Caithness Map :: Links to Site Map Great value Unlimited Broadband from an award winning provider  

 

Is Cyber Security Part Of Your Business Plan?

10th January 2018

Photograph of Is Cyber Security Part Of Your Business Plan?

The increasing use of digital services in a connected world brings an increasing threat of cyberattack. The Internet that connects systems doesn't discriminate between the type of traffic it allows on the network, it is our responsibility to manage this when we connect to and use the Internet by recognising and reducing the risk as appropriate. Attackers are constantly improving their ability to penetrate systems through social engineering and the opportunity of our increased online presence. The first step for an organisation to counter the threat from cyberattack is to understand their risks and to deal with the question of not "if" it will happen, but "when".

The consequence of a successful attack depends heavily on the nature and scale of the attack and the ability of the organisation to respond to it. Some attacks may result in complete failure of an organisation's systems; some may take money from bank accounts or credit cards; some may compromise data; and some may impact on an organisation's reputation. It is important to remember that not all attacks come through the computer systems, successful telephone based vishing attacks are being seen in ever increasing quantities to demonstrate that our ability to detect them does not depend on computer based security systems.

The majority of cyberattacks are not targeted at specific individuals or organisations but are opportunistic and look to exploit known vulnerabilities in computer systems that can be exploited. Cyber attackers, hackers and writers of malware use programs that are able to automatically exploit known weaknesses, poorly configured systems and weak passwords without consideration of the impact that it will have on the target.

Organisations should not look on the cyber security threat as being a technology problem, it is an organisational risk as it is the organisation that will be disrupted and it should be addressed at this level. Whilst technology is a natural part of the process to secure the organisation, most of the changes that are required in the attitude of employees to the risk and the management of the risk. Security needs to be an integral part of the business process, technology can assist in the implementation and management of the process but it can't fully protect it.

There are some practical and basic steps that individuals and organisations should take in order to better protect themselves:

Do not share passwords between employees or on different services/applications, preventing multiple systems being compromised if one username and password is obtained.

Robust passwords provide one of the first lines of defence against attack and we should think about pass-phrases rather than passwords when choosing our passwords. Policies on password management vary from one organisation to another with some demanding passwords have a minimum length, a mixture of numbers, letters and special characters and that needing to be changed frequently. Consider using passwords that are 12 or more characters long that are based on three or four unrelated words that are punctuated by numbers and characters, e.g. Blue1Fish.Moon.

An organisational password policy indicates that the issue is taken seriously and provide guidelines to employees and users on password selection and management. Consider using one of the many available password managers to make the management of passwords within the organisation easier and secure for everyone as user should be using more than the typical five to six unique passwords.

Regularly educate users on the various attacks vectors that are used, this should include email, social media and the use of social profiling. Deliver regular training sessions to ensure that users are aware of the current techniques being used and consider carryout tests on the systems and users through carryout ethical penetration tests to see how effective this training is.

Restrict access to data to only those that require it

The security threat is not static and neither should the system resilience, to assist in maintaining resilience within the business systems:

Ensure that all systems are properly configured so that only authorised and restricted users have management/administrative rights and that they are only used when needed.

Ensure that system updates and patches are applied promptly after being released.

Install commercial grade anti-virus software and keep it up to date.

Review systems to ensure that they are compliant and manage change to ensure that the system resilience is maintained.

Take regular system and data backups and ensure that the organisation can recover with acceptable data loss.

Implement a recovery plan to ensure that the organisation can get back to the required operational level within an acceptable timeframe.

To assist with this, the National Cyber Security Centre has produced a 10 Steps to Cyber Security resource at https://www.ncsc.gov.uk/guidance/10-steps-cyber-security.

The Cyber Essentials scheme has been developed by Government and industry to fulfil two functions. It provides a clear statement of the basic controls all organisations should implement to mitigate the risk from common internet based threats, within the context of the Government’s 10 Steps to Cyber Security. And through the Assurance Framework it offers a mechanism for organisations to demonstrate to customers, investors, insurers and others that they have taken these essential precautions.

Cyber Essentials offers a sound foundation of basic hygiene measures that all types of organisations can implement and potentially build upon. Government believes that implementing these measures can significantly reduce an organisation's vulnerability. However, it does not offer a silver bullet to remove all cyber security risk; for example, it is not designed to address more advanced, targeted attacks and hence organisations facing these threats will need to implement additional measures as part of their security strategy. What Cyber Essentials does do is define a focused set of controls which will provide cost effective, basic cyber security for organisations of all sizes.

The Assurance Framework, leading to the awarding of Cyber Essentials and Cyber Essentials Plus certificates for organisations, has been designed in consultation with SMEs to be light-touch and achievable at low cost. The two options give organisations a choice over the level of assurance they wish to gain and the cost of doing so. It is important to recognise that certification only provides a snapshot of the cyber security practices of the organisation at the time of assessment, while maintaining a robust cyber security stance requires additional measures such as a sound risk management approach, as well as on-going updates to the Cyber Essentials control themes, such as patching. But we believe this scheme offers the right balance between providing additional assurance of an organisation’s commitment to implementing cyber security to third parties, while retaining a simple and low cost mechanism for doing so. The Scottish Business Resilience Centre maintains a list of organisation that can assist organisations to achieve Cyber Essentials at: https://www.sbrcentre.co.uk/services/cyber-services/cisp-and-cyber-essentials/approved-practitioners/

https://www.sbrcentre.co.uk/services/cyber-services/cisp-and-cyber-essentials/trusted-partners/

HIE is currently working with a range of its clients across the region who are working towards their Cyber Essentials accreditation. This has been running since September and included a one day intensive workshop and 1-2-1 support from a digital adviser to develop a Cyber Resilience plan. Any account managed organisations or businesses interested in this programme should contact their account manager or can email hidigital@hient.co.uk

Computer Security is a vast topic and more information can be read at https://en.wikipedia.org/wiki/Computer_security

 

Related Businesses

 

Related Articles

New Orkney Whisky Distillery In Moves To Create Jobs And Lower EmissionsThumbnail for article : New Orkney Whisky Distillery In Moves To Create Jobs And Lower Emissions
Deerness Distillery Ltd has secured £246,000 from Highlands and Islands Enterprise (HIE) for the £820,000 development.   Construction is underway at the distillery, which was founded by husband-and-wife team Stuart and Adelle Brown.  
Cuts And More Cuts But Still Cash For Arts In Highland - £30,000 For TapestriesThumbnail for article : Cuts And More Cuts But Still Cash For Arts In Highland - £30,000 For Tapestries
The Co-Chairs of the Inverness Castle Delivery Group, Fergus Ewing MSP and Cllr Ian Brown, are delighted to announce the award of £30,000 from Highlands and Islands Enterprise (HIE) in support of framing the 57 panels that will form the Tapestry of the Highlands and Islands.   This financial commitment from HIE has contributed significantly to the preservation of the 57 panels created by communities across the Highlands and Islands, of which 32 will be included in the first exhibition as part of the Inverness Castle Experience.  
£24.5m To Secure £350m Inward InvestmentThumbnail for article : £24.5m To Secure £350m Inward Investment
Sumitomo Electric UK Power Cables Ltd plans to establish major operations in the region, supplying high voltage cables to the growing offshore wind energy sector.   A funding package has been agreed to secure an estimated £350m in inward investment for Scotland, based in the Highlands.  
Property Demand Study Launched By Highlands and Islands Enterprisie
As part of the study, businesses, community groups and social enterprises with future land or property plans are encouraged to complete a short survey by 22 March 2024.   Whether it's interest in land for sale or space to lease, HIE is keen to hear from organisations already based in the region as well as from those that are considering locating a business to the area.  
Shetland Engineering Firm Expands And Creates JobsThumbnail for article : Shetland Engineering Firm Expands And Creates Jobs
L&M Engineering has secured a grant of £58,914 from Highlands and Islands Enterprise (HIE) for the development, which is set to boost business turnover by £1.2m and create two jobs over the next three years.   The company is diversifying its operations to cater for additional aquaculture markets.  
Region's Businesses Value Community Links
Most businesses in the Highlands and Islands consider their links with the local community as either equal to or more important than their profitable growth.   This is one of the key findings of the most recent rural business survey commissioned by Highlands and Islands Enterprise (HIE) in partnership with South of Scotland Enterprise (SOSE).  
Support Programme Takes Young Entrepreneurs To The Next Level
Dynamic business support programme, IMPACT30, is aimed at nurturing and empowering the next generation of innovative leaders.   The fully funded programme is for people aged under 35 in a young enterprise and in a key decision-making role.  
Power Boost For Off-grid Island
A project to increase electricity supply and reduce emissions on a west coast island has been awarded more than £25,000 by HIE.   The HIE funding is being used to replace and upgrade high voltage transformers and other associated equipment to enable a major upgrade of the renewable energy supply on the Isle of Muck.  
Region's Young Workforce To Take Part In Pioneering Sustainability Skills ProgrammeThumbnail for article : Region's Young Workforce To Take Part In Pioneering Sustainability Skills Programme
Region's young workforce to take part in pioneering sustainability skills programme.   Highlands and Islands Enterprise (HIE), Zero Waste Scotland and business transformation enterprise Powering Futures have teamed up to provide the fully-funded places on the Highlands and Islands Powering Futures Challenge 2024.  
New Facility For Renewables Industry Trainees
People working in or entering Scotland's growing renewables industry will soon have access to a new training facility in Inverness.   The £1.22m Renewable Energy Training Centre, being established by Aurora Energy Services Ltd, (AES) will be the first of its kind in the region.