Affordable cybersecurity for SMEs: protecting IT and OT
SMEs that recognise the need for stronger cybersecurity understand that the threats are real. Whether it involves days of disruption caused by ransomware or lasting reputational damage following a data breach, the risks are too significant to ignore. The good news is that effective cybersecurity does not always require a large budget.
In a previous article, we discussed how to choose the right cybersecurity solution. In this article, we provide practical advice on protecting both your IT environment and the operational technology that keeps production lines running, even if you do not have the budget of a multinational organisation.
KISS: keep it simple
We cannot emphasise this enough: make sure your IT environment only contains the systems and connections you genuinely need. The more interfaces you have, including software and systems that employees or customers can access externally, the more potential entry points you create for attackers.
One of the greatest pitfalls for SMEs is making the IT environment unnecessarily complex. A complicated network is not only more difficult to manage but can also introduce additional vulnerabilities that attackers may exploit. It is therefore important to keep the infrastructure as simple as possible. This means designing clear and manageable network structures without unnecessary components.
If you answer “yes” to many of the following questions, it may be time to consider simplifying your IT environment.
- Do we have IT systems that do not support the organisation’s core processes and objectives?
- Do we lack a complete and current overview of all IT systems and the connections between them?
- Do we have multiple IT systems or applications that provide the same functionality?
- Are integrations insufficiently documented or unclear to our IT team?
- Could we reduce costs by consolidating or removing systems?
- Do we spend considerable time and resources managing interfaces and integrations?
- Do internal or external users experience our IT systems and integrations as complex, inefficient or ineffective?
- Do we receive complaints or experience recurring problems involving our IT systems?
Be realistic: complete protection does not exist, but you must be able to respond in time
It is almost impossible to isolate an IT environment completely from every external threat. Instead of attempting to build an impenetrable fortress, SMEs should focus on realistic and achievable security measures. These include updating software and systems regularly, using strong authentication and multi-factor authentication, and training employees to recognise phishing and other forms of cyberattack.
These measures will not eliminate every possible risk, particularly when a skilled attacker deliberately targets your IT or OT environment. However, they can prevent many common attacks. Even if your IT environment has been simplified to services such as Microsoft 365, attackers will continue trying to gain access.
It is therefore essential that someone monitors security alerts from platforms such as Microsoft Defender and reviews unusual activity across the network. If you do not have the necessary expertise internally, working with external cybersecurity specialists can be a practical and cost-effective solution.
Not sure where to start? Speak to an external expert
It can be valuable to speak periodically with an independent cybersecurity expert. An external specialist can provide a fresh perspective, identify weaknesses and recommend improvements based on your organisation’s specific IT and OT environments.
Businesses in the UK and Europe can also use guidance and support provided by national cybersecurity authorities and industry organisations.
- The UK’s National Cyber Security Centre provides practical cybersecurity guidance for small organisations. Its recommendations cover subjects including account security, device protection, backups and recognising cyberattacks.
- Cyber Essentials is a UK government-backed scheme based on five technical controls designed to protect organisations against common internet-based cyber threats. Certification can also help organisations demonstrate their security standards to customers and supply chain partners.
- The European Union Agency for Cybersecurity provides cybersecurity guidance, threat information and resources for organisations operating within the European Union.
- National cybersecurity authorities and Computer Security Incident Response Teams provide country-specific advice about threats, incident reporting and applicable legislation.
- Industry associations, regional manufacturing networks and cyber resilience centres can connect SMEs with experts and other organisations facing similar cybersecurity challenges.
At SBL, we are always willing to provide initial advice without obligation or cost. We will not recommend a solution unless it genuinely suits your organisation’s IT and OT environments.
Jan Jaarsma, founder of SBL Cyber Monitoring
Our approach at SBL Cyber Monitoring
SBL Cyber Monitoring provides managed detection and response services. This means that we monitor our customers’ networks and systems and respond immediately when we identify genuinely suspicious activity. The objective is to detect cyber incidents as early as possible and minimise the potential impact on the customer.
Our first step is always a cybersecurity assessment. During this assessment, we map the organisation’s IT and OT environments. We examine how the existing configuration can be improved, including straightforward measures such as implementing multi-factor authentication, correcting configuration errors and removing unnecessary connections.
Existing security sources, such as Microsoft 365, firewalls and endpoint detection and response platforms, can be connected to WatchEagle. This enables us to collect, correlate and analyse alerts from individual IT systems. Our expert system first examines, verifies and prioritises the alerts. The remaining alerts are then assessed by our security analysts. This approach enables us to process large volumes of data and involve a specialist when there are genuine indications of a threat.
If we detect a serious attack, we contact the customer and their IT team or service provider to address the situation. This could involve updating vulnerable server software or, in more serious cases, disabling specific accounts or network connections to prevent further unauthorised access.
Protecting the connection between IT and OT
Manufacturing companies must consider more than their office IT systems. Production machinery, industrial control systems and other operational technology may also be connected to the corporate network or to external service providers.
Unnecessary or insufficiently secured connections between IT and OT environments can allow an attacker to move towards critical production systems. Clear network segmentation, controlled access and continuous monitoring help reduce this risk without disrupting normal production processes.
The objective is not to add as many security products as possible. It is to understand how systems are connected, remove unnecessary complexity and monitor the network traffic that genuinely matters.
Conclusion
Cybersecurity does not need to be unnecessarily complicated or expensive to be effective. In some cases, an assessment may reveal that the IT environment can be simplified. This can reduce security risks and operating costs at the same time.
For SMEs in the manufacturing industry, the challenge is to find the right balance between sufficient protection and solutions that remain practical for employees. By keeping networks manageable, setting realistic security objectives and working with trusted external partners, organisations can strengthen their protection against cyberattacks without investing in unnecessary systems.
There is no single security measure that provides complete protection. However, with a clear understanding of your risks and the right combination of prevention, monitoring and response, effective cybersecurity does not need to be prohibitively expensive.
The statement “there is no such thing as a little security” was made during a conversation with Jan Jaarsma, one of the founders of SBL Cyber Monitoring. It is one of the reasons why our pricing is transparent and proportionate to an organisation’s risk profile. The more complex the IT network and the more data sources that need to be monitored, the more extensive the service will need to be. This reflects the importance and complexity of IT and OT within the organisation. By managing network complexity, organisations can reduce costs while improving their security.
