Another good question, or perhaps it should be, do they ask any questions, other than cost, about cyber security, or do they leave everything up to their IT support, whether contracted or in house?

What is the cost of ignoring cyber security?

Perhaps this is the first question that they should be asking.  The financial hit of a data breach can be crippling, especially for the smaller businesses who are perhaps running on tight margins and for whom cash flow is often critical.  The average clean up for a smallish business is about £27K. this relates to system restoration, hardware replacement, and the implementation of enhanced security measures. and doesn’t include financial loss from the actual data stolen, or whatever scam was perpetrated, and any fall out from compliance failures, such as fines from the ICO.  And at least a third of organisations admit to losing customers post a data breach, highlighting reputational damage and a loss of customer trust.

So, what should owners, managers and board members be asking?

I think many get bogged down in the technicalities of IT and don’t consider it in business terms.  They don’t think about the business impact of cyber security, about what it is they’re trying to protect.  It’s not your IT systems, it’s your data that is the crown jewels.  IT systems can be replaced but once the data is stolen, then you are in very real trouble.

Risk Management

First and foremost, the board members need to ask themselves if they have a good handle on their cyber risk.  Have they identified their cyber assets?  What is a cyber asset? Cyber assets are not just hardware and software, in fact those are often the least of your worries.  It’s the data, where it is and how it’s protected that is important.  Have you assessed the risk to those assets?  Have you assessed the training requirements for your staff, not just the techies but all staff?  Think People, Process and then Technology.

Once you have done this, then you can consider what controls need to be put in place to reduce the risk to an acceptable level.

Below is some of the controls you will need to consider.  This list is not exhaustive

1.        User Access Control (Admin access is a whole other discussion)

This isn’t just about passwords.  Yes, they remain important but on their own, they are no longer sufficient.   Nonetheless weak passwords, password re-use and password sharing remain one of the leading root causes of a data breach.  123456 and, believe it or not, password, remains the most used passwords across the world! 

It is imperative that you have a strong password policy, dictating not just the length of the password, but also its construction, ensuring that there is a good mix of upper and lower case characters, numbers and symbols, that together make things very difficult for password crackers.

On their own though passwords remain a potential weak spot.  Multi factor authentication (MFA), sometimes referred to as 2FA, provides that extra layer of defence and can help to protect against brute-force attacks, phishing scams, key-logging and social engineering.  MFA can be simply implemented on most email platforms and within various apps you are using.  For those of you trying for Cyber Essentials or ISO 27K series, MFA is mandatory, so make sure it’s put in place.  

2.        Are you backing up your files? 

This seems an obvious thing to do but you’d be surprised how often when trying to restore from a backup, it fails.  This is often because the backup routine was set up back in the mists of time and has never been reviewed and even more dangerous, it’s never been tested to see if it works.  Set up your backup regime, have it reviewed regularly and tested regularly to make sure it works.  If you are backing up online, keep in mind that if a cyber-criminal gets access to your systems to, for example, carry out a ransomware attack, then they can probably get at your back up as well.  So, belt and braces, consider having an offline backup as well as an online backup.  The latter is more convenient but can be corrupted.

3.        Do you train your staff in cyber awareness? 

My favourite subject – cyber awareness training.  Your first line of defence is your staff, but if not trained adequately, they can be your greatest vulnerability.  It’s known in the trade as the insider threat but it is caused mainly by human error, staff members doing something they shouldn’t, not maliciously but simply because they didn’t know they shouldn’t.  It actually accounts for 88% of data breaches. Providing your people with training on the threats, current scams and basic cyber awareness reduces the chance of a cyber-attack. This really is the easiest and cheapest quick win any organisation can take in reducing their risk exposure.

4.        Do your employees regularly travel or work remotely? 

This brings us neatly to what Microsoft coined as the New Normal.  Essentially this means remote working shared with in office working, known as the hybrid working model, or for some, moving to a totally remote working system.  Totally remote is not as common as hybrid working but is becoming more normal with certain size businesses in certain commercial verticals.  It’ll never work for everyone, but for those who have embraced it, it saves a considerable amount of expense.  It does however require us to rethink our cyber strategy.

Work-from-home employees are at much greater risk than those in offices. Since home connections are less secure, cybercriminals have an easier entry into the company network.  Furthermore, the explosion of various online tools, solutions, and services for collaboration and productivity tend to have the bare minimum of security default setting, and updates from third-party vendors can change security preferences and be easily overlooked.

Phishing becomes an even greater threat to home workers, often because, in an office environment, they have access to colleagues and managers, who they can approach for advice and guidance.  This is much harder to replicate with remote workers, especially those who may not be particularly tech savvy and who may not wish to become ‘burdensome’ to their co-workers.

Ransomware also enjoys an advantage in the work-from-home model.  If their connection to the company is blocked, it is more difficult for workers to get assistance from the right experts and authorities.  And since trust levels are lower when working from home, some workers will be concerned that they have “done something wrong” and so may be more reluctant to seek help. While this risk can be addressed by increased training, as well as messaging that vigilance and involving IT support will be rewarded, it can still be an uphill battle.

We need to break out of the old ‘bastion’ security model of a network protected by firewalls and other technologies and think about solutions that are designed to protect your assets regardless of where your employees work from.  They exist and aren’t hard to find.

Data tends to proliferate, especially when working remotely.  Cyber awareness training helps here, but it also helps for management to have a handle on data storage.  All organisations have this problem, but it becomes more acute for those businesses that hold large amounts of what is known as Personal Identifiable Information or PII.  This is information that can identify a living individual and compromise their privacy in some way.  Financial advisors, estate agents, solicitors etc, all share this issue.  The data protection act, becoming referred to as UK GDPR, is not a suggestion, it is law.

5.        Where is all your data stored and who has access to it? 

One of the biggest issues we find with organisations of all sizes, is that they think they know where all their data is but get quite a surprise when they discover multiple instances of the same data set.  This has become a real issue in that the new normal tempts users when working remotely, with possibly less than robust broadband, to copy data from cloud storage to their PC or laptop to ensure they can keep working on it.  Then they upload it again when they’ve finished but forget to delete their copy.  That’s just one instance but it is vital to understand where all this data is.  What if for instance, you get what is known as a subject access request, where a client or other member of the public wants to know exactly what personal data you have on them, and why.  I spoke to a financial advisor recently who told me that it took one of their partners off the road for 3 weeks, to discover where all the data was kept on just one person.  But under the law, they had no choice but to bite the bullet.

There are several systems on the market which will help with this but what most need now is a system that works regardless of the location of the user and continues providing that cover when the user moves from one location to another.  This is just a suggestion, but we’d be delighted to demo it to anyone who is interested.  https://hah2.co.uk/gdpr-data-protection/

6.        Disaster Recovery and Business Continuity

Business Continuity refers to the proactive strategies and plans put in place to ensure that essential business functions can continue in the event of a disruption or disaster. This could include natural disasters, cyber-attacks, power outages, or any other event that could disrupt normal business operations. Business Continuity planning typically involves identifying critical business processes, implementing redundant systems and processes, and developing communication plans to ensure that the organisation can continue to operate smoothly in the face of adversity.

Disaster Recovery, on the other hand, is focused specifically on restoring IT infrastructure and data after a disaster has occurred. This could involve recovering lost data, restoring systems and networks, and ensuring that IT operations can resume as quickly as possible. Disaster Recovery planning typically involves creating backup systems, implementing data recovery procedures, and testing these plans regularly to ensure they are effective.  Both are critical components of a comprehensive risk management strategy and should be integrated into an organization’s overall resilience planning efforts.

Just like backups, which are a crucial part of Disaster Recovery, these plans can become very quickly out of date and useless, unless reviewed periodically and tested to see if they actually work.

7.        Vulnerabilities and Threats 

A vulnerability is a flaw or weakness in an asset’s design, implementation, or operation and management that could be exploited by a threat. A threat is a potential for a threat agent to exploit a vulnerability.  A simple way to explain this is that a vulnerability is the inability to resist a hazard or to respond when a disaster has occurred. For instance, people who live on plains are more vulnerable to floods than people who live higher up.  The threat is the flood itself.

IT risks and vulnerabilities are the potential threats and weaknesses that can affect the performance, security and reliability of your business function and processes. They can have serious consequences for your business goals, customer satisfaction, and competitive advantage.

Identifying vulnerabilities to your cyber security assets and then identifying the threat to those assets in terms of the vulnerability being exploited, informs your risk and enables you to assign a value to it.  Financial value can be assigned to the risk score if you so wish.  You then apply controls to bring the risk down to an acceptable level, starting with the Very High risks, and then bringing them down to whatever is acceptable to you.  That acceptable level, known as the risk appetite, will vary business to business, risk to risk.

8. Supply Chain Security? 

In short, a supply chain attack is a cyber-attack that seeks to damage an organisation by targeting less-secure elements in the supply chain.

An example of such an attack was published by NCSC and points out that many modern businesses outsource their data to third party companies which aggregate, store, process, and broker the information, sometimes on behalf of clients in direct competition with one another.

Such sensitive data is not necessarily just about customers, but could also cover business structure, financial health, strategy, and exposure to risk. In the past, firms dealing with high profile mergers and acquisitions have been targeted. In September 2013, several networks belonging to large data aggregators were reported as having been compromised.

A small botnet was observed exfiltrating information from the internal systems of numerous data stores, through an encrypted channel, to a botnet controller on the public Internet. The highest profile victim was a data aggregator that licenses information on businesses and corporations for use in credit decisions, business-to-business marketing, and supply chain management. While the attackers may have been after consumer and business data, fraud experts suggested that information on consumer and business habits and practices was the most valuable.

The victim was a credit bureau for numerous businesses, providing “knowledge-based authentication” for financial transaction requests. This supply chain compromise enabled attackers to access valuable information stored via a third party and potentially commit large scale fraud.

NCSC also cited what is known as a watering hole attack, which works by identifying a website that’s frequented by users within a targeted organisation, or even an entire sector, such as defence, government, or healthcare. That website is then compromised to enable the distribution of malware.

The attacker identifies weaknesses in the main target’s cyber security, then manipulates the watering hole site to deliver malware that will exploit these weaknesses.

The malware may be delivered and installed without the target realising (called a ‘drive by’ attack) but given the trust the target is likely to have in the watering hole site, it can also be a file that a user will consciously download without realising what it really contains. Typically, the malware will be a Remote Access Trojan (RAT), enabling the attacker to gain remote access to the target’s system.

If you are in someones supply chain, then you need to make doubly sure that your security protects your customer as well as yourself.  And conversely, if you are connected electronically to someone who supplies you, are you sure that you are protected from any vulnerability they may have.