Inside the SMB Threat Landscape: AT&T’s Senthil Ramakrishnan on Why Small Businesses Are Cybercrime’s Favorite Target

Did small and midsize businesses are among the most vulnerable targets in cyber security? They make up nearly two-thirds of the global supply chain, but most still lack the resources and the protections to defend against today's cyber threats.

Hi, I'm Joan Goodchild and welcome to another episode of Cyber Sessions. Today we're talking with Senthil Ramakrishnan. He is a cyber expert with AT&T. We're really excited to talk to him about why SMBs are such vulnerable targets and how they can better protect themselves. So, welcome Senthil.

Thank you for having me. Joan, it's a privilege to be on this video series. Great. So, let's just dive right in. let's just start with the big picture. Why are small and medium businesses such vulnerable targets for cyber attacks today?

, the way SMBs are doing business today has fundamentally changed, right? They're no longer this mom and pop, unconnected little entity that's , part of the supply chain. Today, there are a lot more connected, especially connected to the internet.

, you think is for an example, point of sale systems, IoT systems, even API transactions for ordering. All of this is happening over the internet and the internet has become their new lifeline or corporate network.

Now, there's a lot of goodness that comes along with that, but it also exposes these SMBs to this , massive attack surface that they previously didn't even have an idea existed, right?

And so, you couple this with the minimal budgets they have and the lack of knowledge of talent from a cyber perspective. Now, so large attack surface not able to protect themselves.

it's a perfect target and also I think SMBs are now very attractive from an attack surface too right everything from customer records payment details intellectual property you talked about the supply chain and how big they are there and so that also gives indirect access to larger enterprise so all of this together perfect perfect target for cyber criminals today yeah these these the size of these businesses obviously ly they they can't afford the kind of robust security program like a Fortune 500 company has a CISO often several people dedicated to maybe even executive leadership around security it's just not an option for SMBs but yet like I was saying up at the top they are part of the twothirds of the global supply chain so let's dig into that a little bit more like why does SMB security affect the larger global supply chain yeah I mean it's they've become so critical to just you the the global supply chain and they serve as vendors they're logistics providers they're IT service partners they're supplying parts and components and a single compromised SMB can become an entry point for these attackers into multiple organizations because these SMBs are not just serving one customer they're serving multiple customers and so that amplifies the the impact across the entire ecosystem there's that old saying right a chain is only as strong as its weakest link and the SMBs make up that supply chain today and there's this challenge of cascading risk too like the supply chain is no longer constrained to your little region like a large enterprise has parts and components and partners in China there's IT services from India we've got support coming out of Europe so it's spread out everywhere and all of these partners either have to communicate between themselves or are communicating through the large enterprise.

So that gives ample opportunity to weaponize any vulnerability that that each of these partners have. And from a statistics point of view I think Foley produced some statistics that since 2021 there's been a greater than 400% increase in supply chain related cyber attacks related to just SMBs.

So it's a massive it's a massive opportunity today. Is there any sort of specific or I should say attack techniques that SMBs are more vulnerable than to say your really large organization with that budget we mentioned earlier.

or is it kind of the same tricks packaged up in the same ways? It's just that it's sort of easier entry point because of the size of the organization. No, I think it's different. It's still a blend of traditional attack methods and newer advanced technologies like AI today.

But I think the primary factor is the human factor or the f the primary vulnerability is the human factor. I think about 95% Gartner had this statistic 95% of SMB related breaches happen due to some type of human error.

So you think of the older tools like fishing and business email compromise that that still exists today.

that's probably the most common way of reaching or breaking into SMB business but now AI powered fishing is there right so so attackers are using generative AI to craft like highly convincing emails and messages that that mimic their customers their partners even their own executives to bypass the very basic spam filters that that these SMBs are using today and then it comes down to human trust right I see it on my screen came from my boss.

I'm going to go clink click on this link and then boom. you have credential theft, unauthorized software installation. So, so I think that still continues to be the top threat. the second one I'd call out is ransomware.

, the same attack methodology to get into the systems, some type of intrusion to get in, but now it's a double threat. It's a dual threat.

They're not only encrypting your data and holding it ransom, but they're also threatening to leak it and so they're attacking you from two sides. And as a small business, reputation is so important, right?

When this is threatening your livelihood for a large enterprise, they can yeah, have some incident response, fix it, and move on. But for an SMB, this could be the death knell. So, so ransomware continues to be a big one.

And then the last one I call out is because of the lack of knowledge or lack of talent, it's also unpatched systems and the ability to exploit open vulnerabilities, right?

We have so much democratization of attack tools these days that within 20 minutes I can download a set of tools and be able to be up and running compared to the last decade or so where you need to be a expert at cyber crime to be able to go attack somebody.

Um, so, SMBs often delay these patches and updates due to resource constraints and cost. So, it's another reason why they're easy targets. Yeah. Yeah. I mean, I know we've been talking about the human target or the human weakness.

it just continues to be a huge entry point to them. But then, yes, of course, the patching part of it comes in too. again stretched thin, budgets are tight, maybe don't always have people on staff to be able to keep systems up to date and handle the patching.

So, what kind of recommendations do you have here?

We keep hearing, and a lot of conversations like, well, with the with the adoption of a lot of AI, perhaps some of these things might become easier because we might be able to automate some of these some of these more manual processes now so that , teams can get back to more mission critical kinds of work.

I mean is that what you're hearing too or what kind of advice do we give to SMBs about the importance of keeping those systems patched and how to accomplish it? No, absolutely.

I think tools like AI are working in both for the customer and then across the across the table for the attackers as well. Right?

So for an SMB I think it's pretty critical I think the first one is training is trying to fix that human effect or human factor and saying hey you need to have the ability to know what devices you have what software you're putting on your device.

unlike a large enterprise they don't have the luxury of having a full endpoint detection solution running on all their machines or larger XDR or a sock or something like that. So it comes down to almost personal responsibility to manage what you're doing on your business device.

And so that asset discovery and inventory becomes a becomes a personal issue rather than a a a departmental or enterprise wide situation. Right? So I think that's first one is you got to train your people.

teach him that when there's a popup that says, "Hey, you got to update your , your iPad because of a security update is pushed out by Apple, go ahead and do it." That 5 minutes is not going to , the impact of that 5 minutes is much larger than not doing it as well.

Right? the ability to use AI to do automated scanning of what's on your network, I think tools like that is what we need to start looking at. It's becoming a lot more simpler. Lot of software is available. But it's very important to find a trusted partner, right?

There's there's over I think some statistic I was like 6,500 cyber security vendors out there with probably double triple the number of tools and everybody's selling to SMBs cuz they know that's where the market is today.

So trying to find a trusted partner whether it's a managed security service partner or an IT services company that can help you I think that's that's pretty critical pretty critical as well and then layering defense right if email is one of the major points of attack then adding some advanced email protection could be an example even the email providers today you take somebody like a Microsoft or an office 365 outlook based solution they offer cap capabilities that these SMBs can take advantage of.

So, so it's becoming a lot more easier to implement some of these layered approaches, but that also means you have to educate yourself a little bit. Yeah. Yeah. Yeah.

And , you mentioned too like like the toolkits now, like the the tool kits that have been available on the dark web for people to purchase have been around for a while, but now AI only uplevels that even more. what I mean?

So the the bar the threshold for professionalized crime is even is even easier now because you can you can obtain these things easily for a price.

in terms of again going back to sort of techniques and that talk about you things like bulk fix bulk fishing and malware as a service and how how criminals are able to kind of buy into these now in order to be even more stealth with the kind of exploits that they're able to pull off.

Oh absolutely.

fishing and malware right was always a foundational tool in the cyber criminals arsenal but now AI has just scaled that right like if you take bulk fishing now that just means I'm able to send thousands and sometimes even millions of fraudulent emails or messages that are essentially designed to trick the recipients into clicking these malicious links right or downloading some some software now with AI especially generative AI I can I can not only create emails I can create video now I can create images a lot more easier for people to be able to create this stuff.

So it's really scaled it and there's a lot of tools available today and you don't even have to go to the dark web zone.

You can just download them off of the web you and I are using on a daily basis right and you don't need any technical skill to be able to use this. Now you couple this with things like malware as a service.

Now we all know what malware is but with malware as a service it's essentially platforms that are available where attackers have compromised a set of devices usually in like the millions and you can go rent or buy compute on these devices in order to be u install your own software or take advantage of the software that's already on there .

So think ransomware, key loggers to steal credentials, remote access tools, they've all become very very easy. It's amazing. We were we were shown one and it was actually more easier to use than a firewall dashboard that that you'd get from any of the firewall vendors.

It was so userfriendly. It blew my mind. I was like why wouldn't like a teenager sitting in India just pop this open and use it right now? You put all this together and you have a fishing email that comes in sent to thousands of employees. Somebody clicks it.

It's compromised. Now it's a waiting game on who's going to go use it. Right. I think if you remember there was a a mai botnet attack a few years ago that essentially took advantage of IoT devices which I think SMBs are unknowingly installing across their business.

Cameras know everybody buys cameras off of Amazon. , nobody knows where it's coming from. It it works. I'm sticking it in there.

And I think that Mariah botnet was used as a DNS was used to attack the DNS infrastructure and took down I don't know a large part of the internet. So it's amazing how simple things have become these days.

But that just means the SMBs have to be more prepared to protect themselves.

There's the last point I want to make that is on the education front there's this it's a small target illusion right these SMBs just believe that I'm too small for anybody to care to attack me but because these tools are so easy to use and so simple to use they're now the big targets yeah yeah I know I think that again that that mindset of like well what do I have that's worth anything I mean even from a personal standpoint people have been thinking that for years And I mean the the answer to that is everything.

There's everything can be weaponized these days.

and there's the old sort of cliche too that's been around for years about because sort of in the early days of cyber crime since I've been covering security for 20 years there was sort of this notion that these criminals are so intelligent if only they would use this intelligence to do something legitimate.

But it's kind of really not the argument anymore, right?

Cuz you can buy a kit and if especially if you're living in a country where you can make a tremendous amount of money for compared to what you would would make if you went out and found an actual job I think that's a tough sell sometimes for for for the person that's considering buying an exploit kit online.

It it is it is right. , you talk about , video and voice , cloning using AI. It becomes so easy these days and I can pay a dollar to get access to these tools today.

And I I just need it for a few hours so that I can I can build, a set of emails or messages that I can then use to attack and , we talked about the supply chain aspect, right? this just doesn't affect just the SMB space alone.

It is much more farreaching like the target hack came through the HVAC vendor, right? And we're adding more and more connected devices which means more and more partners, more and more access across the board, no matter what the size of your business is. And so, it's challenging.

at the house.

We bought a we we did a kitchen remodel and we got a new fridge and the fridge was connected and I was like I don't know why my fridge needs to be connected but you expand that into the into the commercial space and it becomes more challenging. Yep.

Yep. It's just another entry point. Okay. now you mentioned a minute ago too but I want to go back to it too like sort of these misconceptions the I'm too small to be a target. We now know that that is absolutely not true.

But are there any other misconceptions out there that you hear among SMB security practitioners or that there there's this idea that isn't necessarily true that we should sort of warn folks about. I think the other one is compl regulatory compliance equals security.

a lot of these businesses have to be PCIDSS or HIPPA or GDPR if you're global. So they're meeting a lot of these regulatory compliances, but it never guarantees protection of security, right? Compliance again is a minimum set of standards.

It doesn't cover any of the evolving threats like ransomware or fishing kind of like what we talked about. to me, true security means there's continuous monitoring, there's continuous patching, there's layered defenses beyond just a compliance checklist. So I think that's another one.

Um, and then the simplest one to me is antivirus equals security, right? Traditionally, everybody's like, I got an antivirus on my computer. I'm good to go. And I I don't think that's valid anymore. and the last thing is training. , people overlook that training aspect so much.

, we were talking to as part of work, we were talking to a SMB customer who was compromised and they were like, "Oh man, I spent, $10,000 on this firewall and I thought I was good to go." But, it came down to user error on whether how it was configured or what got through and what got clicked.

So, that that human error piece, just because I have a piece of technology doesn't mean I'm I'm protected. I got to make sure my humans are trained and are acting intelligently, too. Right. Right. Right. Yeah.

And I mean, and it's it's tough again because budgets are so much tighter, too. , that $10,000 on a firewall, that's that's big money.

I heard for an SMB, and I heard a a statistic the other day when I was at an event where the person who was speaking mentioned a really massive company that was down for seven minutes. It was in healthcare.

and they were down for 7 minutes and the cost of that breach and the being out of so not being able to operate for just that 7 minutes the cost to them was in the billions but for an SMB what I mean where it's like it's a very different budget landscape and what they're working with that that $10,000 feels like a tremendous investment and so so kind of what is the lesson there about what the stakes are you're not a Fortune 500 company maybe seven minutes down isn't going to cost you billions of dollars.

But I mean for an SMB that it could potentially mean reputational risk that means you're out of business in a year, I mean it's right. Yeah. Mhm. Yeah. The impacts are bigger, right?

Like like that 7 billion for that enterprise is is a big number, but they might have ins they might have cyber insurance and so they're covered or they have some contingency plan for an SMB like you said.

I think it's it's reputational damage leading to the deathnell of their business, right? one or two partners are compromised because of them or if they're not able to fulfill orders or they're losing sensitive data, that could be the end of an SMB.

And so it's and it also limits them from scaling, right? I don't think these SMBs want to stay SMBs.

They want to kind of grow up the stack and , and a cyber security breach just takes them back so far that it's almost like restarting to try to get back to where you are. Yeah. Yeah. All right. Well, we like to leave people with , some takeaways.

So, do you have any recommendations for any of our SMB, affiliated viewers who might be watching? I mean, what are a couple of things that they could take back to what they're doing today to try to improve their security posture? Well, no, absolutely.

While they might not have like enterprise level budgets, I think there's a few practical steps that they can take, right? Like first one, like I said, I always it's always number one for me. Teach your staff, train your staff to recognize fishing, social engineering, and suspicious behavior.

It's not expensive to do that. , a couple thousand dollars a year to bring in a training company to go do that. Um, second one is email filtering, right? , enable multiffactor authentication, add some advanced email filtering into whatever you're using.

Um, last one is is have an incident response plan. I think unfortunately Joan, you and I know this. It's not a question of if. Now it's become a question of when am I going to be impacted.

So having a incident response plan so that you're ready when when the worst case situation happens, both legal, technical, and communication, I think is critical. And then go change your passwords, change them often, change.

I I I just I know the Lou Museum is not a small business, but when I read that their password was Lou, I was like, what? Yeah.

I literally just read that right before we got on to record our episode here and I was like you cannot make this stuff up. I I was shocked to read that. Yeah.

Just for for those who are those who are watching for clarification, we're recording at the time when the Louve was just robbed a few about a week or so ago and today in the news that has come out that the password for some of their sensitive systems was literally Lou Lra.

I'm not I don't speak French but yeah. So what's the takeaway there? Sometimes it's the simplest things, what I mean? Budget or not, the simplest things. Cyber hygiene, right? Exactly. like cyber security is no longer optional.

I think it's no matter the size of your business, it's business imperative, right? and SMBs that invest in basic protections and more importantly foster a security aware culture are far less likely to suffer some cat catastrophic breach. Great. All right.

Well, Senthil from AT&T, AT&T cyber expert, thank you so much for joining us today. It was great having you as a guest. Thanks for having me. All right, great. And thanks to you for watching.

If you liked what you saw and you want to see some more episodes of Cyber Sessions, we encourage you to like and subscribe and follow along for more. For now, I'm Joan Goodchild. See you next time. [Music]