Cyberattacks can be complicated, but most are actually REALLY SIMPLE and can be prevented by taking simple steps!
Here are 10 points to help non-technical Board members challenge the techies.
- Close the front door! Start by ensuring your office has sensible physical security. Then make sure the equivalent measures are in place for your systems – these are your firewalls. Knowledgeable and trusted experts who understand the complexities of system and firewall management need to configure this equipment and to keep it up to date. Specifically ask them whether they have minimised points of access (ports) and are using secure ports for email and web access rather than standard ports.
- Limit access. Access to systems and data should only be given to those who need it. This is known as a least-privilege policy. For example, when a person is given access to a system, the default should ensure that person has no rights to anything. Then privileges should be granted according to what that person needs to do in the system, building up to only include the data and processes they require. If your systems don’t follow a least-privilege system, then you are significantly exposed to cyberattack, to fraud and to errors. When users’ roles change their access should be reduced if their job doesn’t require it anymore (and their access removed altogether when they leave!)
- Stay up to date. This should be so simple, but most hacks exploit the fact that many companies fall behind. All computers should use up to date operating systems which are properly patched; utilise up to date anti-virus and anti-malware systems. However these systems only work well when they know what they’re up against. Newer protection systems coming on the market look for programmes acting suspiciously and will automatically shut down the programme before it has had time to cause mayhem. These systems provide protection against new attacks (often called “Zero Day”) because they spot the bad behaviour of an application rather than recognise the malware itself.
- Encryption. To protect your data, it should be encrypted and only accessible to those with the approved rights to look at it. Where you have customer data, particularly user accounts and passwords, ask your IT team whether the data is “hashed and salted” which will make it very secure and difficult to break even if your systems are breached. It is unforgiveable nowadays to be holding customer data unencrypted (known as “clear or plain text”).
- Attitudes. Security systems can be bypassed by canny criminals because they know where the weak link is … it’s your employees. Create a “security culture”, where taking this stuff seriously is encouraged. Ensure you and the Board demonstrate good practice – for example, if you write your passwords on post-its then you should fully expect your staff to do the same… and one day you will probably be hacked as a result. Many hackers exploit helpful staff who simply hand over money! Sound financial processes, good education and ongoing training are all vital to security. Remind people to “think before you click”!
- Backups. Your data and systems should also be well backed up and the backup must be stored off-site, preferably with no connection to your live systems (known as an “airgap”). Ensure the backups include multiple versions of the same document in case corruption or malicious encryption took place at some point in the past. Having a decent data backup can be the difference between having a business post-disaster and not.
- Bespoke software. Bespoke software and web applications must be built by experts, using modern tools and techniques. Good developers can build secure software, but bad ones don’t – and you won’t necessarily know which they are! Ask whether they are designing to meet the OWASP Top 10 and consider getting an independent penetration test which can be done for well under £5k.
- Passwords. So many hackers don’t have to be clever because users make it easy by choosing “password123” or reusing their passwords in multiple places. Users must take passwords seriously, choose long passwords that are hard to guess, use different passwords, and don’t share. Software can be used to store passwords securely, but if people must write down details then these must be locked away. Make sure your systems are configured to enforce good password discipline and lock out users after repeated failure attempts.
- Crisis Plans. Establish how you will handle a crisis in advance. Who’s in charge if you are attacked by ransomware and decisions need to be taken on the spot. GDPR makes specific requirements about notifying the ICO if you suffer a security breach – who is responsible for making this happen; failure to do so will result in a fine.
- Certification. Get certified – this will give a focus and purpose to your efforts to improve security. A good place to start is Cyber Essentials Plus certification. This will provide you with a government standard accreditation that directly demonstrates to you, your company and your customers that you take security seriously and that you’re working to ensure their data is held securely and your systems are well managed. We know of clients that have won new customers simply because they stood out from the competition by having Cyber Essentials Plus accreditation.
We have also created a more detailed full CEO’s Briefing document on IT Risks, Compliance and Security. Click the button below to download our full CEO’s briefing.Download now and make sure your business is protected
Freeman Clarke is the UK’s largest and most experienced team of part-time (we call it “fractional”) IT directors, CIOs and CTOs. We work exclusively with SME and mid-market organisations and we frequently help our clients use IT to beat their competition. Contact Us and we’ll be in touch for an informal conversation.