Only 9% of SMEs Teach Staff about IT Security Risks

Only 9% of SMEs run training courses or email updates teaching staff about IT security risks, finds a Cyber Crime Observatory run by Politecnico di Milano School of Management. This number rises to 20% of medium-small firms and 24% of larger firms. The researchers analysed the information security systems and expenditure breakdown of 803 SMEs operating in Italy last year. Alessandro Piva, director of the research observatory says: “Cybercrime has grown dramatically over the past months, alongside a continued rise in ransomware, where hackers demand payment of a ransom to release data, and attacks on products linked to the Internet of Things. “Yet despite this, SMEs are not taking the threat seriously, with only 9% running training courses or merely emailing information to their employees. Although 93% of SMEs report that they allocated a security budget for 2016, this does not necessarily mean that it was spent in a well-informed manner. In fact, the top reported reason for security expenditure was to comply with legislation (48%).” Companies are struggling to look beyond the short-term and are failing to create robust, future-focused cyber security plans. Piva says: “The need for a long-term approach to how information and privacy are managed and the organisation’s data is kept confidential should be a top concern of a company’s upper management. “It seems that smaller organisations don’t anticipate that they will be targeted as victims of cybercrime in the same way as, say, Yahoo in 2013, where a hack left over one billion users’ information publicly available. Yet without a contingency plan or any preventative measures, these companies are leaving themselves wide-open for potentially devastating cyber-attacks.”