CYBERSECURITY

Protecting your business and its information assets by reducing vulnerabilities and maintaining security.

Cybersecurity generally makes headline news when large corporates are attacked and data is leaked or services are interrupted.  But all businesses today have some connection with technology and whether you are large or small, part of a team or a sole trader, you cannot afford to ignore the risks.

In simple terms good cybersecurity comes down to two things.  Protecting your systems as far as is practically possible and then having a backup and recovery plan in place if this should fail.

The protection that you put in place should be appropriate to your business and be based on your industry, the data you hold, the level of regulation in your industry, the technology in use and many more factors.

And it’s much more than protecting your data; it’s also about showing your clients that you take IT security seriously and that is becoming increasingly important.  One of our customers has recently been informed by one of their major clients that they need to be either ISO 27001 or Cyber Essentials certified to even consider continuing to work for them.  

Essentially, and at the most basic level, you need to address your policy, procedure and protection in at least the following areas:

• Understand what you need to protect – if you don’t know what information you store and where you store it then how can you hope to protect it?
• Educate your staff – around browsing behaviour, phishing threats, use of mobile devices;
• Passwords – ensure that your employees use strong passwords and understand the risks associated with compromised passwords;
• Keep your systems and software up to date – so that you will at least be protected from yesterday’s threats;
• Implement comprehensive anti-malware protection – using ‘best of breed’ threat protection will ensure that you aren’t caught out unnecessarily;
• And, above all, make sure you have robust backup solution.

Of course there are many more things to consider and factor in to this.  In all areas, but more so in relation to technology, security is all about risk mitigation—you will never actually achieve “secure”, you merely decrease your exposure.  And the things highlighted above should be carried out as a matter of good practice.

The starting point for all this is to understand the business, the technology in use and the risks faced – we do this by carrying out a basic security audit.  This should include your IT infrastructure, policies and procedures, access control for systems and data, internet connections and other related areas.

Once we have all this information we can identify risks – it isn’t too complicated but there equally isn’t a ‘one size fits all’ approach available.  Businesses can easily waste money and move further from being secure due to a lack of knowledge around how to tackle cybersecurity pragmatically and practically.  Depending on your available resources, competence and expertise we can offer help in many areas.  You may be bombarded with stories of disaster or random offers of assistance but don’t panic.