What Every Small Business Should Know About Hackers & Cybersecurity

It seems like not a week goes by at the moment without a new story about a large corporate cyber-security breach. Recent hacks at Ticketmaster, Fortnum & Mason and Dixons Carphone have resulted in customer data being accessed, stolen or potentially compromised.

But it’s not just large companies that are at risk and, with the General Data Protection Regulation (GDPR) in place, all businesses must take steps to ensure that their systems and data are protected.

Edward Whittingham is a former police officer and the founder of online security company, Business Fraud Prevention Partnership, which is accredited by GCHQ as part of the UK Government’s National Cyber Security Programme. He says that it’s essential that small and medium-sized enterprises (SMEs) understand that cyber-crime is now a major part of organised crime.

“Historically, there has been a perception that cyber-attacks are conducted by teenagers or rogue individuals, but this just isn’t the case,” he explains. “They’re now conducted on a large scale by serious and organised crime gangs who, for pocket change, can purchase the tools that they need to carry out attacks on the dark web.”

Phishers
Mr Whittingham says that one of the biggest threats to SMEs are phishing emails, where hackers pose as trustworthy entities, such as suppliers or colleagues, and ask for sensitive information to be sent. He warns that these must not be underestimated and points to research that shows that between 90pc and 95pc of cyber-attacks begin with phishing.

“They continue to evolve and are becoming ever more convincing,” he says. “[Hackers] are on the ball and always looking to exploit the latest trend, so it’s crucial that we are, too. If there’s one thing to get to grips with, it’s ensuring that employees understand all of the different threats that phishing emails pose and how to spot the warning signs.”

Those signs are often subtle differences, explains Mr Whittingham. “Check the sender details, and not just the sender’s name, but the actual email address itself: does it look legitimate; are there subtle misspellings or additional characters?”
Other red flags to look out for include any unusual or urgent calls to action, such as a request to make a payment, confirm details or access a link or document.

Costs and expenses
The cost of a cyberattack can be huge, but protection for small businesses isn’t necessarily expensive. Anti-virus software is a must for all SMEs and some packages ensure that the software is always up to date. The market is competitive and business owners should read reviews and take recommendations before selecting the right tool or package. Local authorities and chambers of commerce also offer support.

Back-up your data
Firms that want to mitigate the danger of an attack can take action. Mr Whittingham says that the first step is to back up crucial data: “Think about the operational and financial data that you hold that’s absolutely business critical – what would you do if this became inaccessible or permanently lost?” Back-ups should be made regularly (ideally daily) to a storage device separate to the ones from which you work.

Two-factor authentication
The founder also recommends the use of two-factor authentication, where software or email access requires not just a password but also a PIN number, usually sent by text.
Gmail, Dropbox and other cloud services offer this, but passwords should be improved anyway. They are all too often a weak link, he says. “Employees should be encouraged to use strong passwords made up of sequences of words, as these are easier to remember.”

IT policy
SMEs need to create an IT policy to prevent cyber-attacks and data breaches. This should be a comprehensive but easy to read document that’s adhered to by all staff members.

Chris Gough is technical director at IT consultancy, Mintivo, which works with small businesses as well as bigger companies such as Age UK and Investors in People. He says that IT policies are all too often unread and unattractive, and advises a bite-sized version to interest staff: “You can get great engagement from using a ‘Top 10 need to know’ format and promoting this alongside the full document.”

When it comes to the policy’s content, Mr Gough advises that businesses consider a wide variety of areas, including acceptable usage, communications, password policy, social media guidelines, network security, physical security, data protection, incident response and disaster recovery.

Preparation is key and cannot simply be left for the IT department, he says. “Unfortunately, it’s a case of when, not if, a cyber attack will take place.”

Test your systems
The only way to ensure that your systems are strong is to test them – preferably before the hackers do.

“It’s important that organisations are proactive and not reactive when it comes to cyber security,” explains Mr Whittingham.

“Staff training, paired with simulated phishing tests, is not only a way of educating employees; it can also identify high-risk areas within the business.”

Telegraph:         Image: Nick Youngson

You Might Also Read:

Five Key Ways to Protect Your Company Against Cyber Attacks:

UK Business Is Overconfident About Cybersecurity:

 

« Students Blamed For University & College Cyber Attacks
Edward Snowden Reconsidered »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Contrast Security

Contrast Security

Contrast Security is the leader in modernized application security, embedding code analysis and attack prevention directly into software.

InfoSecurity Magazine

InfoSecurity Magazine

Infosecurity Magazine has over ten years of experience providing knowledge and insight into the information security industry.

Bricata

Bricata

Bricata offers industry-leading IPS solutions for enterprise-wide threat prevention and unparalleled situational awareness.

Focal Point Data Risk

Focal Point Data Risk

Focal Point is a pure-play data risk management provider capable of offering end-to-end consulting, implementation, and training services.

SANS CyberStart

SANS CyberStart

SANS CyberStart is a unique and innovative suite of tools and games designed to introduce children and young adults to the field of cyber security.

Infopulse

Infopulse

Infopulse is a global provider of Software Engineering, Cloud & IT Infrastructure Management, and Cybersecurity services.

DANAK

DANAK

DANAK is the national accreditation body for Denmark. The directory of members provides details of organisations offering certification services for ISO 27001.

Norsk Akkreditering

Norsk Akkreditering

Norsk Akkreditering is the national accreditation body for Norway. The directory of members provides details of organisations offering certification services for ISO 27001.

Identity Defined Security Alliance (IDSA)

Identity Defined Security Alliance (IDSA)

IDSA is a group of identity and security vendors, solution providers and practitioners that acts as an independent source of education and information on identity-centric security strategies.

FutureCon Events

FutureCon Events

FutureCon produces cutting edge events aimed for Senior Level Professionals working in the security community, bringing together the best minds in the industry for a unique cybersecurity event.

CorkBIC International Security Accelerator

CorkBIC International Security Accelerator

CorkBIC International Security Accelerator invests in early stage disruptive companies in the security industry including, Cybersecurity, Internet of Things (IOT), Blockchain and AI.

Cyber Gate Defense (CyberGate)

Cyber Gate Defense (CyberGate)

CyberGate is an Emirati establishment founded with an objective to provide cyber security services that would improve the overarching cyber security posture of the UAE.

DAtAnchor

DAtAnchor

Anchor is simply a better way to protect and control sensitive data. Zero-trust, data-centric security. Simplified.

FINX Capital

FINX Capital

FINX strives to solve the cybersecurity issues with its proprietary technolog, FINX SHIELD, by utilizing big data, blockchain combined with artificial intelligence.

VeriBOM

VeriBOM

VeriBOM is a SaaS security and compliance platform that helps protect you and your customers through automation, documentation, and transparency for every software application you build or run.

Evolve Business Group

Evolve Business Group

Evolve is an independently-owned managed network solutions provider, creating bespoke packages for customers globally since 2005.