#NSBCS.049 - Bridging the Cybersecurity Poverty Line: A Balancing Act for Businesses

31 Oct

Bridging the Cybersecurity Poverty Line: A Balancing Act for Businesses

In the digital age, robust cybersecurity is no longer a luxury but a necessity. Unfortunately for many businesses, especially small and medium-sized enterprises (SMEs), a harsh reality looms and they find themselves grappling with a significant challenge - protecting their digital assets without the budget to afford cutting-edge cybersecurity measures.

This concept is often referred to as the “cybersecurity poverty line”, where organisations lack the financial resources to implement robust security solutions, leaving them vulnerable to cyber threats. It describes companies that lack the financial, technological, or specialised personnel resources needed to adequately secure their operations against a constantly evolving and increasingly complex threat landscape.

Business owners stuck under this line face a delicate balancing act, trying to safeguard their digital assets while grappling with limited budgets and the need to maintain business margins.

What is the Cybersecurity Poverty Line?

The cybersecurity poverty line refers to the point at which organisations can no longer afford the necessary tools, personnel, and practices to sufficiently protect themselves from cyber threats.

Businesses below this line often experience gaps in:

Advanced threat detection and response systems;
Continuous security monitoring and management;
An effective cybersecurity operating model;
Skilled and experienced cybersecurity professionals; and
Resources for regular software updates, patching, and risk management practices.

For these businesses, the cost of enterprise-grade security solutions, such as Security Information and Event Management (SIEM) systems, endpoint detection and response (EDR) tools, and skilled cybersecurity staff, is prohibitive.

As a result, they are left vulnerable to real and impending risks such as data breaches, ransomware, and phishing attacks. This impact of these attacks can cripple operations, damage reputation, and erode customer trust, leaving businesses even more financially vulnerable. Many SME’s lack the means to build or maintain a full in-house cybersecurity team or invest in expensive security technologies. But cybercriminals don’t distinguish based on company size.

The Evolving Threat Landscape

The complexity and volume of cyber threats have grown exponentially. According to various industry reports, SMEs are increasingly becoming targets for cybercriminals because they are perceived as "low-hanging fruit"- easier to infiltrate compared to larger enterprises with more sophisticated defences.

From increasingly sophisticated phishing attacks to ransomware-as-a-service (RaaS) platforms that lower the barrier for would-be attackers, the range of threats facing businesses today is staggering. These risks are constant and indiscriminate, putting even the most resource-strapped SMEs at serious risk.

Cyberattacks can be particularly devastating for smaller businesses, so those operating on or below the cybersecurity poverty line must seek alternative strategies to strengthen their defences.

Cost-Effective Security Solutions and Services

There are several key technologies and services that can help SMBs enhance their cybersecurity posture without overspending:

Managed Security Services - Many consulting firms offer managed security services (MSS), which can be particularly beneficial for resource-strapped businesses. Managed Security Service Providers (MSSPs) provide affordable outsourced security services, including threat monitoring, cyber threat intelligence, vulnerability management, and cybersecurity incident response. These services enable businesses to access expert cybersecurity protection without the high cost of maintaining an internal security team.
Cloud-Based Security Solutions - Many cloud service providers offer built-in security features, including encryption, multi-factor authentication (MFA), and continuous monitoring. By migrating to trusted cloud platforms, businesses can leverage enterprise-grade security without the need for costly on-premise infrastructure.
Security Information and Event Management (SIEM) - While traditionally expensive, cloud-based SIEM solutions have made it possible for SMBs to afford centralised logging and monitoring of their network activities. By using these platforms, businesses can detect unusual behaviour and potential threats more easily, reducing response times and minimising damage.
Endpoint Detection and Response (EDR) - EDR tools automatically detect and respond to threats on individual devices. They offer advanced threat-hunting capabilities that previously only large enterprises could afford. By adopting EDR, even smaller businesses can gain visibility into potential threats and take quick action.
Cyber Insurance - While it won’t prevent an attack, cyber insurance can help businesses recover from one. It can cover the costs of data recovery, legal fees, notification processes, and business interruption losses. For businesses with limited budgets, this safety net can mean the difference between surviving a breach and closing down.

A Balanced Approach to Cybersecurity

As the digital landscape evolves, businesses cannot afford to ignore cybersecurity, regardless of their size or budget. For those on or below the cybersecurity poverty line, the key is balancing the need for protection with financial realities. Cost-Effective Security Solutions and Services can bridge the gap between limited resources and the growing need for security for organisations.

Business owners shouldn’t have to choose between staying secure and staying solvent. With the right mix of consulting, technology, and affordable services, businesses can protect themselves from cyber threats, even within limited budgets, ensuring they’re not just surviving, but thriving in the digital age and take #NoStepsBackward.

For information on NSB Cyber’s Cyber Resilience capabilities or to book a meeting with our team, click here.

What we read this week

'Midnight Blizzard' Targets Networks With Signed RDP Files - The Midnight Blizzard group has recently targeted multiple organisations with a spear-phishing campaign involving signed Remote Desktop Protocol (RDP) files. In this attack, they send emails with malicious RDP attachments, which, once opened, connect the victim's device to a server under the attackers' control. This setup allows the attackers to access local drives and potentially install persistent malware, enabling ongoing access even after the RDP session ends. Midnight Blizzard’s tactic exploits trust by using signed RDP files that evade standard security checks. Microsoft has advised affected organisations to implement multi-factor authentication, monitor for unusual network activity, and educate users on the dangers of such phishing schemes.
Cisco Patches Vulnerability Exploited in Large-Scale Brute-Force Campaign - Cisco has patched a vulnerability (CVE-2024-20481) in its Adaptive Security Appliance and Firepower Threat Defence products, which attackers exploited in a large-scale brute-force campaign targeting VPN authentication. This flaw, which leads to denial-of-service by exhausting system resources, affects devices with Remote Access virtual private network (VPN) enabled. Cisco discovered these attacks in a broader campaign affecting various vendors, including Checkpoint and Fortinet. In total, 50 vulnerabilities were addressed, including three critical flaws that could allow attackers full system control. Cisco urges users to apply patches promptly to mitigate these threats.
Black Basta Ransomware Poses as IT Support on Microsoft Teams to Breach Networks - Black Basta ransomware is now posing as IT support on Microsoft Teams to breach corporate networks. They first overwhelm employees with spam emails and then, pretending to assist with this spam issue, contact them on Teams. The attackers pose as corporate IT, using deceptive usernames, and request remote access tools like AnyDesk. Once connected, they install malware such as Cobalt Strike, gaining deeper network access to deploy ransomware. Security experts recommend restricting external Teams communication and enabling logging to detect suspicious activity.
Researchers Uncover OS Downgrade Vulnerability Targeting Microsoft Windows Kernel - Researchers identified a new operating system (OS) downgrade vulnerability in Windows that allows attackers to bypass Driver Signature Enforcement (DSE), enabling the installation of unsigned kernel drivers. This vulnerability relies on a tool called Windows Downdate, exploiting flaws in the Windows update process to downgrade systems and bypass key security features. The attack also involves disabling Virtualisation-Based Security (VBS), giving attackers kernel-level access for rootkit installation and persistence. Microsoft has patched the vulnerabilities involved, though strict security settings are advised to prevent similar attacks.
QNAP Patches Second Zero-Day Exploited at Pwn2Own to Get Root - QNAP recently patched a second zero-day vulnerability, CVE-2024-50387, exploited during the Pwn2Own hacking competition to gain root access on its NAS devices. This SQL injection flaw, found in the Server Message Block (SMB) Service, allowed security researchers to breach a QNAP TS-464 NAS device. Another critical zero-day in QNAP's HBS 3 backup software was also patched after being used in the same competition for command execution.

References
https://www.darkreading.com/cyberattacks-data-breaches/midnight-blizzard-targets-networks-signed-rdp-files
https://www.securityweek.com/cisco-patches-vulnerability-exploited-in-large-scale-brute-force-campaign/
https://www.bleepingcomputer.com/news/security/black-basta-ransomware-poses-as-it-support-on-microsoft-teams-to-breach-networks/
https://thehackernews.com/2024/10/researchers-uncover-os-downgrade.html
https://www.bleepingcomputer.com/news/security/qnap-patches-second-zero-day-exploited-at-pwn2own-to-get-root/

Shane Bell