Webcast Summary: Cybersecurity & M365 for SMBs

Ransomware and malware are huge issues for SMBs, whether public sector or private sector. In this podcast, Dave Littmann, managing editor of Truth in IT, Michael Osterman, from Osterman Research, and Zahid Saeed, Global Tech Lead for Microsoft 365 Business, discuss increasing security threats to SMBs and the obstacles to better security, while discussing creative and affordable solutions now available from Microsoft.

 

Bad Actors Continue to Evolve — And Small Businesses Aren’t Prepared

 

Mike Osterman, whose organization focuses on primary research, particularly in the security space, talks to managers, decision-makers, and influencers to understand the security issues they're experiencing (as well as other aspects of IT). Research shows that security threats are increasing across the board — things like phishing, ransomware, spear phishing, and business e-mail compromise. And decision-makers are worried, because these threats impact their businesses’ ability to function on a daily basis.

 

Zahid Saeed, who is also an accomplished leader in cyber security, collaboration, and cloud computing, adds, “ … We see a lot of challenges with virus[es], especially in SMBs, because they don't have large IT [staff], and they're looking for how they can safeguard their businesses and their employees on ransomware and identity theft.”

 

A recent survey from Osterman Research revealed that organizations think they're doing a decent job at protecting end users from ransomware and malware infection. But, Osterman says, “It pretty much falls off from there when we're talking about things like successful account takeovers, training end users … and protecting the data that attackers want.”

 

Major SMB Security Concerns

 

Email security continues to be a major issue. According to Osterman, decision-makers are “worried about users clicking on a link or opening an attachment, and then somehow launching the keystroke loggers or some kind of other malware into the organization or ransomware.”

 

In addition, “Seventy two percent are concerned about employees just failing to spot things like social engineering attacks, phishing attacks and so forth … Most are concerned about targeted attacks. Most are concerned about login credentials being compromised.”

 

And there are no signs of improvement. Says Osterman, “Things are basically staying the same year over year. For many organizations, [they] are getting worse. Phishing attacks, for example, for about a third of organizations, are actually getting worse year over year. Even things like malware infection on the network, for about one out of eight organizations, things are getting worse. Ransomware is getting worse for about one out of eleven.”

 

Businesses Can No Longer Assume They’re Fully Protected

 

According to Osterman:

 

• Close to a third of organizations had sensitive or confidential information leaked through e-mail. This can be things like keystroke loggers that are stealing data.

 

• Twenty-nine percent of organizations had a business e-mail compromise attack successfully trick one or more lower-level employees.

 

• Most decision-makers are concerned about targeted attacks, and those decision-makers are also concerned about login credentials being compromised.

 

And still, according to Saeed, “People still believe they cannot be breached. Or maybe, they will wait till the breach happens” before taking action.

 

Decision-Makers Want Accessible Security Solutions

 

The number of available solutions only complicates the issues. Osterman says, “You go to a security show like RSA, for example — There are many hundreds of different vendors, and it's almost impossible for decision-makers to really understand exactly what they're supposed to be doing in the context of security. What do you implement? Where do you implement it?”

 

BYOD and the High Costs of Management

 

For SMBs, the biggest obstacle to better security against data threats is cost. The cost of effective security per user is incredibly high, so most businesses simply can’t afford it.

 

Another significant obstacle is BYOD. Managing multiple mobile devices, and working to protect them from ransomware, phishing emails, and viruses is an ongoing challenge. Osterman says, “It's generally accepted that employees will use their own devices, so it’s necessary to support all of the personally owned devices that are brought into the workplace. And the device’s different iterations, whether different manufacturers or different operating systems, increase the attack vector exponentially.“

 

 

What is Microsoft Doing to Help SMBs Address Data Security Threats?

 

For Microsoft, artificial intelligence and machine learning are key, and Microsoft’s global reach and data centers are major contributors to both.

 

Saeed says, “We can predict what is going on, like what type of viruses we have. If a big phishing campaign is going on — [we can see] from which IP its coming from and [in] which country it is happening. So all of this helps us to create an obscurity draft which we can analyze and which we can feed back the signals, back to our rich intelligence system.”

 

Microsoft is also focused on data loss prevention, which they call Azure Information Protection.

 

Saeed provides a use case: “Users are typing credit card information in the e-mail … [and] they are trying to send [an] attachment which contains a passport, driver's license, or Social Security [number], which is a big risk [to an] organization. We have DLP technology within M365 Business. So whatever you are typing, [the algorithm] is analyzing it before you send the e-mail, [like a] credit card’s 16-digit number. So it can give a tip to the user [on sending] sensitive information, or based on how you’ve configured it, it can also disable an attachment.

 

Microsoft 365 for business also offers real-time e-mail scanning with AI (time to click protection); encrypt and save data protection; mobile device management (Intune) and Device as a Service (managing users remotely with a single click, on a single dashboard, or configure a new device running Windows 10  — without even opening the box).

 

In Closing

 

Cybersecurity is evolving quickly, and no business can afford to put off better security — or remain complacent. Saeed says, “Any customer who is planning to move to the cloud with advanced security collaboration and mobile device management system should go for M365 Business.”

To Learn More: Check out the on-demand webcast here: Cybersecurity & Microsoft 365 for SMBs