How to protect yourself from frequent cyberattacks?
Small and medium-sized businesses, which make up nearly 99.5% of the domestic economy and contribute over 51% to GDP, are often targets of hacker attacks. Therefore, applying preventive measures such as creating backups, installing antivirus software, updating operating systems and applications, encrypting data, and using strong passwords is crucial for reducing the risk of cyberattacks, according to the guide "Guidelines for Information Security for Small and Medium Enterprises."
The guide was created as part of the "Strengthening Information Security" project, implemented by NALED and TAG International, with the support of the British Embassy in Belgrade. Although awareness of data protection and the prevention of losses is growing, most small and medium-sized enterprises apply less stringent measures than necessary.
According to the latest available data from the Serbian Statistical Office, only about 40% of companies encrypt their data, documents, and emails, while only 13% of small businesses and one in four medium-sized businesses assess the risk of hacker attacks. Only a third of small businesses and less than half of medium-sized businesses use antivirus programs. More than one method of protection for accessing emails and other sensitive data is rarely implemented. Less than one-fifth of small businesses and 40% of medium-sized businesses employ experts in information and communication technologies.
- It is impossible to prevent all cyberattacks, and there will certainly be some, but it is possible to stop some or most of them and prepare so that the consequences are minimal. The first line of defense is held by employees, who need to be aware of the importance of protecting their data, both in business and private life. Only through proactive protection can businesses reduce the risk of money, intellectual property, and data theft, says Dragana Ilić, president of NALED's eGovernment Alliance and director of corporate affairs at CETIN.
Among the important measures to protect against hacker attacks is the "clean desk" rule, which means that employees should lock their computers when leaving the office and secure any documents containing sensitive information. Strong passwords and multi-factor authentication (email, SMS, OTP) should be used, as well as secure internet browsers. When working from home, the private wireless network should be secured, and in public places, it is mandatory to turn off Bluetooth, avoid using open Wi-Fi networks, and be cautious and limited when sharing personal data, especially on social media.
In regular annual reports on cyberattacks, IBM Security states that 30% of all incidents occurred in Europe, and the average damage caused by data breaches is around $4.88 million, including lost business. In more than 30% of cases, the cause of the data breach was an attempt to steal personal data through emails, SMS messages, and even phone calls, or stolen and otherwise compromised passwords. The motives for cyberattacks, besides stealing money and identity, may also include disrupting operations and damaging the company's reputation.
- In small and medium-sized businesses in Serbia, awareness of the risks associated with internet use is not sufficiently developed, or these risks are consciously ignored due to a lack of resources and personnel. Serbia should soon adopt an upgraded Information Security Law, which will be aligned with new European directives. One of the main changes is that all businesses operating in sectors such as energy, transport, banking, and healthcare will be required to check their systems' compliance with cybersecurity protection measures at least twice a year. The law emphasizes training and raising awareness about the importance of defense against cyberattacks, strengthening public-private sector collaboration, information exchange, and early risk assessment, says Ilić.
As part of the "Strengthening Information Security" project, alongside the guide for small and medium-sized businesses, Guidelines for Local Governments have also been developed. As with companies, municipalities also require mechanisms for preparation and protection, which include establishing procedures for data protection and employee actions in the event of an attack, installing new licensed software, and developing a recovery plan in case of a successful cyber breach.
