Small business not necessarily weakest security link
Small businesses may not be the weakest link in the supply chain after all, with a lack of skills and best practices being bigger factors, a study by (ISC)² reveals.
Half of the large enterprises view third-party partners of any size as a cybersecurity risk, according to the latest Securing the partner ecosystem study by security professionals’ association (ISC)2.
However, only 14% have experienced a breach as the result of a small business partner, while 17% have been breached as the result of working with a larger partner, the poll of more than 700 security professionals across North America reveals.
These findings contradict the widely held belief that small businesses serve as the easiest conduit for cyber attacks against large enterprises, with 94% of respondents saying they are “confident” or “very confident” in their small business partners’ cybersecurity practices, while 95% said they have a standard process for vetting their suppliers’ cybersecurity capabilities.
“This research highlights the fact that building a strong cybersecurity culture and subscribing to the right best practices can help organisations of any size maximise their security effectiveness,” said Wesley Simpson, (ISC)2 chief operating officer.
“It’s a good reminder that in any partner ecosystem, the responsibility for protecting systems and data needs to be a collaborative effort, and multiple fail safes should be deployed to maintain a vigilant and secure environment. The blame game is a poor deterrent to cyber attacks.”
Nearly two-thirds (64%) of large enterprises outsource at least a quarter (26%) of their daily business tasks, which requires them to allow third-party access to their data. These outsourced functions can include anything from research and development to IT services and account payable.
This data access and sharing are necessary as a large enterprise scales its operations, but the research indicates that access management and vulnerability mitigation is often overlooked.
More than a third (34%) of large enterprise respondents said they have been surprised by the broad level of access a third-party provider has been granted to their network and data, while a similar proportion (39%) of small business respondents expressed the same surprise about the access they were granted when providing services to large enterprise partners.
The study also shows that 35% of large enterprise respondents admitted that when alerted by a third party to insecure data access policies, nothing changes in the large enterprise’s practices, while 55% of small business respondents reported that they still had access to a client’s network or data after completing a project or contract.
More than half (54%) of small business respondents have been surprised by some of their large enterprise clients’ inadequate security practices, and 53% have provided notification of security vulnerabilities they have discovered in large enterprise networks.
The report found that while small businesses have fewer employees overall, the proportion of their cybersecurity staff is not necessarily lower than in large enterprises. Nearly half (42%) of small businesses, with 250 or fewer workers, employ at least five dedicated cybersecurity staff.
By comparison, 75% of large enterprises, with more than 1,000 employees, have at least 10 staff members focused on cybersecurity. This means that some small businesses have a higher percentage of security professionals working to implement best practices and defend data and networks.
The study found that, while they may have differing toolsets, small businesses and large enterprises approach data protection similarly by focusing on many of the same cybersecurity best practices.
Both sets of respondents indicated that they employ the same top three best practices to protect their networks and data:
- Regular automatic scans with antivirus and anti-malware programs.
- Blocking access to known malicious IP addresses through firewall configuration.
- Strong email filters to prevent phishing.
The report concludes that enterprises are just as likely to be breached through a relationship with a larger third-party supplier and that enterprises need to improve their security practices in some critical areas, specifically in relation to addressing security issues discovered by partners and removing access to systems when partners no longer need it
“Breach prevention responsibility rests with all parties in a partnership, and enterprises should have the proper layered security controls in place to defend themselves from all angles of attack,” the report said.
Creating a strong culture focused on cybersecurity is a core element in raising the bar of cyber competence and readiness, no matter the size of the organisation, the report notes.
The report cited a 2018 study by (ISC)2 which found that companies that recruit and maintain strong cybersecurity teams – and are by extension more confident in being able to defend their information systems – do it by fostering a resilient culture of cybersecurity, in which executives understand and reinforce the importance of security practices, hire certified security professionals, train and promote from within, and draft clear job descriptions when hiring.
“Size isn’t the best indicator of a company’s cybersecurity abilities or likelihood of being breached. It’s everyone’s joint responsibility to do their due diligence in working with partners when shared access to networks is concerned,” the report said.
source computerweekly
Industry: Cyber Security
Latest Jobs
-
- Senior Client Microsoft Security Delivery Consultant - Hybrid (London | Remote)
- London
- N/A
-
Senior Client Microsoft Security Delivery Consultant - Hybrid (London | Remote) We are seeking an experienced technical Security Consultant to help clients deploy and enhance their cyber defences across Microsoft and vulnerability management technologies. You will work with enterprise customers to deliver tailored solutions across threat detection, endpoint protection and exposure management, ensuring security platforms are efficient, integrated and aligned with operational goals. Whilst you won't do the design yourself- you will work alongside technical Presales to document, agree and then deliver the solution. You will have experience leading delivery the implementation and improvement projects, providing hands-on support with configuration, integration and optimisation. You will assess existing environments, recommend enhancements and guide clients on best practice to strengthen visibility and control. Strong experience with SIEM, XDR and vulnerability tooling (Microsoft & Tenable ecosystems ideal) Understanding of Azure security, identity and access controls Background in consulting or project-based cyber delivery Clear communication skills with the ability to engage senior stakeholders Extra points if you have the SC-100. You must be eligible to achieve UK Security Clearance to be considered for this role.
-
- Account Director | Cyber Security Consulting | UK - South East
- London
- N/A
-
Account Director | Cyber Security Consulting - Financial Services | UK - South East. New Role due to Growth We are looking for an experienced Account Director to develop and expand existing relationships across the financial services sector, working with investment firms, asset managers, private equity groups and strategic partners to deliver intelligent cyber consulting and a bespoke Cyber product offerings. You will act as a trusted advisor, helping organisations strengthen digital resilience, manage third-party and regulatory risk and adopt a proactive approach to cyber assurance. Key Responsibilities Manage a defined portfolio of financial clients, understanding business priorities and aligning tailored cyber solutions. Drive new client engagement while nurturing existing partnerships through a consultative, long-term approach. Present the benefits of advanced cyber services including threat intelligence, vulnerability management, incident readiness, and continuous risk monitoring. Collaborate with technical and delivery teams to ensure smooth engagement from proposal through to implementation and ongoing support. Prepare proposals, negotiate commercial terms, and clearly articulate value and business outcomes. Build trusted relationships at senior and board level. Ideal Profile Strong background in cybersecurity, consulting, or risk management within financial services. Skilled communicator with proven success managing and growing key accounts. Able to translate complex technical insight into commercial and strategic value for clients. Confident engaging with senior stakeholders and decision makers. Please note: Sponsorship is not available.
-
- SOC Analyst- Level 2- Hybrid Greater London
- London
- N/A
-
SOC Analyst- Level 2- Hybrid Greater London New opportunity created through continued growth. We’re looking for a SOC Analyst (Level 2) to strengthen a growing managed security team. You’ll work hands-on with Microsoft Sentinel and Defender XDR, investigating alerts, responding to incidents, and helping improve how clients stay protected. This role is ideal for someone who enjoys unravelling security events, thinking critically under pressure, and making a real difference day to day. What you’ll do · Investigate and respond to security activity across SIEM and endpoint tools · Analyse network and log data to uncover real threats · Support automation initiatives to streamline response processes · Help maintain visibility, data flow, and performance across SOC platforms What you’ll need · Practical experience using Microsoft Sentinel and Defender XDR · Confident working with KQL or similar query languages · Understanding of attacker tactics and response techniques · SC-200 certifications would be nice. · Experience supporting multiple customer environments Please note: Sponsorship is not available.
-
- Senior SOC Engineer - UK - New role due to growth
- London
- N/A
-
Senior SOC Engineer – New role due to growth We are hiring a Senior SOC Engineer to take the lead across security operations for a growing managed service. You will lead detection, response and onboarding activity across multiple clients, helping shape how the SOC evolves. Expect variety; from fine-tuning alerts and threat hunting to supporting customers and mentoring junior analysts. What you’ll bring · Strong experience across SIEM, EDR, and threat detection tools · Confident working with customers in a managed service environment · Skilled in scripting or query languages such as KQL or PowerShell · Knowledge of frameworks like NIST, ISO27001, MITRE ATT&CK · Calm communicator with a problem-solving mindset · Experience with Azure Lighthouse or delegated access models · Prior involvement in automation or SOC improvement projects Location: South East England- Hybrid role Please note: Sponsorship cannot be offered now or in the future.