Five ways to improve your cyber security

Most business owners hear ‘cyber’ and say things like “It’s too technical for me” or “I just don’t understand the terminology”. This easy-to-understand guide is going to transform your business, by giving you the knowledge to make your business safer.

Your business right now, metaphorically speaking, leaves every window and door open in the office – 24 hours a day, 7 days a week. What’s wrong with this? Anyone that wants to come into your office, steal a computer and run off, could easily do so. In fact, they wouldn’t even need to run away, they could just walk away – it’s that easy. This is how cyber criminals view your business. You’re an easy business to steal sensitive and personal data from.

This is the reality of the situation you’re in at the moment and whilst it’s not what you want to hear, it is something you do need to hear.

We’re sure you’ve been told that your business is completely safe because you’ve got a firewall in place or that you’ve got an antivirus solution and whilst these tools aren’t going to negatively harm your business, thinking these tools will protect you is like putting a single rope in between each door and window thinking you’ll stop people coming in. It’s just not enough.

Every business has been at this point. It takes real awareness to understand you need to improve.

What is cyber security and why is it important?

Most business owners think they don’t need cyber security because “we’ll never get hacked” or “breaches only happen to corporations making billions”. However, the CEO of the National Cyber Security Centre (NCSC) said it’s not a matter of if you’ll be breached, it’s a case of when. When you’ve got insufficient cyber security in place, it doesn’t matter whether you’re a huge company or not, you’re at risk. With around 39% of businesses in the United Kingdom being breached between April 2021 and April 2022, it’s very possible that you’ll be part of the future statistics. You and your team use technology every single day and rely on it to ensure your business can function. The amount of information, personal and sensitive data that you’re risking by not utilising cyber security means your entire business is at risk.

Without cyber security:

■ Your business will come to a standstill during and after a breach

■ You’ll be unproductive and inefficient

■ Your clients will leave you if you’re breached your clients are right to expect their data to be in safe hands and the businesses who look to avoid cyber security will ultimately have less business in the future.

Create a cyber security culture in the workplace

Adopting a culture of cyber security means your staff care about cyber security and they are aware of its importance. Moreover, they know what to NOT do.

Human error to this day, still remains the biggest threat to organisations. It doesn’t matter if you’ve got all the cyber security tools in the world, if your first line of defence is uneducated, you’re at risk. Adopt a cyber security culture in your organisation:

■ Implement a strong password policy by making sure every single employee uses at least 12 characters and includes numbers, symbols and capital letters.

■ Use two-factor-authentication to make it harder for attackers to breach your infrastructure and systems.

■ Limit access of data, systems and software to only those who are meant to use them in their role.

■ Train and educate your staff by making your training sessions as interactive as possible, creating games such as “spot the fake email” can make your staff more aware of the threats being posed. If you make this monthly agenda, you can track their progress and reward your employees for keeping your company cyber safe.

Back up your data

It’s highly likely that you will be breached in the future, so you need to back up your data to ensure you’re retaining the data you currently hold. Our recommendations for your organisation:

■ When calculating the amount of storage required for a backup, it’s important that you include operating systems and applications in your total figure. ■ If you have the storage facility, opt for a daily backup.

However, if this is unrealistic, you can opt for a weekly or monthly backup instead.

Remove unused applications and update existing applications

There are a number of applications on your devices which can get exhausted after a certain period of time and businesses remain unaware of it. These applications and services act as loopholes for your system security. You need to delete that particular application and the user credentials associated with it to prevent hackers from taking any sensitive data.

Also, make sure your software is being automatically updated as developers are constantly finding solutions to security gaps in their applications.

Cyber Essentials

The Government created the Cyber Essentials certification for small and medium businesses to reduce the risk of breach by 80% and for businesses to show their clients that they take data protection seriously. So how does it reduce the risk by 80%?

Cyber Essentials reduces the risk by using five technical controls:

■ Firewalls and Internet

Gateways Cyber Essentials certification requires that you configure and use a firewall to protect all your devices, particularly those that connect to public or other suspicious and unreliable Wi- Fi networks.

■ Secure Configuration Cyber

Essentials certification requires your organisation to only use software, accounts and apps that are frequently used. The key here is that they need to be a necessity to your organisation.

■ Access Control Cyber

Essentials certification requires that you control access to your data through user accounts.

Also, administration privileges are only given to those that need and furthermore, the use of the data with those accounts is controlled.

■ Malware Protection Cyber

Essentials certification requires that you do at least one of following to defend against malware: Whitelisting, sandboxing or installing antimalware software

■ Patch Management Cyber

Essentials certification requires that you keep your devices, software and apps up-to-date.

Cyber Essentials is great for building the foundation of your cyber security but once certified, you will need ongoing threat management solutions to maximise your risk reduction.

Threat detection and protection

SOC and SIEM are high level, 24/7 cyber security tools which could benefit your business greatly.

A SOC (Security Operations Centre) is a dedicated team of cyber security analysts who proactively monitor your network and respond to incidents. SOC’s were once a tool only accessible by the biggest organisations but now with virtual SOCs, you don’t need full time staff or even an entire facility, making it a possibility for smaller organisations.

The key aims of a SOC are:

■ Detecting and responding to threats

■ Protecting data held on systems and networks

■ Enhancing cyber resilience

■ Identifying and responding to criminal behaviours

■ Understanding user behaviour to improve future technologies

A SIEM (Security Information and Event Management), is a tool that indicates suspicious activity by setting rules and alerting your team when the rules are broken. They can also be used to discover compromised members of your team. The SIEM analyses activity from many different resources across your infrastructure as well as collecting security data from network devices and servers.

Organisations use SIEMs to:

■ Detect cyber security incidents by collecting logs from all data sources across your network and triggering alerts from suspicious activity

■ Regulate compliance

■ Allow cyber security specialists and analysts to handle suspicious activity

Together, SOCs and SIEMS are incredibly powerful as they improve the cyber security measures of an organisation whilst mitigating current risks at the same time. Every SOC needs the SIEM’s intelligence to know what it is protecting your systems against. The SIEM makes the SOC aware of the threat and the SOC tackles this threat.