<div dir="ltr"><a href="http://www.telegraph.co.uk/connect/small-business/tech/easy-ways-to-protect-your-business-from-cyber-attacks/">http://www.telegraph.co.uk/connect/small-business/tech/easy-ways-to-protect-your-business-from-cyber-attacks/</a><br><p><span class="gmail-m_first-letter">U</span>nlike larger companies,
small businesses often operate without dedicated IT professionals, and
rarely regard themselves as attractive targets for cyber attacks. But
this very attitude, and the knock-on effect of being left undefended, is
precisely what may make them tempting to hackers.</p>
<p>Duncan Sutcliffe, director of <a href="http://www.sutcliffeinsurance.co.uk/" target="_blank" rel="nofollow">Sutcliffe Insurance Brokers</a> didn’t
know where to start when it came to protecting his firm. “Like many
SMEs, we have no in-house IT expertise and were faced with a vast array
of confusing and sometimes contradictory advice," he says, "We didn’t
know where to start. We found cyber security so out of our comfort zone
that it was tempting to just ignore the issue."</p>
<p>Mr Sutcliffe is not alone in trying to put off the issue. According to the <a href="http://www.experian.co.uk/assets/identity-and-fraud/smes-under-threat.pdf" target="_blank">Experian data breach preparedness study</a>, 51pc of UK SMEs do not see cyber security as a priority.</p>
<div class="gmail-htmlEmbed gmail-section"><div class="gmail-html-embed gmail-component">
<div class="gmail-component-content">
<div class="gmail-quote gmail-section"><div class="gmail-quote gmail-component"><div class="gmail-component-content"><q class="gmail-quote__content">Guarding against spam and phishing emails is key to mitigating the risk of ransomware attacks </q><span class="gmail-quote__author">Vince Warrington, Protective Intelligence</span></div></div></div>
</div>
</div>
</div>
<p>But the consequences of an attack can be severe. An assault
on a business's IT systems, infrastructure or devices could mean the
difference between staying afloat or going under, especially if
reputational damage results in losing trade, or it faces legal
consequences.</p>
<p>With <a href="http://www.pwc.co.uk/assets/pdf/2015-isbs-technical-report-blue-digital.pdf" target="_blank">38pc of UK SMEs having</a> experienced an attack in the past year, ignoring the issue is no longer an option.</p>
<h3>Guard against email spam</h3>
<p>A <a href="http://www.telegraph.co.uk/connect/small-business/business-solutions/how-to-improve-your-cybersecurity/">major threat</a> to
SMEs are ransomware attacks – malicious software that locks a device,
such as a computer, tablet or smartphone, and then demands a ransom to
unlock it. “Guarding against spam and <a href="http://www.telegraph.co.uk/connect/small-business/business-solutions/what-is-email-security-and-how-can-SMEs-get-it-right/">phishing emails</a> is
key to mitigating the risk of these attacks, and to achieve this, you
need to use a blend of technical and educational solutions,” explains
Vince Warrington, founder of information security company, <a rel="nofollow" href="http://www.protectiveintelligence.co.uk/" target="_blank">Protective Intelligence</a>.</p>
<p>Ransomware is reliant on an end user activating it, usually
by opening an infected email attachment, so educating staff who can
expect attachments on a daily basis, such as finance and HR teams, is
vital. They should be encouraged to have a healthy scepticism by
questioning who or where emails come from.</p>
<p>On the technological side of things, a disaster recovery
plan should be in place, outlining what to do in the event of an attack.
“There’s nothing quite so devastating for your business as finding out
that you’ve become a victim of ransomware, only to discover that your
backups are so old – or non-existent – that you can no longer operate,”
he says.</p>
<p>Having effective backups of data on an external hard drive
or cloud-based service – or both, ideally – are useful, but shouldn't be
your only line of defence.</p>
<h3>Have a strong response plan</h3>
<p>For some, taking an active leadership role is an important
way to protect yourself from an attack. Matt Middleton-Leal, the
regional director of UK and Ireland at security software company, <a href="https://www.cyberark.com/" target="_blank" rel="nofollow">CyberArk</a>,
says that in the absence of IT specialists, it’s up to SME leaders to
determine an effective cause of action in the event of an attack, and
educate staff to prepare for them.</p>
<div class="gmail-htmlEmbed gmail-section"><div class="gmail-html-embed gmail-component">
<div class="gmail-component-content">
<div class="gmail-quote gmail-section"><div class="gmail-quote gmail-component"><div class="gmail-component-content"><q class="gmail-quote__content">Ensuring that security is a priority begins during staff induction</q><span class="gmail-quote__author">Ryan McGrath, Echo</span></div></div></div>
</div>
</div>
</div>
<p>The main way business leaders can do this is through
preparation. “This means having a strong cyber security response plan
that clearly defines roles and responsibilities, and outlines how data
can be recovered quickly in the wake of an attack,” he says.</p>
<p>By regularly testing these plans through live drills, and
updating them as needed, this will help prevent company paralysis when
an incident occurs. Further assistance for SMEs can be found in the <a href="https://www.gov.uk/government/publications/cyber-risk-management-a-board-level-responsibility/10-steps-summary" target="_blank">UK Government’s 10 Steps to Cybersecurity</a>.</p>
<p>Taking a proactive approach to cyber security means that
small businesses will be able to make better and faster decisions in
crisis mode, build trust from customers, and be in the best position for
long-term growth, explains Mr Middleton-Leal.</p>
<h3>Educate your staff on their responsibility</h3>
<p>Data is far too important to be interfered with, especially
when it’s extremely sensitive. The health tech industry is held to a
higher standard than others when it comes to protecting patient data, so
they have to invest heavily in security, says Ryan McGrath, development
operations and security lead at free prescription management app, <a href="https://www.echo.co.uk/" target="_blank" rel="nofollow">Echo</a>.</p>
<p>“Our main challenge in 2017 is maintaining a culture of
security while meeting operational requirements. This means ensuring
that security is at the heart of everything we do,” he explains.</p>
<p>A critical part of that is employee education. “<a href="http://www.telegraph.co.uk/connect/small-business/tech/pc-world/basic-sme-tech-guide/">Ensuring that security is a priority</a> begins
during staff induction," says Mr McGrat. "People are reminded of their
responsibility under the data protection act, and we share personal
experiences – as patients and employees – from previous companies. We
also talk about major data breaches in the press."</p>
<p>Reinforcing employment contracts is done by reminding staff of their responsibility to the company's <a href="https://www.echo.co.uk/blog/echo-patient-charter" target="_blank" rel="nofollow">patient charter</a>.
This is done by ensuring two-factor authentication as much as possible
across devices and minimising access to data. “For example, our chief
executive can't access Echo patient information. All requests for data
must be justified and approved on a time-bound basis,” he adds.</p><br></div>