The 2022 activity report of the ANSSI (National Agency for the Security of Information Systems) is formal: the number of reports related to ransomware has increased by 255%. 

According to Guillaume Poupard, its managing director, “both private and public players are still too little aware of the risk and of their own vulnerability. “While cyber threats are becoming more and more present, few companies have implemented a real cybersecurity strategy. 

Just as fire safety is mandatory in business premises, it is necessary to protect against cyberattacks which can be fatal, especially for VSEs/SMEs, which are little or not equipped with defensive barriers. 

Understanding malware

Malware is a general term for malicious software. Viruses, worms, and ransomware are just some of the most common types of malware. Viruses infect your devices and allow hackers to break in and steal data. Viruses also spread to other devices, like computers on a network, by sending copies of themselves in email attachments or by visiting malicious websites.

Worms are designed to spread rapidly to break through firewalls and other protective systems and disrupt operations by bringing down networks.

Malware is often disguised as legitimate software that you download. You can protect yourself against malware by downloading programs only from official websites and avoiding suspicious or unverified downloads. You can also install antivirus software on your devices and keep it updated to catch malware before it can do any damage. For email security, you can use a trusted AI-powered email security platform such as Trustifi.

Leaders of small structures and CIOs of SMEs / ETIs must be at the forefront of the fight against computer attacks and think upstream of a real cyber policy. 

1. Multiple and sophisticated intrusions

Cyberattacks have multiplied since the appearance of Covid-19 and the generalization of telework. In 2021, more than one French company in two declared having suffered at least one successful cyberattack. The report points to three growing trends: 

• Big Game Hunting, which consists of targeting companies with the capacity to pay large ransoms
• Ransomware -as-a-service (RaaS) which offers any novice hacker a service platform to distribute ransomware
• and the double extortion that is increasingly practiced following a ransomware attack, the cybercriminal threatening to release the data he has taken hostage if the ransom is not paid to him. Under these conditions, a company that has been the victim of such an attack can see its financial health deteriorated to the point of going out of business.

For its part, the Cybermalveillance.gouv.fr platform shows that in 2021, ransomware was the main reason for seeking assistance, both for companies and associations (24% of their searches) and for communities and administrations. (20%).

 Figures show that VSEs/SMEs are indeed targeted and that, without appropriate defense, they seek help from the State. 

2. Networks with little or no protection

Business information systems (IS) have been transformed with the arrival of all-digital technology. Today, infrastructures, networks, fixed and mobile terminals use H24 to transfer data flows essential to any company. They also represent multiple entry points for hackers. 

These can target emails through an infected attachment or web link. They also have the possibility of introducing ransomware inside an advertising banner, an image, a mobile app, or USB key.

 They can also take advantage of a software or hardware flaw or even connect to an unsecured public Wi-Fi network. In teleworking, the development of BYOD (Bring Your Own Device) represents an additional danger. 

Ultimately, the multiplication of entry points makes life easier for them. Leaders need to realize how easily a hacker can inoculate a virus into a corporate network. The DSI can audit and propose solutions to secure the entry points.

3. VSMEs: priority targets

Hackers have every interest in attacking small structures, with little or no defense, rather than attacking an ETI or a large group, they are better able to counter hacking. 

VSEs/SMEs, which represent 99.9% of companies and provide work for approximately 7 million employees, must stop being targets of choice. The good health of the economic and social fabric of France depends on it. 

Proof of this trend targeting small businesses, in 2021 the number of ransomware attacks targeting SMBs increased by 53%. 

The number of cyberattacks targeting companies continues to grow year after year, whether in France or internationally. Since the start of the pandemic, cybercrime has increased by 600%! Hackers continue to professionalize, therefore there is no lull in sight in terms of cyber risks.

Even today, nearly 7 out of 10 SMEs ⁽⁸⁾ think that they are not a potential target for cybercriminals! In the absence of missing safety devices, they are on the contrary easy prey… and profitable.

These disturbing figures should alert managers to the need to put in place anti-piracy protections.

4. Often fatal financial damage

The financial cost generated by a cyberattack constitutes the second major impact for the target company. In parallel with restarting the network and restoring data, it must set up crisis management as quickly as possible to deal with numerous challenges in the short and medium term. 

First, by filing a complaint and being assisted by a specialized lawyer, which generates legal costs. Then by adopting measures to preserve its media, financial and legal reputation. 

Otherwise, it risks finding itself faced with numerous or even insoluble problems that could lead to its filing for bankruptcy. 

Such as the erosion of turnover linked to the loss of customer confidence which does not renew its contract, loss of image of the value of its brand, loss of intellectual property, increase in the cost of its debt and insurance premiums, etc. 

On average, the cost of a cyberattack is estimated at €18,465 for VSMEs.

Cyberattacks against companies are increasing more as hybrid work develops: 46% of VSMEs now allow their employees to work remotely. 

The use of the cloud, collaborative solutions, but also a greater number of terminals and networks to access the IS significantly increases the attack surface of companies.

Hackers are acquiring increasingly sophisticated tools to force entry into a network, impersonate a collaborator or facilitate the execution of malware (early launch anti malware).

 Faced with these facts proven by exponentially increasing figures, it is now essential to protect your company by deploying multiple security measures (antivirus, antispam, anti-phishing, web filtering, intrusion prevention system, etc.): it can now go for the survival of your business.

 Turnkey dedicated outsourced cybersecurity solutions exist. They are offered by telecom operators, also security integrators.

To further protect themselves, companies can adopt a “by design” security policy. This approach consists of integrating the concept of security and risk management into the development of each new product, system, or application. Scenarios are established based on identified risks to reduce the consequences of potential security incidents. Finally, this approach also makes it possible to generate trust, which creates business, with customers and users.

Cybersecurity is now inseparable from business issues. 

While it is up to each company to assume its responsibilities to protect its ecosystem, it is important to favor partners who also take the appropriate measures in this area.