What Every Small Business Should Know About Hackers & Cybersecurity

It seems like not a week goes by at the moment without a new story about a large corporate cyber-security breach. Recent hacks at Ticketmaster, Fortnum & Mason and Dixons Carphone have resulted in customer data being accessed, stolen or potentially compromised.

But it’s not just large companies that are at risk and, with the General Data Protection Regulation (GDPR) in place, all businesses must take steps to ensure that their systems and data are protected.

Edward Whittingham is a former police officer and the founder of online security company, Business Fraud Prevention Partnership, which is accredited by GCHQ as part of the UK Government’s National Cyber Security Programme. He says that it’s essential that small and medium-sized enterprises (SMEs) understand that cyber-crime is now a major part of organised crime.

“Historically, there has been a perception that cyber-attacks are conducted by teenagers or rogue individuals, but this just isn’t the case,” he explains. “They’re now conducted on a large scale by serious and organised crime gangs who, for pocket change, can purchase the tools that they need to carry out attacks on the dark web.”

Phishers
Mr Whittingham says that one of the biggest threats to SMEs are phishing emails, where hackers pose as trustworthy entities, such as suppliers or colleagues, and ask for sensitive information to be sent. He warns that these must not be underestimated and points to research that shows that between 90pc and 95pc of cyber-attacks begin with phishing.

“They continue to evolve and are becoming ever more convincing,” he says. “[Hackers] are on the ball and always looking to exploit the latest trend, so it’s crucial that we are, too. If there’s one thing to get to grips with, it’s ensuring that employees understand all of the different threats that phishing emails pose and how to spot the warning signs.”

Those signs are often subtle differences, explains Mr Whittingham. “Check the sender details, and not just the sender’s name, but the actual email address itself: does it look legitimate; are there subtle misspellings or additional characters?”
Other red flags to look out for include any unusual or urgent calls to action, such as a request to make a payment, confirm details or access a link or document.

Costs and expenses
The cost of a cyberattack can be huge, but protection for small businesses isn’t necessarily expensive. Anti-virus software is a must for all SMEs and some packages ensure that the software is always up to date. The market is competitive and business owners should read reviews and take recommendations before selecting the right tool or package. Local authorities and chambers of commerce also offer support.

Back-up your data
Firms that want to mitigate the danger of an attack can take action. Mr Whittingham says that the first step is to back up crucial data: “Think about the operational and financial data that you hold that’s absolutely business critical – what would you do if this became inaccessible or permanently lost?” Back-ups should be made regularly (ideally daily) to a storage device separate to the ones from which you work.

Two-factor authentication
The founder also recommends the use of two-factor authentication, where software or email access requires not just a password but also a PIN number, usually sent by text.
Gmail, Dropbox and other cloud services offer this, but passwords should be improved anyway. They are all too often a weak link, he says. “Employees should be encouraged to use strong passwords made up of sequences of words, as these are easier to remember.”

IT policy
SMEs need to create an IT policy to prevent cyber-attacks and data breaches. This should be a comprehensive but easy to read document that’s adhered to by all staff members.

Chris Gough is technical director at IT consultancy, Mintivo, which works with small businesses as well as bigger companies such as Age UK and Investors in People. He says that IT policies are all too often unread and unattractive, and advises a bite-sized version to interest staff: “You can get great engagement from using a ‘Top 10 need to know’ format and promoting this alongside the full document.”

When it comes to the policy’s content, Mr Gough advises that businesses consider a wide variety of areas, including acceptable usage, communications, password policy, social media guidelines, network security, physical security, data protection, incident response and disaster recovery.

Preparation is key and cannot simply be left for the IT department, he says. “Unfortunately, it’s a case of when, not if, a cyber attack will take place.”

Test your systems
The only way to ensure that your systems are strong is to test them – preferably before the hackers do.

“It’s important that organisations are proactive and not reactive when it comes to cyber security,” explains Mr Whittingham.

“Staff training, paired with simulated phishing tests, is not only a way of educating employees; it can also identify high-risk areas within the business.”

Telegraph:         Image: Nick Youngson

You Might Also Read:

Five Key Ways to Protect Your Company Against Cyber Attacks:

UK Business Is Overconfident About Cybersecurity:

 

« Students Blamed For University & College Cyber Attacks
Edward Snowden Reconsidered »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Asavie

Asavie

Asavie provide solutions for Enterprise Mobility Management and secure IoT Connectivity.

AcceptLocal

AcceptLocal

AcceptLocal is a payments industry consultancy with expertise in payment processing, payment security, anti-money laundering and fraud prevention.

Robert Bosch Centre for Cyber-Physical Systems (RBCCPS)

Robert Bosch Centre for Cyber-Physical Systems (RBCCPS)

RBCCPS is an interdisciplinary research and academic centre within the Indian Institute of Science focused on research in cyber-physical systems.

AuthenTrend

AuthenTrend

AuthenTrend provide biometric authentication products to achieve high security with extreme ease-of-use for the user.

GE Digital

GE Digital

GE Digital is a leading software company for the Industrial Internet. Products include Industrial Cyber Security for Operational Technology (OT).

TCDI

TCDI

TCDI specializes in computer forensics, eDiscovery and cybersecurity services.

macmon secure

macmon secure

macmon secure develops network security software, focussing on Network Access Control.

ODSC

ODSC

ODSC is a security systems integrator that provides services and expertise in identity management and access.

Vehere

Vehere

Vehere specialises in mission critical signals aquisition and analytics platform and cyber defence systems.

Securis

Securis

Securis provides organizations and agencies with the highest level of professional, ultra-secure data destruction and IT recycling.

ISA Global Cybersecurity Alliance (ISAGCA)

ISA Global Cybersecurity Alliance (ISAGCA)

Objectives of the ISA Global Cybersecurity Alliance include the acceleration and expansion of standards, certification, education programs, advocacy efforts, and thought leadership.

OSIbeyond

OSIbeyond

OSIbeyond provides comprehensive Managed IT Services to organizations in the Washington D.C., MD, and VA area including IT Help Desk Support, Cloud Solutions, Cybersecurity, and Technology Strategy.

Periculus

Periculus

Periculus makes managing digital risk simple. Its integrated platform offers access to purchase cyber insurance and cyber security solutions uniquely tailored to fit the needs of every business.

ThreatNix

ThreatNix

ThreatNix is a tight knit group of experienced security professionals who are committed to providing competent cybersecurity solutions that adhere to international standards.

Aura Information Security

Aura Information Security

Aura Information Security consists of a team of highly-skilled and renowned information security professionals spanning Australia and New Zealand.

Dispel

Dispel

Dispel makes the fastest secure remote access for industrial networks. Built by operators for operators: a zero trust engine for your entire OT, IoT, and xIoT stack.