, vendors or contracts.”

He points out that the Mid-Market Cyberdefense Programme his company has developed is structured around five integrated defence components – something the company will elaborate on during a webinar it will host on 7 October – which together represent the customer’s cyber security capabilities.

“The first component is what we call the ‘cyber defence baseline’, where we establish a practical baseline for cyber governance and security hygiene. It uses a lightweight pre-assessment questionnaire, focused discovery session and templated advisory review to identify quick wins, high-risk gaps and a pragmatic 12-month cyber defence roadmap.”

“The second part, we call ‘human defence’, and is a key element, considering that some 70% of breaches are caused by human failure. This component reduces human risk through security awareness, phishing simulations and targeted user education. It is designed to improve user behaviour, increase reporting of suspicious activities and reduce the likelihood of successful social engineering attacks.”

Thirdly, continues Petropoulos, is ‘threat defence’, where a managed detection and response capability is provided – including endpoint detection and response with licensing, extended detection and response with licensing, and a security operations centre (SOC)-based monitoring. This enables clients to benefit from a 24×7 security operations capability, without needing to build or staff their own SOC.

“The fourth element is ‘exposure defence’, which identifies externally visible weaknesses and validates whether attackers can exploit exposed systems, services or misconfigurations. It may include continuous penetration testing, external attack surface management and prioritised remediation guidance,” he adds.

“Finally, there is ‘defence assurance mapping’, a component that provides the reporting, validation and assurance outputs required by executives, customers, insurers and regulators. It translates technical findings into clear business-facing evidence of cyber defence maturity and ongoing improvement. Since many smaller companies act as third-party providers to enterprises, this assurance enables customers to prove to the enterprise they are servicing that they are undertaking correct security measures.”

He indicates that Orange Cyberdefense also works with a number of cyber insurers, who will offer customers better cover and better premiums, because they are utilising this programme.

While there are plenty of interesting and sophisticated technologies running in the background, he suggests that Orange Cyberdefense places emphasis on making these easy to procure, onboard and understand – with the option to co-manage these through an online portal.

“Despite its intended market, this programme is not a one-size-fits-all offering. Some customers may already have invested in certain technologies, or have their own SOC already, and we allow them to use what they have. After all, for us, it is about ensuring they have what they need and that they use it correctly.

“It’s important for customers to understand that we have a 24-year cyber security track record, along with a clear understanding of what enterprises have had to do to secure themselves. We have thus purpose-built our solution using this knowledge, allowing us to offer a quality service at a reasonable price. Moreover, we have the knowledge, understanding and skills to deliver this in a way that will best serve the small and mid-market space,” concludes Petropoulos.

To learn more, join Orange Cyberdefense at its upcoming cyber defence webinar on 7 October, and have the opportunity to watch a live cyber attack and defence. Register here.