Small Budget, Big Protection: Cyber Defense for SMBs

Robert Wagner opens with the problem: small and medium businesses often run security with very little money, staff and authority, and tend to repeat mistakes that larger companies made years ago. He frames the gap using the idea of a security poverty line, below which an organization cannot reach basic hygiene, and names money, expertise, capability and influence as the main hurdles.

The middle of the talk focuses on people and process rather than technology alone. He covers hiring a virtual CISO who speaks business language, building a low-cost team of interns and rotating roles so staff teach each other, and writing job posts that avoid biased wording. He also describes free awareness resources, rewards that encourage staff to report odd activity, insider-risk signals that are easier to spot in small companies, and using CIS control implementation groups to set priorities. Risk is presented as probabilities and dollar thresholds rather than heat maps, and assessments are described as more useful when scoped well and run with the testers given a foothold.

Toward the end, he recommends inexpensive technical steps: MFA for everyone including third parties, logging privileged activity, jump boxes as a choke point, immutable cloud backups, regularly reloaded golden images, automation of repeated tasks, and deception tokens such as canary files and honey tables. He closes by suggesting that larger companies and local institutions help smaller ones through advisory boards and shared guidance.