Secure your company from cyber attack
- Thread starter Akiram
- Start date
My advice is:
- Encrypt data
- Encrypt Hard drives on machine (desktop, laptop), desktops especially if home based business
- Bitlocker (free with various editions of Windows)
- VeraCrypt (Open Source)
- Symantic (Paid)
- USB or External storage devices
- Sensitive data; especially if storing to the cloud (Dropbox, one drive)
- Encrypt Hard drives on machine (desktop, laptop), desktops especially if home based business
- External hardware Firewall that sits between the internet and network..
- Do not rely on software based on like Windows or the one that comes with your favourite Anti virus/malware software
- A cost effective one is an old desktop or one off ebay (£40 to £60) with 2 network cards running PFSense.
- A number of my small/home based clients have this, especially if a shared internet with home..
- Work on least privilege access
- If you issue any machines make sure that full admin rights are not provided
- Security Awareness
- Change passwords every 30/60 days
- Do not use the same password for everything
- Do not use easy to guess password (abc123) or something personal like your partners or children(s) names. Use complex passwords like rYx59gnP@jhw$NNp
Upvote
0
Gov UK Cyber Essentials website
https://www.gov.uk/government/publications/cyber-essentials-scheme-overview
https://www.gov.uk/government/publications/cyber-essentials-scheme-overview
Upvote
0
- Original Poster
- #7
It's a scheme developed by the UK Government to help companies improve their cyber security and avoid being victim of basic cyber attacks. It's based on 5 security controls (some of them mentioned by @soundengineeruk ).
The company I work for is one of the certification bodies for the scheme and has cost-effective solutions to help small and medium companies become cyber secure.
The company I work for is one of the certification bodies for the scheme and has cost-effective solutions to help small and medium companies become cyber secure.
Upvote
0
I'm astounded on a regular basis by business owner's wilful ignorance in this field.
Business critical IT systems brought down because of a lack of backup / disaster recovery plan usually cost much time, money and reputation.
Learning this lesson first hand seems to be what motivates most into listening to us annoying IT engineers.
Business critical IT systems brought down because of a lack of backup / disaster recovery plan usually cost much time, money and reputation.
Learning this lesson first hand seems to be what motivates most into listening to us annoying IT engineers.
Upvote
0
I'm an advocate for cloud solutions, so where possible I would suggest hosting your data and applications with a cloud provider and let them look after cyber security i.e. having nothing on site or on PCs, then if you get attacked or hacked the risk is lessened (although you still need to be vigilant in protecting access to your cloud services). Look for providers with ISO27001 certification. Ideally go for one's in the UK that will let you visit their data centres so you can see where your data is kept and the security around it.
Upvote
0
If you are talking for an website / application or online game what you should do is to host your project with provider who will can provide you speed,security and stability.
What you should be looking for is DDOS protection with high capacity .
Also avoid shared hosting and go for linux based VPS or Dedicated server.
I'm not aware of any serious and secure hosting provider with privacy protection who would let you to walk free inside their data centers. On our datacenter the only one who can access it is our staff members. If the datacenter let you to walk in then the whole idea behind security and privacy is gone.
What you should be looking for is DDOS protection with high capacity .
Also avoid shared hosting and go for linux based VPS or Dedicated server.
I'm not aware of any serious and secure hosting provider with privacy protection who would let you to walk free inside their data centers. On our datacenter the only one who can access it is our staff members. If the datacenter let you to walk in then the whole idea behind security and privacy is gone.
Upvote
0
As a little contrast to a list of security technologies...
You can spend all day and all night forever looking at different technical lock-downs and measures to take, but it's often looking at the problem with the wrong end of the telescope once you're past the basics.
My advice is:
1) Work out what risks you're concerned about.
2) To do 1) you need to have a think about what information and services you need to protect.
3) To to 2) you'll need to think about why you want or need to protect these things - e.g. because you need them to run your business, the law requires it, the risk of reputational damage etc.
4) Prioritise the risks (often it can be helpful to use a scoring system which might look something like Risk Level x Impact = Score. Risk Level is how likely (e.g. 1-5) the risk is to happen and Impact is how big a deal it is if it happens (again, say 1-5).
You can look up risk assessment if you want and make it more complex, but in a nutshell this will do and you're just trying to get some perspective on what to worry about most and crucially, where you should spend money.
This may sound like a massive faff compared to asking for some recommendations and doing the ones like the sound of, but it changes it from being a technical problem to a business one.
If you don't do something like the above, you can spend fortunes and still miss the most important things.
Simplifying a little...
Things like Cyberessentials bundle up basic security measures that the majority of businesses should consider and essential security knowledge. It's an attempt to simplify doing something about security. Worthwhile if you don't know where to start, but don't get a false sense of....well, you know.
When you go through the steps set out above, consider a broad set of risks because when the stuff hits the fan, it doesn't matter whether it was some super clever DDoS attack from the other side of the world or the cleaner unplugging your server, the impact's the same.
Other advantages of the approach I recommend:
a) If you go through the above, you should be in a much better position to determine how much time and money to throw at the problem. On the one hand it will always be tempting to think that it's money spent on nothing (like insurance right
?) On the other hand there will be plenty of security specialists who will give all sorts of dire warnings about how you need to do everything under the Sun. Neither's right unless tailored to your business (and the stage of your business).
b) You may work out that you have enough valuable information and services at risk that you want to get some paid help form a specialist to help with some of the assessment above and selection of security measures.
c) You'll need to consider the non-technical risks before getting to technical "solutions" e.g. employees/contractors accessing customer data not just external cyber attack.
d) You may be able to find a non-technical workarounds before you get to technical "solutions". - e.g. a (now trivial) example would be with credit card data - many ecommerce businesses now avoid the risk of holding credit card data altogether by using a payment processor. Another would be staff background checking and limiting access to data.
None of the above is meant to suggest that technical solutions for security are no good or not needed. There is a whole industry for security products and services whose marketing puts these uppermost in our minds. The reality is that addressing security in a business-like and effective fashion is about more than checklists.
You can spend all day and all night forever looking at different technical lock-downs and measures to take, but it's often looking at the problem with the wrong end of the telescope once you're past the basics.
My advice is:
1) Work out what risks you're concerned about.
2) To do 1) you need to have a think about what information and services you need to protect.
3) To to 2) you'll need to think about why you want or need to protect these things - e.g. because you need them to run your business, the law requires it, the risk of reputational damage etc.
4) Prioritise the risks (often it can be helpful to use a scoring system which might look something like Risk Level x Impact = Score. Risk Level is how likely (e.g. 1-5) the risk is to happen and Impact is how big a deal it is if it happens (again, say 1-5).
You can look up risk assessment if you want and make it more complex, but in a nutshell this will do and you're just trying to get some perspective on what to worry about most and crucially, where you should spend money.
This may sound like a massive faff compared to asking for some recommendations and doing the ones like the sound of, but it changes it from being a technical problem to a business one.
If you don't do something like the above, you can spend fortunes and still miss the most important things.
Simplifying a little...
Things like Cyberessentials bundle up basic security measures that the majority of businesses should consider and essential security knowledge. It's an attempt to simplify doing something about security. Worthwhile if you don't know where to start, but don't get a false sense of....well, you know.
When you go through the steps set out above, consider a broad set of risks because when the stuff hits the fan, it doesn't matter whether it was some super clever DDoS attack from the other side of the world or the cleaner unplugging your server, the impact's the same.
Other advantages of the approach I recommend:
a) If you go through the above, you should be in a much better position to determine how much time and money to throw at the problem. On the one hand it will always be tempting to think that it's money spent on nothing (like insurance right
?) On the other hand there will be plenty of security specialists who will give all sorts of dire warnings about how you need to do everything under the Sun. Neither's right unless tailored to your business (and the stage of your business).b) You may work out that you have enough valuable information and services at risk that you want to get some paid help form a specialist to help with some of the assessment above and selection of security measures.
c) You'll need to consider the non-technical risks before getting to technical "solutions" e.g. employees/contractors accessing customer data not just external cyber attack.
d) You may be able to find a non-technical workarounds before you get to technical "solutions". - e.g. a (now trivial) example would be with credit card data - many ecommerce businesses now avoid the risk of holding credit card data altogether by using a payment processor. Another would be staff background checking and limiting access to data.
None of the above is meant to suggest that technical solutions for security are no good or not needed. There is a whole industry for security products and services whose marketing puts these uppermost in our minds. The reality is that addressing security in a business-like and effective fashion is about more than checklists.
Upvote
0
Backup. Backup. Oh, did I say backup? And a recovery plan.
And updates.
Any measures someone takes will slow down an attack and maybe avoid simple attacks, but IT security (generally speaking - either network, data, website, app server, internal app etc) can't be bulletproofed (due to several reasons, including "social" ones).
In any event, it is important to know how fast can you react into isolating the "trouble", identifying the source/fixing the entry point(if it can be done) and then recover. After recovery, there might be some other steps needed (for example, in case of a databreach). But al; depends on the business type, as there isn't a for-all-cases recipe.
And updates.
Any measures someone takes will slow down an attack and maybe avoid simple attacks, but IT security (generally speaking - either network, data, website, app server, internal app etc) can't be bulletproofed (due to several reasons, including "social" ones).
In any event, it is important to know how fast can you react into isolating the "trouble", identifying the source/fixing the entry point(if it can be done) and then recover. After recovery, there might be some other steps needed (for example, in case of a databreach). But al; depends on the business type, as there isn't a for-all-cases recipe.
Upvote
0
Latest Articles
-
MTD for Income Tax: your first quarterly update is due 7 August.If you are a sole trader or landlord and your gross income from...- maka
- Updated:
-
Andy Burnham's Manifesto for Small Business, and How It Stacks Up Against Count BinfaceIf all goes to plan (or rather, to Labour's timetable), Andy Burnham...- Ozzy
- Updated:
-
SEO in the Age of AI: What UK Small Businesses Actually Need to KnowTL;DR Search has shifted from "ten blue links" to answer engines, and...
- Ozzy
- Updated:
-
What Carphone Warehouse, Microsoft and Uber Have in Common: They Started in a DownturnThere's a comforting myth that you need a booming economy to start...
- Ozzy
- Updated:
-
What Makes a Small Business Actually Sellable?There's a question that a lot of small business owners never think to...
- Ozzy
- Updated: