Tackling Cyber Threats faced by MSMEs
Introduction
MSMEs, being the cornerstone of the Indian economy, are one of the most vulnerable targets in cyberspace and no enterprise is too small to be a target for malicious actors. MSMEs hardly ever perform a cyber-risk assessment, but when they do, they may run into a number of internal problems, such as cyberattacks brought on by inadequate networking security, online fraud, ransomware assaults, etc. Tackling cyber threats in MSMEs is critical mainly because of their high level of dependance on digital technologies and the growing sophistication of cyber attacks. Protecting them from cyber threats is essential, as a security breach can have devastating consequences, including financial loss, reputational damage, and operational disruptions.
Key Cyber Threats that MSMEs are facing
MSMEs are most vulnerable to are phishing attacks, ransomware, malware and viruses, insider threats, social engineering attacks, supply chain attacks, credential stuffing and brute force attacks and Distributed Denial of Service (DDoS) Attacks. Some of these attacks are described as under-
- Insider threats arise from employees or contractors who intentionally or unintentionally compromise security. It involves data theft, misuse of access privileges, or accidental data exposure.
- Social engineering attacks involve manipulating individuals into divulging confidential information or performing actions that compromise security by pretexting, baiting, and impersonation.
- Supply chain attacks exploit the trust in relationships between businesses and their suppliers and introduce malware, compromise data integrity, and disrupt operations.
- Credential stuffing and brute force attacks give unauthorized access to accounts and systems, leading to data breaches and financial losses.
Challenges Faced by MSMEs in Cybersecurity
The challenges faced by MSMEs in cyber security are mainly due to limited resources and budget constraints which leads to other issues such as a lack of specialized expertise as MSMEs often lack the IT support of cyber security experts. Awareness and training are needed to mitigate poor understanding of cyber threats and their complexity in nature. Vulnerabilities in the supply chain are present as they rely on third-party vendors and partners often, introducing potential supply chain vulnerabilities. Regulatory compliance is often complex and is taken seriously only when an issue crops up but it needs special attention especially with the DPDP Act coming in. The lack of an incident response plan leads to delayed and inadequate responses to cyber incidents, increasing the impact of breaches.
Best Practices for Tackling Cyber Threats for MSMEs
To effectively tackle cyber threats, MSMEs should adopt a comprehensive approach such as:
- Implementing and enforcing strong access controls by using MFA or 2FA and password policies. Limiting employee access as role based and updating the same as and when needed.
- Regularly apply security patches and use automated patch management solutions to prevent exploitation of known vulnerabilities.
- Conduct employee training and awareness programs and promote a security-first approach for the employees and assessing employee readiness to identify improvement areas.
- Implement network security measures by using firewalls and intrusion detection systems. Using secure Wi-Fi networks via strong encryptions and changing default credentials for the router are recommended, as is segmenting networks to limit lateral movement within the network in case of a breach.
- Regular data backup ensures that in case of an attack, data loss can be recovered and made available in secure offsite locations to protect it from unauthorized access.
- Developing an incident response plan that outlines the roles, responsibilities and procedure for responding to cyber incidents with regular drills to ensure readiness and clear communication protocols for incident reporting to regulators, stakeholders and customers.
- Implement endpoint security solutions using antivirus and anti-malware softwares. Devices should be against unauthorized access and implement mobile device management solutions enforcing security policies on employee-owned devices used for work purposes.
- Cyber insurance coverage will help in transferring financial risks in case of cyber incidents. It should have comprehensive coverage including business interruptions, data restoration, legal liabilities and incident response costs.
Recommended Cybersecurity Solutions Tailored for MSMEs
- A Managed Security Service Provider offers outsourced cybersecurity services, including threat monitoring, incident response, and vulnerability management that may be lacking in-house.
- Cloud-Based Security Solutions such as firewall as a service and Security Information and Event Management , provide scalable and cost-effective protection for MSMEs.
- Endpoint Detection and Response (EDR) Tools detect and respond to threats on endpoints, providing real-time visibility into potential threats and automating incident response actions.
- Security Awareness Training Platforms deliver interactive training sessions and simulations to educate employees about cybersecurity threats and best practices.
Conclusion
Addressing cyber threats in MSMEs requires a proactive and multi-layered approach that encompasses technical solutions, employee training, and strategic planning. By implementing best practices and leveraging cybersecurity solutions tailored to their specific needs, MSMEs can significantly enhance their resilience against cyber threats. As cyber threats continue to evolve, staying informed about the latest trends and adopting a culture of security awareness will be essential for MSMEs to protect their assets, reputation, and bottom line.
References:
- https://economictimes.indiatimes.com/small-biz/security-tech/security/cyber-security-pitfalls-and-how-negligence-can-be-expensive-for-msmes/articleshow/99508822.cms?from=mdr
- https://www.investopedia.com/financial-edge/0112/3-ways-cyber-crime-impacts-business.aspx
- https://www.financialexpress.com/business/sme-msme-tech-cisco-launches-new-tool-for-smbs-to-assess-their-cybersecurity-readiness-2538348/
- https://www.cloverinfotech.com/blog/small-businesses-big-problems-are-cyber-attacks-crushing-indias-msmes/
Related Blogs
Introduction
The increase in consumer demands has resulted in a sharp increase in digital financing in India. As a result, the reputation of the digital lending sector has been impacted, as bad actors increasingly deploy illicit lending platforms such as fraudulent loans and trading apps. As millions of Indians download fast loan applications to help them meet their financial ends, the fraudulent apps result in cyber crimes including financial fraud. Consumers need to be vigilant of dubious trading or loan applications as bad actors frequently use illegitimate apps to trick victims by advertising limited-period offers and applying pressure.
Recently the Indian Cyber Crime Coordination Centre (I4C) led handel CyberDost has issued a cybercrime alert against the ‘CashExpand-U’ finance assistant app, which has been now removed from the Google Play Store. The app was found to be associated with hostile foreign entities, and the app had made it easier to raise small loans. However, such loan apps are seldom credible and may compromise financial information.
Raising cases of Fraudulent Loan Apps
The finance minister had stated that the government is constantly engaged with the Reserve Bank of India and other regulators and stakeholders to control fraudulent loan apps. In FY23, there were 1,062 complaints against such apps, the Finance Minister shared during a Lok Sabha session. Google removed almost 134 fake apps from the Play Store in a single week in September 2023 after multiple complaints were registered against such apps. The Reserve Bank of India (RBI) had also issued regulatory guidelines on digital lending in April 2023 to bring transparency in the digital loan space.
CyberPeace Policy Wing Advisory for Users
- Be cautious of App Permissions
Fake lending apps collect data by fraudulently taking numerous app permissions from consumers and misusing them later. The users must effectively manage their app permissions to avoid denying any extra permissions such as access to contacts, location, and photos. This is because fraudulent digital lenders access users' personal data to extort additional money even after loan repayment.
- Practice Due Diligence
Consumers must exercise care & caution before applying for a loan from digital lending platforms. Before applying for a loan or downloading any such apps, consumers must conduct due diligence by verifying the app's name, rating, reviews, physical address, and contact information. Always double-verify the paperwork before signing any agreement or contract. Always apply for loans from RBI-approved and compliant banking and financial services providers.
- Download from Official Sources
To avoid downloading counterfeit apps, only download lending apps from official stores like Google Play Store or Apple App Store, and avoid downloading apps from web links sent via SMS, email, or social media, even if shared by your known persons.
- Be sceptical of too-good-to-be-true offerings
Be cautious of deals that seem too good to be true, like hassle-free easy loans as they can be fraudulent. If an offer seems too good to be true, it might be a red flag. Hence always conduct your own research to verify the lender and avoid making hasty decisions.
- Reporting Mechanism
In case of facing a scam by such fraudulent apps, victims can file a complaint with the ‘National Cyber Crime Reporting Portal’ or Cyber Crime Helpline ‘1930’, or they can also contact us at CyberPeace Helpline +919570000066 and helpline@cyberpeace.net to get assistance in reporting their cases.
Final Words
Illegitimate loan/trading apps have been raising concerns by defrauding innocent consumers who seek financial assistance. The Center has recently warned against the CashExpand-U app, which has been now removed from the Google Play Store. Users are advised to exercise due care and caution while downloading loan apps and applying for loans to prevent any potential scams. keep up to date with news from concerned authorities about common scams and fraudulent practices in the lending space and stay safe in the online world.
References:
- https://www.livemint.com/news/beware-govt-issues-cybercrime-alert-against-loan-app-cashexpand-u-finance-assistant-11720338996430.html
- https://timesofindia.indiatimes.com/technology/tech-news/government-has-issued-an-important-warning-for-this-loan-app/articleshow/111541577.cms
Introduction
In today's era of digitalised community and connections, social media has become an integral part of our lives. we use social media to connect with our friends and family, and social media is also used for business purposes. Social media offers us numerous opportunities and ease to connect and communicate with larger communities. While it also poses some challenges, while we use social media, we come across issues such as inappropriate content, online harassment, online stalking, account hacking, misuse of personal information or data, privacy issues, fake accounts, Intellectual property violation issues, abusive and dishearted content, content against the terms and condition policy of the platform and more. To deal with such issues, social media entities have proper reporting mechanisms and set terms and conditions guidelines to effectively prevent such issues and by addressing them in the best possible way by platform help centre or reporting mechanism.
The Role of Help Centers in Resolving User Complaints:
The help centres are established on platforms to address user complaints and provide satisfactory assistance or resolution. Addressing user complaints is a key component of maintaining a safe and secure digital environment for users. Platform-centric help centres play a vital role in providing users with a resource to seek assistance and report their issues.
Some common issues reported on social media:
- Reporting abusive content: Users can report content that they find abusive, offensive, or in violation of platform policies. These reports are reviewed by the help centre.
- Reporting CSAM (Child Sexual Abuse Material): CSAM content can be reported to platform help centre. Social media platforms have stringent policies in place to address such concerns and ensure a safe digital environment for everyone, including children.
- Reporting Misinformation or Fake News: With the proliferation of misinformation online, users can report content that they find or suspect misleading or false information and Fact-checking bodies are employed to assess the accuracy of reported content.
- Content violating intellectual property rights: If there is a violation or infringement of any intellectual property work, it can be reported on the platform.
- Violence of commercial policies: Products listed on social media platforms are also needed to comply with the platform’s Commercial Policies.
Submitting a Complaint to the Indian Grievance Officer for Facebook:
A user can report his issue through the below-mentioned websites:
The user can go to the Facebook Help Center, where go to the "Reporting a Problem” section, then by clicking on Reporting a Problem, Choose the Appropriate Issue that best describes your complaint. For example, if you have encountered inappropriate or abusive content, select the ‘I found inappropriate or abusive content’ option.
Here is a list of issues which you can report on Facebook:
- My account has been hacked.
- I've lost access to a page or a group I used to manage.
- I've found a fake profile or a profile that's pretending to be me.
- I am being bullied or harassed.
- I found inappropriate or abusive content.
- I want to report content showing me in nudity/partial nudity or in a sexual act.
- I (or someone I am legally responsible for) appear in content that I do not want to be displayed.
- I am a law enforcement official seeking to access user data.
- I am a government official or a court officer seeking to submit an order, notice or direction.
- I want to download my personal data or report an issue with how Facebook is processing my data.
- I want to report an Intellectual Property infringement.
- I want to report another issue.
Then, describe your issues and attach supporting evidence such as screenshots, then submit your report. After submitting a report, you will receive a confirmation that your report has been submitted to the platform. The platform will review the complaint within the stipulated time period, and users can also check the status of their filed complaint. Appropriate action will be taken by platforms after reviewing such complaints. If it violates any standard policy, terms & conditions, or privacy policies of the platform, the platform will take down that content or will take any other appropriate action.
Conclusion:
It is important to be aware of your rights in a digital landscape and report such issues to the platform. It is essential to understand how to report your issues or grievances on social media platforms effectively. By using the help centre or reporting mechanism of the platform, users can effectively file their complaints on the platform and contribute to a safer and more responsible online environment. Social media platforms have their compliance framework and privacy and policy guidelines in place to ensure the compliance framework for community standards and legal requirements. So, whenever you encounter an issue on social media, report it on the platform and contribute to a safer digital environment on social media platforms.
References:
- https://www.cyberyodha.org/2023/09/how-to-submit-complaint-to-indian.html
- https://transparency.fb.com/en-gb/enforcement/taking-action/complaints-handling-process/
- https://www.facebook.com/help/contact/278770247037228
- https://www.facebook.com/help/263149623790594
%20(1).webp)
Introduction
The Central Electricity Authority (CEA) has released the Draft Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2024, inviting ‘comments’ from stakeholders, including the general public, which are to be submitted by 10 September 2024. The new regulation is intended to make India’s power sector more cyber-resilient and responsive to counter emerging cyber threats and safeguard the nation's power infrastructure.
Key Highlights of the CEA’s New (Cyber Security in Power Sector) Regulations, 2024
- Central Electricity Authority has framed the ‘Cyber Security in Power Sector Regulations, 2024’ in the exercise of the powers conferred by sub-section (1) of 177 of the Electricity Act, 2003 in order to make regulations for measures relating to Cyber Security in the power sector.
- The scope of the regulation entails that these regulations will be applicable to all Responsible Entities, Regional Power Committees, Appropriate Commission, Appropriate Government and Associated Power Sector Government Organizations, and Training Institutes recognized by the Authority, Authority and Vendors.
- One key aspect of the proposed regulation is the establishment of a dedicated Computer Security Incident Response Team (CSIRT) for the power sector. This team will coordinate a unified cyber defense strategy throughout the sector, establishing security frameworks, and serving as the main agency for handling incident response and recovery. The CSIRT will also be responsible for creating/developing Standard Operating Procedures (SOPs), security policies, and best practices for incident response activities in consultation with CERT-In and NCIIPC. The detailed roles and responsibilities of CSIRT are outlined under Chapter 2 of the said regulations.
- All responsible entities in the power sector as mentioned under the scope of the regulation, are mandated to appoint a Chief Information Security Officer (CISO) and an alternate CISO, who need to be Indian nationals and who are senior management employees. The regulations specify that these officers must directly report to the CEO/Head of the Responsible Entity. Thus emphasizing the critical nature of CISO’s roles in safeguarding the nation’s power grid sector assets.
- All Responsible Entities shall establish an Information Security Division (ISD) dedicated to ensuring Cyber Security, headed by the CISO and remain operational around the clock. The schedule under regulation entails that the minimum workforce required for setting up an ISD is 04 (Four) officers including CISO and 04 officers/officials for shift operations. Sufficient workforce and infrastructure support shall be ensured for ISD. The detailed functions and responsibilities of ISD are outlined under Chapter 5 regulation 10. Furthermore, the ISD shall be manned by sufficient numbers of officers, having valid certificates of successful completion of domain-specific Cyber Security courses.
- The regulation obliged the entities to have a defined, documented and maintained Cyber Security Policy which is approved by the Board or Head of the entity. The regulation also obliged the entities to have a Cyber Crisis Management Plan (CCMP) approved by the higher management.
- As regards upskilling and empowerment the regulation advocates for organising or conducting periodic Cyber Security awareness programs and Cyber Security exercises including mock drills and tabletop exercises.
CyberPeace Policy Outlook
CyberPeace Policy & Advocacy Vertical has submitted its detailed recommendations on the proposed ‘Cyber Security in Power Sector Regulations, 2024’ to the Central Electricity Authority, Government of India. We have advised on various aspects within the regulation including harmonisation of these regulations with other rules as issued by CERT-In and NCIIPC, at present. As this needs to be clarified which set of guidelines will supersede in case of any discrepancy that may arise. Additionally, we advised on incorporating or making modifications to specific provisions under the regulation for a more robust framework. We have also emphasized legal mandates and penalties for non-compliance with cybersecurity, so as to make sure that these regulations do not only act as guiding principles but also provide stringent measures in case of non-compliance.
References:
