What Every Small Business Should Know About Hackers & Cybersecurity

It seems like not a week goes by at the moment without a new story about a large corporate cyber-security breach. Recent hacks at Ticketmaster, Fortnum & Mason and Dixons Carphone have resulted in customer data being accessed, stolen or potentially compromised.

But it’s not just large companies that are at risk and, with the General Data Protection Regulation (GDPR) in place, all businesses must take steps to ensure that their systems and data are protected.

Edward Whittingham is a former police officer and the founder of online security company, Business Fraud Prevention Partnership, which is accredited by GCHQ as part of the UK Government’s National Cyber Security Programme. He says that it’s essential that small and medium-sized enterprises (SMEs) understand that cyber-crime is now a major part of organised crime.

“Historically, there has been a perception that cyber-attacks are conducted by teenagers or rogue individuals, but this just isn’t the case,” he explains. “They’re now conducted on a large scale by serious and organised crime gangs who, for pocket change, can purchase the tools that they need to carry out attacks on the dark web.”

Phishers
Mr Whittingham says that one of the biggest threats to SMEs are phishing emails, where hackers pose as trustworthy entities, such as suppliers or colleagues, and ask for sensitive information to be sent. He warns that these must not be underestimated and points to research that shows that between 90pc and 95pc of cyber-attacks begin with phishing.

“They continue to evolve and are becoming ever more convincing,” he says. “[Hackers] are on the ball and always looking to exploit the latest trend, so it’s crucial that we are, too. If there’s one thing to get to grips with, it’s ensuring that employees understand all of the different threats that phishing emails pose and how to spot the warning signs.”

Those signs are often subtle differences, explains Mr Whittingham. “Check the sender details, and not just the sender’s name, but the actual email address itself: does it look legitimate; are there subtle misspellings or additional characters?”
Other red flags to look out for include any unusual or urgent calls to action, such as a request to make a payment, confirm details or access a link or document.

Costs and expenses
The cost of a cyberattack can be huge, but protection for small businesses isn’t necessarily expensive. Anti-virus software is a must for all SMEs and some packages ensure that the software is always up to date. The market is competitive and business owners should read reviews and take recommendations before selecting the right tool or package. Local authorities and chambers of commerce also offer support.

Back-up your data
Firms that want to mitigate the danger of an attack can take action. Mr Whittingham says that the first step is to back up crucial data: “Think about the operational and financial data that you hold that’s absolutely business critical – what would you do if this became inaccessible or permanently lost?” Back-ups should be made regularly (ideally daily) to a storage device separate to the ones from which you work.

Two-factor authentication
The founder also recommends the use of two-factor authentication, where software or email access requires not just a password but also a PIN number, usually sent by text.
Gmail, Dropbox and other cloud services offer this, but passwords should be improved anyway. They are all too often a weak link, he says. “Employees should be encouraged to use strong passwords made up of sequences of words, as these are easier to remember.”

IT policy
SMEs need to create an IT policy to prevent cyber-attacks and data breaches. This should be a comprehensive but easy to read document that’s adhered to by all staff members.

Chris Gough is technical director at IT consultancy, Mintivo, which works with small businesses as well as bigger companies such as Age UK and Investors in People. He says that IT policies are all too often unread and unattractive, and advises a bite-sized version to interest staff: “You can get great engagement from using a ‘Top 10 need to know’ format and promoting this alongside the full document.”

When it comes to the policy’s content, Mr Gough advises that businesses consider a wide variety of areas, including acceptable usage, communications, password policy, social media guidelines, network security, physical security, data protection, incident response and disaster recovery.

Preparation is key and cannot simply be left for the IT department, he says. “Unfortunately, it’s a case of when, not if, a cyber attack will take place.”

Test your systems
The only way to ensure that your systems are strong is to test them – preferably before the hackers do.

“It’s important that organisations are proactive and not reactive when it comes to cyber security,” explains Mr Whittingham.

“Staff training, paired with simulated phishing tests, is not only a way of educating employees; it can also identify high-risk areas within the business.”

Telegraph:         Image: Nick Youngson

You Might Also Read:

Five Key Ways to Protect Your Company Against Cyber Attacks:

UK Business Is Overconfident About Cybersecurity:

 

« Students Blamed For University & College Cyber Attacks
Edward Snowden Reconsidered »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

National Crime Agency (NCA)

National Crime Agency (NCA)

The NCA's Cyber Crime Unit focuses on critical cyber incidents in the UK as well as longer-term activity against the criminals and the services on which they depend.

Israel Aerospace Industries (IAI)

Israel Aerospace Industries (IAI)

IAI offers a holistic approach that provides defense forces, governments, critical infrastructures and large enterprises with end-to-end cyber security & monitoring tools.

Wireless Logic

Wireless Logic

Wireless Logic delivers a range of secure and resilient value-added M2M/IoT managed services that empower remote devices to communicate cost-effectively, two ways.

Gemserv

Gemserv

Gemserv is a specialist market design, governance and assurance services consultancy.

CyberForce Program - US Department of Energy

CyberForce Program - US Department of Energy

The Department of Energy’s (DOE) CyberForce Program is a workforce development program that seeks to inspire and develop the next generation of cyber defenders for the energy sector.

Selectron Systems

Selectron Systems

Selectron offers system solutions for automation in rail vehicles and support in dealing with your railway cyber security challenges.

Naq Cyber

Naq Cyber

Naq is the number one platform for SMEs looking to become legally compliant and protect against cybercrime and other data-related incidents.

Robo Shadow

Robo Shadow

Robo Shadow are trying to bridge the gap between the top tier organisations that can afford everything and everyone else who has to “Make it up as they go along” when it comes to Cyber.

Adversa AI

Adversa AI

Adversa's mission is to build trust in AI and protect AI from cyber threats, privacy issues, and safety incidents.

Omantel Innovation Labs

Omantel Innovation Labs

The Omantel Innovation Labs is a platform to enable startups and innovators to develop and commercialize solutions within selected technology verticals including cybersecurity.

Ignite Cyber

Ignite Cyber

IGNITE Cyber is focused on enabling secure technology adoption through intelligent business decisions. We are focused on providing a secure and stable business environment for everyone.

Ingenics Digital

Ingenics Digital

Ingenics Digital is a recognized initiator and leading service provider in the areas of software development and embedded systems.

HLB System Solutions

HLB System Solutions

HLB System Solutions: Empowering businesses with proactive IT management, consulting, security, and cloud solutions. Seamless tech for growth!

Myrror Security

Myrror Security

Myrror Security is a software supply chain security solution that aids lean security teams in safeguarding their software against breaches.

Avatar Managed Services

Avatar Managed Services

Avatar offers proven, process driven IT support to companies who want to utilize their technology to their best advantage.

Beazley Security

Beazley Security

Beazley Security is a global cyber security firm committed to helping clients develop true cyber resilience: the ability to withstand and recover from any cyberattack.