Cyber-risks facing businesses today are significant and only increasing. With many welcoming the EU’s recent announcement that cyber criminals will face tough sanctions under a new regime agreed by member states. James Morrison, Solicitor at Ashfords LLP comments
In April 2019, cyber security firm Malwarebytes reported that the number of cyber threats to businesses has increased 235 per cent over 2018-19. Insurance firm Hiscox recently reported that more than 60% of British businesses have been the victim of one or more cyber-attacks in 2019 already.
Good news
Under the measures, people and organisations could be given travel bans and have their assets frozen if they are found to be responsible for cyber-attacks or to have provided financial, technical or other assistance in connection with a cyber-attack. Significantly, sanctions may also be imposed on people or organisations associated with them.
The UK government has welcomed the new measures describing them as decisive action in deterring future cyber-attacks.
In a statement on the measures, foreign Secretary Jeremy Hunt said, “For too long now, hostile actors have been threatening the EU’s security through disrupting critical infrastructure, attempts to undermine democracy and stealing commercial secrets and money running to billions of Euros. We must now look to impose travel bans and asset-freezes, against those we know have been responsible for this.”
Limited protection
There is no doubt the EU’s recent announcement marks a step forward in the battle against cyber-crime. The measures provide potentially powerful sanctions against cyber-criminals.
However, it is important not to overplay the impact of these measures. Whilst the new EU sanctions will provide some potentially helpful tools for fighting security at an international level, their benefit is unlikely to be felt equally by all organisations.
The new EU measures only apply to cyber-attacks which have a ‘significant effect’. Guidance is yet to be released on the types of attacks that will fall into this category. However, it is possible that an isolated attack against an SME may not be included.
It is more likely that the new regime of measures are aimed at countering attacks on organisations and infrastructure on a national and international scale. One cannot help thinking of the worldwide WannaCry ransomware attack which took a particularly heavy blow to NHS hospitals in England and Wales back in May 2017. Further, in March 2019, Jeremy Hunt warned of the growing vulnerability of democratic elections to interference. It is against these sorts of public targets that these sanctions are likely to be focused.
Even then, there are inherent difficulties associated with law enforcement of cybercrime. Locating and identifying perpetrators, with hackers regularly employing secure software to remain anonymous by hiding their location and routing their communications through multiple countries in order to evade direct detection.
Easy target
Whilst the introduction of international sanctions against those involved in cyber-crime is a positive step, their direct impact on most businesses is likely to be limited. It is therefore important that businesses do not first look to government and international organisations for cyber-protection but rather develop robust cyber security strategies of their own.
The number of cyber-attacks against businesses is increasing at an alarming rate. But what maybe more surprising for SMEs is that size offers no protection to cyber-attacks. Whilst we may be more familiar with stories of large attacks against well-known organisations, it is often SMEs that are most vulnerable to a breach.
Size does not make data any less valuable to criminals. Sensitive information such as customer bank details or staff log-ins are desirable to criminals whether you are an SME or a PLC. And in light of robust regulation such as GDPR, their legal obligations in relation to the protection of that data may be the same.
In fact, SMEs can be particularly attractive to hackers precisely because of their size. Smaller businesses often do not have in place the mechanisms necessary to resist an attack. Therefore, attackers see them as easy targets.
In April, the government published the results of its latest annual cyber security survey. Whilst the survey encouragingly reported an increase in the proportion of SMEs who see cyber security as high priority (74%), there is still cause for concern. Smaller businesses are less likely to seek information, advice or guidance about cyber security compared to larger businesses. Only a quarter of small business have cyber security policies in place and even less have received any cyber security training.
Urgent action
Organisations of all sizes need to implement measures to effectively manage growing cyber-security risks. These are likely to include ongoing assessment of current security capability and implementation of appropriate upgrades, training to minimise human error and the taking out cyber-liability insurance to cover the costs of when things go wrong.
Cyber security is now a key business risk and it is not going to go away. This is reflected in the EU’s recent measures. The sooner SMEs are alive to these risks, the better.
