← GZERO World with Ian Bremmer
GZERO World with Ian Bremmer
Cyber resilience for small enterprises
00:23:36
In this episode of Local to global: The power of small business, host JJ Ramberg sits down with Shamina Singh, Founder & President of the Mastercard Center for Inclusive Growth, and Brian Cute, Interim CEO and Director of Capacity & Resilience at the Global Cyber Alliance, to explore what Southeast Asia’s fast-growing digital economy reveals about the cybersecurity challenges facing micro, small and medium-sized businesses everywhere.
Loading summary
Transcript36 lines
- [00:00]
A
When you really think about how its supply chain works, it's a feeding ground for cybercriminals with small businesses who aren't protected. And not only can it take out the small businesses, it can actually compromise the data of large enterprises as well.
- [00:14]
B
In 2023 in Southeast Asia, there was about 18 to 37 billion dollars lost for small business owners through fraud and scam. What our research shows is that about one in four businesses have been attacked. So this is a really serious issue for all business owners around the world.
- [00:37]
C
I'm JJ Ramberg and this is local to Global the Power of Small Business, a podcast from GZero Media's Blue Circle Studios, produced in partnership with Mastercard. In our previous three episodes, we looked at different aspects of small business growth around the globe, all fueled by a rising middle class. And along the way, we've seen the many ways that local solutions and opportunities can be shaped by global forces. We wrap up the series today with the incredible growth of small businesses in Southeast Asia and the risks, particularly cybersecurity risks that those businesses face. Our focus is on the association of Southeast Asian nations, or asean, a regional bloc that includes Indonesia, Singapore, Malaysia, Thailand, Vietnam, the Philippines and several of their neighbors. Together, ASEAN represents more than 670 million people, and it's on track to become one of the world's four largest economies. But underneath all that growth is a massive vulnerability. As more commerce moves online, the potential pool of targets for cybercriminals grows larger as well. And at the same time, smaller firms usually have far fewer defenses against such attacks than larger organizations. In fact, recent research across Asia Pacific shows that most SMEs have already experienced at least one cyber incident in the past year, and only about 2/3 of small firms in ASEAN have adopted basic cybersecurity software. The good news is that this is starting to change thanks to a series of collaborative initiatives. Today we're going to look at how companies like MasterCard are partnering with organizations like the Global Cyber alliance and governments to extend practical cybersecurity tools, training and products to small businesses so that even the smallest enterprises can access world class protection. Joining me now is Shamina Singh, Founder and President of the center for Inclusive Growth at mastercard, and Brian Q, Interim CEO and Director of Capacity and Resilience from Global Cyber Alliance.
- [02:42]
B
Hi jj, thank you so much for having me. Really excited to be here.
- [02:46]
A
Thank you so much for having me here today. I'm really excited to be with you in Shamina.
- [02:50]
C
Shamina, I want to start with you just to talk about the growth of small business. When we look at Southeast Asia, in terms of this growth that we know is being unlocked by digital tools like payments and platforms and cross border commerce, where is the momentum coming from?
- [03:07]
B
A billion people joined the middle class over the last 10 years in this region. A billion more will join the middle class over the next 10. That's an enormous amount of purchasing power, consumption patterns that are gonna be changing over the next 10 years. And guess who's gonna be serving them and catering to them? Small business owners. So you can see the momentum, especially in this part of the world, is really growing when it comes to consumption, small business growth and population growth, especially around the middle class.
- [03:41]
C
So if you think about a restaurant owner in Jakarta or a textile shop in Ho Chi Minh City and they're trying to go digital to compete in this new world, what does small business vulnerability look like on the ground and what's actually at stake here for those businesses?
- [03:56]
B
Whether you're in Ho Chi Minh City, Honolulu or Akron, A lot of what we're talking about, especially when it comes to cybersecurity issues, are things that we can all relate to. We've been working on our mastercard strive small business program for several years and we've come to understand small business owners need to go digital. They need access to capital and they need to grow their network and their know how. Then when it comes to going digital, what we see especially in this part of the world is, you know, attacks by ransomware and phishingware and malware and all of the things, all the hacking that we hear about every day. And what our research shows is that about one in four businesses have been attacked and, and usually within, unfortunately within six months to a year, many of them, in fact over half of them don't recover and go out of business. So this is a really serious issue for all business owners around the world.
- [04:56]
C
Is this an issue of education or of resources? Are people getting hacked because they just don't know not to respond to something or is it that they need to spend money on more protection?
- [05:09]
A
I think the response is both. Small businesses, they just don't know what they don't know. And you know, let's be honest, it and cybersecurity of its nature is kind of a complex topic. You know, it can be very daunting. Even people who have a baseline level of knowledge, understanding what all of their risks are and as we would say the attack vectors against them are, can be daunting. So education is important, raising awareness and helping small business owners Understand what their risks are is really the first step. But also giving them the tools they need to protect themselves is as important.
- [05:47]
C
I want to talk about the solutions in a second, but let's talk about what a big deal it is for a small business to get attacked because some people listening to us might think it's awful. As Shamina said, a business is attacked, they shut down in six months. And how heartbreaking. But it's actually much bigger than that because Southeast Asia is a manufacturing and supply chain powerhouse for the entire world. So when a small supplier in this region gets hit by a cyber attack, what are the ripple effects?
- [06:16]
A
They're enormous. But let's first start with the local. If any small business goes out of business in their community, in their village, in their small town, that has an impact on the local community telescoping out to the supply chain. Supply chains are made up of large enterprises, multinationals, mid sized companies and small businesses. Many, many small businesses. Vendors that provide a piece of what's being sold at the end of the chain. And you know, it's an old saying, but a chain is only as strong as its weakest link is absolutely true. Some of the biggest exploits that we've seen against large enterprises have been through the small businesses who are in the supply chain. So an example of a large retailer whose vendor had access to their data platform. Right, They're a vendor, they need to share data about the products they're delivering, the shipments, the timing, the payments. Well, the small vendor gets compromised, the access credentials to the large enterprise get stolen, and now the cybercriminals have access to the large enterprise. So when you really think about how its supply chain works, it's a feeding ground for cybercriminals with small businesses who aren't protected. And not only can it take out the small businesses, it can actually compromise the data of large enterprises as well. So it does have a massive ripple effect in that context.
- [07:40]
C
All right, let's talk about solutions then. And we'll start with an example of Indonesia, just as a case study, because that is a location where both of your organizations have focused on small business cybersecurity and partnered with each other on the ground. So Brian, let's start with you. Can you just walk us through that collaboration in Indonesia and what you saw?
- [07:58]
A
We've worked with mastercard, center for Inclusive Growth and mastercard for quite some time now, and we've focused on playing our role in delivering the knowledge and skills and tools that small businesses need so they can protect themselves online. We've worked in the Academy 2.0 program and in the Strive program that Shamina mentioned. This is really a team effort at the end of the day. And what we do is we prepare content and curriculum that raises awareness for small businesses about their risks. We take them through the steps of basic cyber hygiene, what they need to know, simple things like a complex password and two factor authentication. Right, Basic things like that. And we put together the content, the curriculum. But we've also developed the toolkit that I referenced earlier. So in there it's holding you by the hand, meeting you where you are in your local language and taking you through the steps you need to understand, and also pointing you to free tools that you can download into your devices as a small business and your network that provide operational protection.
- [09:09]
C
Shamina, talk to me about what the collaboration looks like from MasterCard side. Because it's one thing to have this information out there, it's another thing to get it delivered to the right person and then get them to pay attention to it.
- [09:21]
B
It's been a fantastic partnership and it's really yielded a lot of impact. I mean, just sort of rounding out where we started a little bit with this conversation. If you think about, you know, in 2023 in Southeast Asia, there was about 18 to 37 billion dollars lost for small business owners through fraud and scam. And so this notion of education is incredibly important. You asked the question earlier. Is it just about education? Is it about solution? It's yes. And so the partnership with Brian and the Global Cyber alliance is incredibly important because it does the first bit about creating a toolkit that can be easily distributed and delivered to small business owners in a way that doesn't necessarily mean they have to sacrifice a ton of their time, energy or resources. It has to be, as we say at MasterCard, frictionless. It has to be easy to be delivered. And our partnership happened to be in Indonesia. And so we had to also make sure that the language was right. So we, we made sure it was translated into Mahasa. And then what we saw, at least in the initial construct, was there were about, I think, 40,000 downloads over a very short period of time. And so the demand for this type of tool and toolkit very, very high. But the interesting thing, I think in addition to the distribution is that what MasterCard does as an organization is this targeted a very specific segment of the small business EcoSystem. Of course, MasterCard serves all small businesses on the MasterCard network. So what we did was also combine this with some AI fraud detection tools on the Mastercard Network and made sure that we scaled and expanded the lessons of the learning and the impact of the toolkit across the larger small business ecosystem. For MasterCard, I want to dig into.
- [11:16]
C
How you did that a little bit because Indonesia is one market, but the region is quite diverse. And MasterCard had its inaugural ASEAN Inclusive Growth Summit in Kuala Lumpur recently. And I want to just play a clip from that. It comes from Temasek CEO Dylan Pillay, Sandra Segarra, because he talks about this diversity.
- [11:37]
D
The fact remains that all the 11 countries of ASEAN are quite different. Not just culturally, but the way in which our economic structures are based are very, very different. And so you can't compare Singapore, a small city state, 729 square kilometers, 6 million people, with Malaysia or Indonesia or Philippines or Vietnam or Myanmar, wherever you can't. But there's so many more people who are not part of burn setting, who don't get the same benefits that we do from an urban setting. And we need to reach out to them and pull them up. Because if you want to be successful for the long run on a multi decade basis, you can't leave behind significant numbers of your population who are not able to get the benefits of economic prosperity.
- [12:20]
C
Brian, that makes it clear that you can't just have a one size fits all solution. So how do you take. And Shamina started to talk about this, but how do you take this toolkit and then adapt it so it works across such a diverse region?
- [12:34]
A
This is really where the rubber meets the road. And that's language and that's contextualization. So translation and getting it into the local language and contextualization is a really important part of that too. Right. Because we use imagery, we use videos. All of those things have to resonate with the small business in their locality and in their local language. And it's even more than that. Right. What's also as important? And we use the phrase cyber maturity level. So when we're preparing curriculum, we want to make sure that the curriculum is meeting the user where they are in their digital journey. Right. A small business can be a woman entrepreneur, solo entrepreneur with a smartphone in a village. That's it. A smartphone she shares with her family. Right. A small business can be 30 employees in a city with an internal network and external access. So you really have to create curriculum that is meeting the end user where they are. And that starts with doing a cyber risk profile, understanding the contours of their small business and then delivering the curriculum that's fit for them for the risks that they have. And pointing them to the specific tools that they need. So this is really the important part of all of our work. And it's been really great to work with MasterCard and their partners. And there's a lot of partners on the ground. As I said, this is a team effort. There's many organizations, trainers on the ground who help us succeed at contextualizing, localizing and making the content fit for that end user.
- [14:11]
B
Just to build a little bit on what Brian was talking about, I think it's really important what he said, which is an entrepreneur could be a woman on her phone in a village. And so we think about these cybercriminals as all over the world and sort of like with black hats and black, you know, it's like these are small business owners literally on their phones. So fraud also looks like sticker switching. So you know, if you're buying a soda can or if you're buying a, you know, water or something, criminals will change the sticker on the QR code as an example, so that when you might use your phone and to scan the QR code to log the price and pay for loads malware onto your phone instead of what you think is maybe the price tag of a bottle of water. So we talk about ransomware and malware and phishing and all of these things which are obviously there and true. But like, don't forget these are mom and pop shops where people are buying things and literally criminals are changing the stickers, they're putting malware on your QR code. And so it's really, really important that small business owners understand what's happening and then have the tools to fight back.
- [15:21]
C
Wow. The other complication here is that technology is moving so fast and so we haven't even begun to address AI, but it was addressed also at the conference recently. So I wanted to take a second to listen to another clip from there. This is Stephane Dugan, who's chief executive officer at the Cyberpeace Institute.
- [15:40]
E
Well, this campaign now that are based solely on phishing and on manipulation of your targets, which were impossible in certain languages, which become possible because thanks to LLM you can craft any content in any language. We also saw very recently some AI based deep fake attacks, fake sound, fake video. You think you talk to someone and you're not and that someone tried to create a feeling of urgency in you so that you're going to make a wire transfer from point A to point B. We see this more and more, but at the same time, AI is also enabling defense. We should not forget that, so it's a double edged sword.
- [16:16]
C
All right. I have to admit the deep fakes are petrifying to me. And so Brian, while you're still trying to catch people up to the old versions of cyber attacks, how are you also trying to keep up with all of the new kinds of cybersecurity that needs to be developed?
- [16:33]
A
Well, AI and AI assisted attacks, deepfakes and phishing emails have just exploded in the last couple of years. What has AI done for the cybercriminal? It's lowered their cost structure. They can launch more attacks and they can launch more attacks at more targets and they're doing it. It's also given them technology and deepfakes that is even more convincing if social engineering is the hook and tricking someone into clicking onto a link they shouldn't is the goal. You know, the audio, deepfake technology, the video, the visual. Today is incredibly convincing. People are four times more likely to click through on an AI assisted attack than a traditional one before deepfakes. The really concerning part about that is not just the impact it's having today, but think two years out we have scam centers in Southeast Asia that are generating this huge uptick in the last couple years when they have fully agentic AI systems creating more effective deepfake attacks 24 hours a day, 7 days a week, 365 days a year. If you let that sink in, within two years time, we're literally going to experience what I call a tsunami of incredibly sophisticated scam and phishing attacks. And there are so many small businesses that are not prepared, that are not protected. This is really an urgent problem that's arising for all of us.
- [18:12]
B
Yeah, it's really serious, obviously. And sometimes the cyber security isn't the top thing that a small business owner is thinking about. Sometimes it's not even in the top three. This just swallows the centers everywhere. And so what we've done at mastercard is we've created something called the mastercard Trust, sort of a one stop shop for small business owners. We also have things like risk recon. We have other tools that are useful and available that we provide as a service, open source, so that small business owners can download these things and really start to fight back. But fighting back means they have to really pay attention to this and do the necessary work. Like, you know, look at the toolkits, get educated. Because the ideal would be that they're never attacked, that they're educated, they're prepared, they have the tools, they have the infrastructure in place to combat these attacks. But that requires work on the front end.
- [19:07]
C
Brian, as we look forward, what does getting it right mean to you? Getting cybersecurity right?
- [19:13]
A
I think in the big picture, based with what's coming at us, the nature of the threat has changed considerably. And so the nature of the response has to change. You know, anytime we do a capacity building project, it's, you know, 10 to 15 organizations working together to train x hundred thousand of small businesses. The challenge is our current models aren't scaling fast enough. So what we really need at the highest level is we need a coordinated response. And this is a global threat. We need a lot of companies to come together and start investing in cybersecurity. We need governments to start taking this threat seriously and focus on workforce development and skilling of people so they can have what they need to protect themselves and also start building some AI agents that can deliver protection at scale. We're an international, not for profit ourselves, you know, not for profits, need to be at the center of this type of a coordinated global initiative because we bring the values that are important in the public interest. We're not looking to monetize these solutions that can deliver protection of scale, but it's going to take all of us and it's going to take a truly global, coordinated effort to get the job done.
- [20:28]
C
And Shamina, how do you continue to use mastercard's leadership to ensure that this happens?
- [20:33]
B
I talked about the platform we have through the Trust Center. We also have programs like Digital Doors. We also have programs like Small Business Navigator. We're in the process of creating things almost in real time to meet small business owners where they are. Because it's. We look across the world, we sort of have to adapt in real time because in some more digitally savvy markets, you know, the criminals are getting really smart too, as, as Brian talked about. And so we actually recently released a documentary series called Anatomy of a Scam. It really dissects what scam is and the impacts, how it works, who's doing it and things like that. You know, we talked earlier about, you know, fake QR codes and things like that, but even then, you know, these are all happening almost in silos. So what MasterCard has done, and I'm really proud of this and I'm really pleased to say that we have recently renewed a commitment that we started 10 years ago to bring people into the formal economy for what all that means. So 10 years ago, MasterCard said, Look, we're gonna bring a billion people into the formal economy and help them become more digitally savvy. What we found, though, was the security maturity, as we call it, did not follow when we were bringing them in. So today, I'm really proud to say that we are recommitting, and by 2030, we will connect and protect 500 million individuals and small business owners on their journey to financial security and financial health. So that's how we're going to keep this momentum alive and keep responding almost in real time to the needs as they happen.
- [22:10]
A
Absolutely. And you know, 10 years ago, the Internet was a very different place. There weren't nearly as many people connected to it around the globe. There's so many more connected today. And the services and the technologies that are thriving on the Internet today are very different. Someone coming online today as a small business is stepping onto a platform that's much more sophisticated, much more technically challenging. There's opportunity to grow and to leverage the Internet to accomplish your business goals. But there are many, many more threats as well. It's not just about economic growth. It's not just about being a savvy online business so I can grow my business. It's also the security piece of it. It's absolutely essential. And we need more commitment like that. We need to empower small businesses and we need to protect small businesses at the end of the day.
- [23:04]
C
Jamina Singh, founder and President of the center for Inclusive Growth at mastercard. And Brian Cute, interim CEO and Director of Capacity and Resilience from Global Cyber Alliance. Thank you both so much for joining me.
- [23:16]
B
Thank you.
- [23:17]
A
Thank you, jj.
- [23:19]
C
This has been an episode of Local to Global the Power of Small Business For Gzero's Blue Circle Studios, I'm JJ Ramberg. Be sure to check out all four of our episodes in the GZERO World feed.