Cybersecurity: where should SME directors begin?

For many SME directors, cybersecurity appears on the list of priorities, but rarely is at the top of said list.

Between daily operations, business growth, recruiting challenges, and the arrival of new technologies like artificial intelligence, it may be difficult to decide where to focus efforts and resources.

This is precisely the topic explored by the hosts of Longueur d’avance, Etienne Crevier and Dominic Gagnon, who recently sat down with Joëlle-Alexandra Desmarais Lauzon, Vice-President, Security, at nesto. Throughout their discussion, one thing became clear: cybersecurity improvement doesn’t necessarily begin with the purchase of a new tool. Rather, it starts with a better understanding of the risks to which the company is exposed and what truly needs to be protected.

The good news is, you don’t need to change everything over night. Start by adopting these six reflexes.

When talking about cybersecurity, often, the first instinct is to look for a better technological solution.

And yet, the first step should be defining what is critical to the company. For certain organizations, this is primarily customer data.

For others, it can be intellectual property, financial information, or even systems used to ensure day-to-day operations.

Each business has a different risk profile.

Before even thinking about tools, ask yourself a simple question: 

What would happen if some data became inaccessible or had been compromised by the time you logged in tomorrow?

The answer often makes it easier to define the appropriate priorities.

There’s no need for all SMEs to hire a cybersecurity expert right off the bat.

However, someone does need to be responsible for it.

Whether a director, manager, or employee with an interest in information security, the person ensures initiatives are applied, coordinates efforts, and keeps the matter at the forefront.

Just like finance and human resources, cybersecurity should be recognized as a clearly assigned responsibility.

There are various solutions on the market. However, some of the most basic measures remain the most effective. 

Enable two-factor authentication
This protection adds a step when logging into an account, but significantly reduces the risks of password theft.

Use a password manager
Weak or reused passwords are a major vulnerability for several organizations.

Perform regular backups
Backups play a key role in ensuring business continuity, and they help recover faster from a given incident.

Keep a log of your systems and accesses

Knowing which tools are used, who has access to them, and which partners can consult some of the data is essential in all security initiatives.

Technology is important, but it’s only part of the equation. Cybercriminals often prey on human behaviour: fraudulent emails, fake links, unusual requests, or identity theft attempts.

That’s why raising team awareness remains an essential lever.

Employees should be able to:

• Recognize unusual situations;
• Validate suspicious requests;
• Know who to contact when in doubt;
• Report a potential incident quickly.

The more teams are informed, the more the organization has the power to respond effectively.

One of the most interesting topics discussed during the podcast pertains to organizational culture.

In many companies, employees are hesitant to report an error by fear of potential consequences.

However, if someone thinks they may have clicked on a malicious link or inadvertently shared sensitive information, time is of the essence.

A culture based on trust fosters faster incident detection and allows the appropriate teams to intervene before the situation escalates.

In terms of cybersecurity, finding out about an error is often much more useful than looking for a guilty party.

An effective culture of security depends both on trust and technology.

Artificial intelligence is quickly being integrated into workplaces.

Rather than forbid its use entirely, several organizations are setting out clear rules to support the adoption of these tools.

These questions can serve as a good starting point:

• Which information can be shared in these tools?
• Which information should remain confidential?
• Which tools are approved by the company?
• What kind of usage is encouraged?

The goal is to allow innovation while protecting the company’s most sensitive assets.

Cybersecurity may seem complex as a whole. However, as Joëlle-Alexandra Desmarais Lauzon explains in this episode of Longueur d’avance, companies that fare better are not necessarily those that invest the most. Instead, it is those that gradually develop a better understanding of their risks and a culture of daily vigilance.

In this SME and cybersecurity month, remember that protecting your business rarely starts with technology. It starts by asking the right questions.