Locking Down Cyber Security

Many operations are failing to manage the cyber security basics, and this is leaving businesses highly vulnerable.

Why is it that even well-run organisations seem unable to take the critical steps needed to protect themselves? In part it can be attributed to a failure to update ageing IT systems, rendering resilience to hacking, ransom and accidental data loss progressively weaker over time. Innovative IT systems installed 10 years are now archaic.

Furthermore, the different ways in which organisations operate, often using a mixture of new and old (sometimes incompatible hardware alongside complex and frequently poorly updated unpatched software renders many operations more vulnerable. These weaknesses are made worse by the trend to hybrid and remote work and BYOD policies.

In the last year, 39% of UK businesses reported cyber attacks, of which phishing attempts were the most common (83%). This figure has decreased slightly from 46% in 2020, although one in every 3,226 emails an executive receives is a targeted phishing attempt, also known as whaling attacks. 

With only a quarter (26%) of small business professionals considering cyber security to be a top priority, there is real scope for improvement if organisations are to limit the threat that fraud and other online crimes present to their operations. For many, the world of cyber security is a confusing one and it can be hard to know where to start. So what threats do companies face, and what can they do to maintain a secure and thriving ecosystem?

Complacency is the biggest threat to a business’s safety. Just 54% of UK businesses acted to identify cybersecurity risks in the last year and IT teams are often delayed in their response to fixing misconfigured technology and protective tools, leaving their companies open to attacks.

The problem is that most businesses are more focused on their profitability than security, with little consideration for the potential cost of an attack. Employees often use weak or repetitive passwords, or specific teams may employ processes that diverge from their company’s safety regulations. These transgressions can have a huge impact on the entire business; cybersecurity breaches can cost medium to large UK companies often over £8,000 and this does not take account of the impact on reputation. 

The introduction of cloud-based networks has also weakened businesses’ security by globalising the cyber security landscape.

Furthermore, the post-pandemic shift to flexible working means companies can no longer implement overarching regulations, as these may inadvertently hinder employees being able to work effectively. In this new era, security measures need to open up access to remote workers while also empowering the identification and limitation of threats. On top of this, people are more aware of sites tracking them than ever before and there’s a common belief VPNs will keep personal information secure, making these tools increasingly popular despite tests highlighting concerns over security and privacy practices. 

Many companies use VPNs to give their employees access to their system server, however, malicious actors can use VPNs to protect their identities, causing confusion when considering whether a VPN user is legitimate or not.

Training and Education

Implementing effective cyber security measures doesn’t need to be expensive, and introducing simple yet powerful training sessions to educate employees is an easy way to increase awareness, improve security and drive change. Training and explaining to management and staff about the changing phishing attempts and the importance of strong, regularly updated passwords, as well as how password managers can really help and is a very good first step. 

Any organisation's employees can prove to be the weakest link, and junior employees are often deliberately targeted by hackers as they can provide an easy route into a businesses’ databases due to limited security knowledge.

As Internet use is essential for modern businesses, everyone is at risk of cyber attacks - but this needn’t cause anxiety if each individual is taking steps to prevent them. Business leaders need to apply the same logic as insurance only covers so much, especially if the organisation's leaders have failed to properly assessed its risk profile.

Companies must at least ensure they’re taking basic precautions, such as keeping databases secure.

Hackers usually access company networks via mobile phones, laptops or phishing emails, and considering more and more employees are using private devices for business purposes, companies need to deploy security tools that also cover these personal devices. While greater employee education is paramount, it’s not enough on its own to provide sufficient cyber security.

Implementing robust technological solutions will add an extra layer of defence, like CCTV cameras outside your home. This is where IP address data is crucial; it carries rich geolocation information and can provide details on whether an IP address, essentially like a post-code for an internet login, is proxied or masked, and whether it relates to a home address or a business. By partnering with technology providers who have access to these insights, businesses can identify in real time how and where a device is connecting to the Internet to spot, and block, cyber-attacks.

Businesses should also incorporate data from virtual private networks (VPNs) and proxy servers to build a more accurate view of who is accessing their network. 

Opportunistic hackers often take advantage of the IP-address-disguising capabilities of proxies and VPNs, so sophisticated technology can help companies examine data from these sources to weed out malicious players. 
Businesses can even automate this process by integrating the data into their front-end online security processes, while proxy data can activate fraud alerts. It’s important to ensure the data used is of the highest quality. By working with providers that regularly update their proxy and VPN data, and guarantee it comes from reliable sources, companies can ensure their security systems are operating on accurate information.

When it comes to cyber security, learning from past mistakes is crucial and these areas are fundamental areas for an organisation to monitor continually.

Change

Organisations face a constantly changing array of pressures from multiple sources. Competitive threats, 
New regulations, financial uncertainty, technological shifts, and business risk all force managers to maintain a state of perpetual vigilance. Globalisation and technological advancements have enabled new business models and competitors to spring up overnight. The ability of businesses to respond effectively to these pressures can be in itself a source of sustainable competitive advantage. 

Compliance

Corporate governance, risk management, and compliance with policies and regulations are in sharp focus for most organisations. It’s not enough to express intent to follow regulations and policies, organisations must measure and transparently report on how completely they are being followed. Efforts to ensure consistent experiences for customers and to wring efficiencies from standardisation are often competing with individual workers whose sense of privilege or creativity conflicts with the corporate standard. Getting it wrong in this area can have devastating consequences on the viability and competitiveness of any firm. The survival of every organisation hinges on its ability to deliver value for its customers. 

Continuity 

Organisations routinely spend hundreds of thousands of dollars on hot-standby computers, back-up power sources, and disaster recovery locations to create resiliency in their physical security platforms. These measures are not only expensive; they are often reliant on internal computer networks that are likely to be severely challenged by any form of massive disaster. If employees cannot get to the machines that operate the security platform, all the redundant measures will be devalued

Coverage

Organisations often find that the best way to accelerate profitable growth is through geographic expansion. Expansion comes with significant challenges, risks, and expenses. Management teams will be extended a bit further, as will scarce company resources. Solutions that provide good results in one location or at a small campus can become troublesome when multiplied for many geographically dispersed sites. Typically, these latter types of installations expose the vulnerabilities, complexities, and hidden expenses of traditional client/server solutions. 
Security as a Service solutions provide clear benefits for organisations with geographically dispersed sites. The low initial costs and wide-scalability of SaaS solutions give organisations access to world-class technologies with an economic model that promotes expansion instead of restricting it. 

Securely using the public Internet as a communication channel can greatly simplifies the deployment of remote sites for IT departments. 

The centrally hosted SaaS model provides all the central oversight and management needed in well-run organisations without requiring costly investments in dedicated infrastructure. Given the number of people who are still acting negligently with regards their own cyber security, perhaps it’s not yet been considered in the risk analysis for insurers.

By identifying areas of weakness and the valuable assets that are most in need of protection, businesses can tighten their security and protect themselves against bad actors. 

Educating employees to eliminate basic errors will empower them to lock criminals out, while partnering with the right technology and IP address data providers double-bolts the door against hackers, making the identification of security breaches quicker, easier, and more effective. The best way to get peace is by taking an active approach and do something about it.

By implementing a cyber security risk management plan, you will be able to limit the damage caused by a potential cyber attack.

Business Leader:   Brivo:   CIO:     David Mytton:     Rail Monitor:   Christopher Hodson

You Might Also Read:

Ransom: Prepare For The Worst:





 

« The Quantum Internet Could Be Immune To Cyber Attack
(ISC)² Makes Cyber Security Careers More Widely Accessible »

Quartz Conference
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Perimeter 81 / Zero Trust Network Access Guide

Perimeter 81 / Zero Trust Network Access Guide

Curious how you can Implement a Zero Trust roadmap with insights from Gartner? Download this free report for a limited time only.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Infosys

Infosys

Infosys is a global leader in consulting, technology and outsourcing solutions.. Services include IT strategy, technical architecture and operations.

Riverbed Technology

Riverbed Technology

The Riverbed Network and Application Performance Platform enables organizations to visualize, optimize, accelerate and remediate the performance of any network for any application.

Dimension Data

Dimension Data

Dimension Data specialising in IT services in areas including network integration, data centres and managed security.

Agenci

Agenci

Agenci are specialists in cyber security and information security and deliver ISO 27001 Certification.

Secure India

Secure India

Secure India provides Forensic Solutions that help Government and Business in dealing with prevention and resolution of Cyber related threats.

BlueID

BlueID

BlueID is an IDaaS technology product which enables your objects to securely connect and interact with your users’ smart phones and smart watches.

CyberInt

CyberInt

CyberInt’s Managed Detection and Response services span globally and include some of the top finance, retail and telecommunication organizations.

Imunisys

Imunisys

Imunisys - We are your company's immune system in an increasingly connected world.

Octane OC

Octane OC

OCTANe is building the SoCal of tomorrow. We drive innovation and growth by connecting people, resources and capital. Our Incubator focus is FinTech, Data Analytics and Cybersecurity.

Ukrainian Academy of Cyber Security (UACS)

Ukrainian Academy of Cyber Security (UACS)

UACS is a professional non-profit public organization established to promote the development of an extensive network and ecosystem of education and training in the field of cyber security.

Women4Cyber

Women4Cyber

Women4Cyber is a non-profit European private foundation, with the objective to promote, encourage and support the participation of women in the field of cybersecurity.

SHIELD

SHIELD

SHIELD are the world’s leading cybersecurity company specializing in cyber fraud and identity solutions.

Securix

Securix

SECURIX AG delivers holistic IT security solutions that are tailored to the specific challenges and requirements of your company.

Comparitech

Comparitech

Comparitech strives to promote cyber security and privacy for all. We are committed to providing detailed information to help our readers become more cyber secure and cyber aware.

GLIMPS

GLIMPS

GLIMPS-Malware automatically detects malware affecting standard computer systems, manufacturing systems, IOT or automotive domains.

Codean

Codean

The Codean Review Environment automates mundane software analysis tasks, so security experts can focus on finding vulnerabilities.