According to the UK Government’s Cyber Security Breaches Survey 2017 report, assessing UK businesses between October 2016 and January 2017:
46% of all UK businesses identified at least one cyber security breach or attack in the previous 12 months
The survey highlighted that the most common type of breaches are related to:
-
staff receiving fraudulent emails (72%)
-
viruses, spyware, and malware (33%)
-
people impersonating the organisation via email or online (27%)
-
and ransomware (17%).
This highlights that, although having strong technical security in place is important, the awareness of staff to potential threats is a crucial element of security.
As well as costing the business in temporary loss of files or network access (23%), corrupted systems (20%) and staff time to deal with the breach (34%), these attacks frequently incur a financial cost. The survey notes that the average business faces costs of £1,570 as the result of a breach. This average cost grows to £3,070 for medium firms and a massive £19,600 for large firms.
Although 74% of UK businesses say that cyber security is a high priority for senior management, only a fifth (20%) of businesses have had staff attend internal or external training on cyber security in the last 12 months. Micro (12%) and small (25%) firms are least likely to engage staff in cyber security training, compared to medium (43%) and large (63%) firms.
The recent cyber-attack that affected 150 countries, and many more businesses, has particularly brought to light the need for businesses to implement secure systems and effective training for staff.
The malicious software known as ‘ransomware’ blocks access to the victim’s data or threatens to use, publish or delete this data unless a ransom is paid. The virus will usually find its way onto a device or into a system by exploiting a hole in security or vulnerable software, or by tricking someone into installing the virus under the guise of something else.
Depending on the calibre of ransomware, the system might be temporarily locked or it may encrypt all of the files rendering them inaccessible. However the attack manifests, it could mean lost time, data and money for the businesses.
If you are concerned about the cyber security of your business, here are some steps you can start taking now to protect your assets:
Ensure staff awareness
As malware is most likely to hit your business through email or web, it’s important that all staff are vigilant and take steps to protect the business when they are online. Here are a few things to remember:
- Do not open an email from unknown or untrusted senders
- Do not open or download unexpected attachments or links in emails
- Do not use websites that are not secure or trusted
- Report any suspicious emails or odd activities taking place immediately
Use strong passwords
Passwords are all too easy for hackers to crack. You will never be able to prevent 100% of password threats but you can reduce the risk of being compromised. All passwords should be a combination of upper and lower case, numbers and symbols. They should ideally use unrelated or nonsensical words. Finally, passwords should be reset every few weeks to ensure they are constantly changing.
Designate a key member of staff
As a small business, you may not have the resources to invest in a full-time IT team member. However, it’s important that you identify someone who will have the responsibility of overseeing your cyber security, otherwise this could become overlooked and your business could be left in a vulnerable state. This designated team member should stay informed of any digital security news, understand basic requirements for your business to operate safely online and ensure that those requirements are adopted across the whole business.
Always back up your data
Your data is arguably the most important part of your business so what would you do if they were corrupted by a virus? A great way to ensure you can always recover your data is to regularly back up to a cloud system. The Superfast Business Wales Software Directory offers a list of data back up systems that could help you to back up your entire business safely.
Use an anti-virus software
If your business uses a number of devices such as computers, tablets and smartphones then it’s important to recognise that any of these could become infected with viruses or malware. Install internet security software on all devices that are used for the business or to access business data.
Education and training
Although assigning a key person to managing cyber security is important, it’s not their sole responsibility to keep the business protected. Keep your staff up to date on cyber security best practices by offering training and education. Whether you send a staff member on a course and ask them to share their learnings with the team, you bring in a professional to give group training, or you employ a dedicated member of IT staff who can give internal training, it’s important that staff participate in some form of education.
Dedicating business time now could mean the difference between a successful cyber-attack or not. Superfast Business Wales offers free Cyber Security masterclasses and information, click the link to find out more.
Prepare for an attack
Although the best offence is a good defence, staff should be prepared to take action if necessary. This could be as simple as having an immediate contact for any suspicious activity or clear step-by-step guidelines on what to do if there is an attack. It’s vital that any potential attack is recognised and reported immediately so you can have the best chance of ensuring recovery and prevention of further loss.
Don’t wait until there is a breach to take action. Now is the time to build up your defences and put strong foundations in place so if the worst does happen, you’ll be prepared to deal with it and move on with your business intact.