Be proactive, not reactive: 5 steps to a cyber security prevention plan
James Healey, Managing Director at Air IT, explains the five main steps that a company should take in preventing a cyber attack.
Cyber security news, such as the Marriott hack in November, is dominating headlines, and becoming a serious headache for business leaders.
This article offers CTOs, businesses and tech leaders the advice and actionable information they need to implement a solid cyber prevention plan. And, make sure that their business is not tomorrow’s headline.
A new report has found that nearly two-thirds of respondents lack confidence in their organisations’ ability to prevent serious damage from a cyber attack.
As technology grows more sophisticated, so to do hackers as they constantly work on new threats and software. Only this month, hotel giant Marriott was found to have suffered one of the world’s biggest hacks ever reported following a string of security breaches, leading to the theft of data from its 500-million customer database.
Hackers are using valid credentials and connections to make it substantially more difficult for businesses to detect them. But at a time when we are increasingly relying on connected devices which store and utilise vast pools of valuable information, organisations must take the time to develop a sound security strategy to prevent their data from falling into the wrong hands.
Over 70% of all data breaches in SMEs are due to internal vulnerabilities, such as failure to follow policies and procedures and lack of expertise — 36% of these breaches are caused by misuse of data by employees. There has to be more done, and there must be a prevention plan in place, not a hasty reactive motion when an attack hits which may get rid of the current problem, but not prevent other, more advanced attacks. Prevention is better than cure — you take steps to prevent viruses and infections from your body, so why not your network?
1. Assess your current cyber hygiene
The UK Government backs an innovative scheme called Cyber Essentialswhich is designed to help all companies improve their cyber hygiene. It’s an essential requirement for any business bidding on government contracts, but it’s beneficial for any company, as it’s believed to reduce the risk of an attack by up to 80%. It results in a certification which demonstrates a commitment to protecting business and stakeholder data from threats – crucial for building customer trust. The scheme covers all essential controls such as firewalls, malware prevention and up-to-date software.
Businesses can self-assess, or go through a Cyber Essentials or Cyber Essentials Plus certifying body, which can manage the whole process from initial audit to actions needed, right through to completing your assessment and issuing your certificate. This gives the business a practical framework to measure itself against, and reassures customers that it takes security seriously as well as proving your commitment to good cyber security practices.
2. Good housekeeping
There’s no replacement for the basics. Updates and patching should be performed regularly — WannaCry, the ransomware that caused chaos across the world, exploited unpatched Windows systems to spread malware. Businesses should steer away from legacy systems like Windows XP, as these no longer receive updates and are especially vulnerable to attack.
Get in the habit of conducting regular routine maintenance and audits, and seek a service provider if necessary, which can use specialist software to block ransomware strains.
Other admin that businesses can do is limiting user privileges for employees, by making sure they only have access to the servers and drives that they need to complete work. For example, most staff do not need access to any HR files. Along with being a possible breach of GDPR standards, the more people that have access to personal information, the less chance you have of preventing the spread of an attack if you’re compromised.
3. Raise awareness, stay vigilant
Awareness should always underpin your prevention plan. SMEs are often targeted as the way in for financial attacks through phishing or impersonation with the aim to extract financial data or currency. This is often due to it being easier to take advantage of human behaviour to target specific individuals who may not have had the right training. Whether it’s lack of awareness or just lazy decisions, they need to be properly trained on the risks and repercussions, along with potential hacking tricks as the majority of malware still requires a human action to initiate it.
Build on their education, raise their awareness of cybercrime, and make sure that they stay vigilant. Signs like grammatical errors and email addresses that don’t match the sender are common signs of a malicious email, for example. Also, implement a mandatory strong password rule, and ensure that all employees have access to the incident response policy. No defence strategy is watertight, but with the right prevention methods in place, you can reduce the risk of the human factor.
4. Layered prevention approach
Proactive technology must be in place to help you to identify and mitigate threats. Managed security packages and dark web monitoring solutions can proactively monitor for threats and compromised user credentials so you can stop an attack before it happens or minimise the damage. By using human and artificial threat intelligence, monitoring services can find your vulnerabilities and any compromised or exposed credentials.
There are also business-grade security solutions that can help protect the network and users from would be attacks such as anti-virus, anti-spam and business grade firewalls. Businesses should always invest in a layered defence strategy, as the more comprehensive the set up is, the less chance an attack will succeed as it has to pass through the various layers.
Avoid free products and solutions which claim that they can keep malware off your PC. Windows Defender, for instance, doesn’t stop adware or Potentially Unwanted Programs (PUP) and doesn’t possess the accuracy and effectiveness that more sophisticated prevention tools do.
Paid-for prevention tools are a small price to pay for the reassurance of digital safety. The cost of a hack to a business would be much more than the cost of the prevention technology.
5. Better safe than sorry
While it’s important to be proactive, businesses need a recovery plan in place in the event of a disaster or any downtime. A staggering 60% of businesses that encounter an attack go out of business in their first year, because of attacks to their network and users. While the big dogs like the NHS, Sony and Equifax dominate the headlines when they suffer attacks, it’s the SMEs that are secretly suffering the worst due to factors such as the human element and not prioritising investments, as mentioned above.
Under GDPR legislation, you must have a plan in place to be able to restore data, whether it’s a cyber attack, file corruption or simple data loss, otherwise you risk non-compliance. IT continuity is the bread and butter of so many businesses, and you must make sure that you have a backup and business continuity plan to prepare, should the worst happen. Seek Disaster Recovery as a Service (DRaaS) to protect critical business data and get operational again after a disaster.
While there is not a simple, singular solution to combat hack attacks and deter criminals, a layered prevention plan is crucial. Follow these steps, and data misuse and abuse can be minimised, while still enabling your business to take advantage of the growing opportunities the internet can harness.
Industry: Cyber Security News
- Data Protection Officer (DPO)/ Risk Manager
- 65000 plus benefits
Data Protection Officer with a strong focus on risk management is needed for this expanding Paytech business. You will work closely with the CISO to help understand how the data is being processed within the business and identify the business risk associated with this. this role will be both internally and externally focused As the business processes payments across the globe, they require someone with knowledge of the different data regulations, GPPR, CCPA. This role is focused on helping to identify potential business risks associated with the data usage and ensuring that issues are flagged to the relevant teams within the business.
- Security Monitoring and Vulnerability Analyst, End User. PCI Level 1 Service Provider.
CH7843 Security Monitoring and Vulnerability Analyst, End User. Level 1 Service Provider. £50,000 London Security Monitoring and Vulnerability Analyst needed to join an Level 1 Service Provider. The Security Analyst will be responsible monitoring, configuring, fine tuning and generally improving the security tool capability. Specific experience with Tripwire Log Center and Tripwire Enterprise is highly desirable. Other security tools experience should include the managing and monitoring of firewalls, Anti Phishing, AV, vulnerability management, IAM etc. Current experience with Vulnerability management and penetration testing is highly desirable. Specifically the ability to effectively manage 3rd party pen tests. Hands on penetration testing is a very nice to have. You will be working within a specialist security team reporting to the CISO. Experience working within an end user environment within financial services is highly desirable. Flexible location. This is an exclusive role to DCL Search & Selection. https://calendly.com/chris-holt/arranged-call-with-chris-holt-soc-role-clone
- Internal Security Auditor, Level 1 Service Provider (ISO27001)
- Upto 65,000 plus benefits
Internal Security Auditor ISO 27001, PCI, needed to join a Cyber team within this expanding Fintech business. The Internal Security Auditor will have end to end responsibility for planning, delivering, remediating any findings etc. Experience working within financial services is highly desirable. This Is a great time to join a newly formed and growing Cyber team within a rapidly expanding fintech, that is taking a major share of its market. We are looking for someone with experience, (but not to be limited to) a mix of Information Security standards, frameworks, audit principles, controls / policies and the management and use of the technical tooling etc. ISO 22301, ISO 27001, NIST Cybersecurity Framework etc An ideal candidate will be working within an end user environment with a cyber consultancy background. Experience taking a company through accreditation is highly desirable Experience managing internal stakeholders, technical teams and external third parties essential Flexible working, but with the ability to get into London. This is an exclusive role to DCL Search & Selection.
- DevOps Engineer with IdAM
- Upto £80,000 plus benefits
We are ooking for an DevOps engineer, idealy with IdAM (identity access Management) experience, this is a senior role for someone that can be the lead hands on person on a project. Your role will be to work on the deployment project implementing the solution into the exsiting application so will be used to connect an applications into mulipe 3rd party appliactions. We Would look at someone who has done DevOps with Security and can cross train into IdaM, but preference would be given to someone with the IdAM experience this is a great opportunity to join a consultancy that work on some truely amazing and differnet solutions