Locking Down Cyber Security

Many operations are failing to manage the cyber security basics, and this is leaving businesses highly vulnerable.

Why is it that even well-run organisations seem unable to take the critical steps needed to protect themselves? In part it can be attributed to a failure to update ageing IT systems, rendering resilience to hacking, ransom and accidental data loss progressively weaker over time. Innovative IT systems installed 10 years are now archaic.

Furthermore, the different ways in which organisations operate, often using a mixture of new and old (sometimes incompatible hardware alongside complex and frequently poorly updated unpatched software renders many operations more vulnerable. These weaknesses are made worse by the trend to hybrid and remote work and BYOD policies.

In the last year, 39% of UK businesses reported cyber attacks, of which phishing attempts were the most common (83%). This figure has decreased slightly from 46% in 2020, although one in every 3,226 emails an executive receives is a targeted phishing attempt, also known as whaling attacks. 

With only a quarter (26%) of small business professionals considering cyber security to be a top priority, there is real scope for improvement if organisations are to limit the threat that fraud and other online crimes present to their operations. For many, the world of cyber security is a confusing one and it can be hard to know where to start. So what threats do companies face, and what can they do to maintain a secure and thriving ecosystem?

Complacency is the biggest threat to a business’s safety. Just 54% of UK businesses acted to identify cybersecurity risks in the last year and IT teams are often delayed in their response to fixing misconfigured technology and protective tools, leaving their companies open to attacks.

The problem is that most businesses are more focused on their profitability than security, with little consideration for the potential cost of an attack. Employees often use weak or repetitive passwords, or specific teams may employ processes that diverge from their company’s safety regulations. These transgressions can have a huge impact on the entire business; cybersecurity breaches can cost medium to large UK companies often over £8,000 and this does not take account of the impact on reputation. 

The introduction of cloud-based networks has also weakened businesses’ security by globalising the cyber security landscape.

Furthermore, the post-pandemic shift to flexible working means companies can no longer implement overarching regulations, as these may inadvertently hinder employees being able to work effectively. In this new era, security measures need to open up access to remote workers while also empowering the identification and limitation of threats. On top of this, people are more aware of sites tracking them than ever before and there’s a common belief VPNs will keep personal information secure, making these tools increasingly popular despite tests highlighting concerns over security and privacy practices. 

Many companies use VPNs to give their employees access to their system server, however, malicious actors can use VPNs to protect their identities, causing confusion when considering whether a VPN user is legitimate or not.

Training and Education

Implementing effective cyber security measures doesn’t need to be expensive, and introducing simple yet powerful training sessions to educate employees is an easy way to increase awareness, improve security and drive change. Training and explaining to management and staff about the changing phishing attempts and the importance of strong, regularly updated passwords, as well as how password managers can really help and is a very good first step. 

Any organisation's employees can prove to be the weakest link, and junior employees are often deliberately targeted by hackers as they can provide an easy route into a businesses’ databases due to limited security knowledge.

As Internet use is essential for modern businesses, everyone is at risk of cyber attacks - but this needn’t cause anxiety if each individual is taking steps to prevent them. Business leaders need to apply the same logic as insurance only covers so much, especially if the organisation's leaders have failed to properly assessed its risk profile.

Companies must at least ensure they’re taking basic precautions, such as keeping databases secure.

Hackers usually access company networks via mobile phones, laptops or phishing emails, and considering more and more employees are using private devices for business purposes, companies need to deploy security tools that also cover these personal devices. While greater employee education is paramount, it’s not enough on its own to provide sufficient cyber security.

Implementing robust technological solutions will add an extra layer of defence, like CCTV cameras outside your home. This is where IP address data is crucial; it carries rich geolocation information and can provide details on whether an IP address, essentially like a post-code for an internet login, is proxied or masked, and whether it relates to a home address or a business. By partnering with technology providers who have access to these insights, businesses can identify in real time how and where a device is connecting to the Internet to spot, and block, cyber-attacks.

Businesses should also incorporate data from virtual private networks (VPNs) and proxy servers to build a more accurate view of who is accessing their network. 

Opportunistic hackers often take advantage of the IP-address-disguising capabilities of proxies and VPNs, so sophisticated technology can help companies examine data from these sources to weed out malicious players. 
Businesses can even automate this process by integrating the data into their front-end online security processes, while proxy data can activate fraud alerts. It’s important to ensure the data used is of the highest quality. By working with providers that regularly update their proxy and VPN data, and guarantee it comes from reliable sources, companies can ensure their security systems are operating on accurate information.

When it comes to cyber security, learning from past mistakes is crucial and these areas are fundamental areas for an organisation to monitor continually.

Change

Organisations face a constantly changing array of pressures from multiple sources. Competitive threats, 
New regulations, financial uncertainty, technological shifts, and business risk all force managers to maintain a state of perpetual vigilance. Globalisation and technological advancements have enabled new business models and competitors to spring up overnight. The ability of businesses to respond effectively to these pressures can be in itself a source of sustainable competitive advantage. 

Compliance

Corporate governance, risk management, and compliance with policies and regulations are in sharp focus for most organisations. It’s not enough to express intent to follow regulations and policies, organisations must measure and transparently report on how completely they are being followed. Efforts to ensure consistent experiences for customers and to wring efficiencies from standardisation are often competing with individual workers whose sense of privilege or creativity conflicts with the corporate standard. Getting it wrong in this area can have devastating consequences on the viability and competitiveness of any firm. The survival of every organisation hinges on its ability to deliver value for its customers. 

Continuity 

Organisations routinely spend hundreds of thousands of dollars on hot-standby computers, back-up power sources, and disaster recovery locations to create resiliency in their physical security platforms. These measures are not only expensive; they are often reliant on internal computer networks that are likely to be severely challenged by any form of massive disaster. If employees cannot get to the machines that operate the security platform, all the redundant measures will be devalued

Coverage

Organisations often find that the best way to accelerate profitable growth is through geographic expansion. Expansion comes with significant challenges, risks, and expenses. Management teams will be extended a bit further, as will scarce company resources. Solutions that provide good results in one location or at a small campus can become troublesome when multiplied for many geographically dispersed sites. Typically, these latter types of installations expose the vulnerabilities, complexities, and hidden expenses of traditional client/server solutions. 
Security as a Service solutions provide clear benefits for organisations with geographically dispersed sites. The low initial costs and wide-scalability of SaaS solutions give organisations access to world-class technologies with an economic model that promotes expansion instead of restricting it. 

Securely using the public Internet as a communication channel can greatly simplifies the deployment of remote sites for IT departments. 

The centrally hosted SaaS model provides all the central oversight and management needed in well-run organisations without requiring costly investments in dedicated infrastructure. Given the number of people who are still acting negligently with regards their own cyber security, perhaps it’s not yet been considered in the risk analysis for insurers.

By identifying areas of weakness and the valuable assets that are most in need of protection, businesses can tighten their security and protect themselves against bad actors. 

Educating employees to eliminate basic errors will empower them to lock criminals out, while partnering with the right technology and IP address data providers double-bolts the door against hackers, making the identification of security breaches quicker, easier, and more effective. The best way to get peace is by taking an active approach and do something about it.

By implementing a cyber security risk management plan, you will be able to limit the damage caused by a potential cyber attack.

Business Leader:   Brivo:   CIO:     David Mytton:     Rail Monitor:   Christopher Hodson: 

You Might Also Read:

Ransom: Prepare For The Worst: