Introduction
Hopefully, over the course of this module, you will have realised that its difficult to give a "set of rules" for security. The threat landscape is continuously, and the types of vulnerability you will be exposed to change over time. However, understanding why cyber vulnerabilities happen does offer some protection. Keeping up to date with the latest trends in security can also help you be aware of potential threats.
This week we look at some general ways of protecting both yourself, and organisations from cyber attack.
Increasing Companies Resilience to attack
The Governments National Cyber Security Centre (NCSC) https://www.ncsc.gov.uk/, offers advice on Cyber security for both Organisations and Individuals. There are Guides available on the NCSC website on a wide range of security topics.
When it comes to an organisations security, a great place to start is the NCSC's Board toolkit https://www.ncsc.gov.uk/collection/board-toolkit this offers up to date security advice from GCHQ. Some other suggestions for cyber resilience are:
The first is to make sure you have some!, we saw earlier in the course that even large organisations have no spend on cyber security. Not taking care of the security of your systems means you are exposing yourself to danger.
One step you can take here is to make use of a professional penetration testing company to assess the security of your infrastructure. The companies employ hackers to attack your system, and provide an assessment of the risk. While a large organisation may have In-House security teams, it can also be worthwhile getting a second opinion.
Organisations like OWASP also offer tools to check the security of websites, that you can run in-house https://www.owasp.org/index.php/Appendix_A:_Testing_Tools. These are not a substitute for professional testing, but can give some indication of major risks.
Raising staff awareness of the threats is also needed. As we saw earlier, a large number of data breaches happen through social engineering and phishing. Having your staff aware of these problems means that they are less likely to accidental "click that link". CPD courses on cyber security are a good start, and it is worth looking at the Cyber Essentials course, from NCSC. https://www.cyberessentials.ncsc.gov.uk/
Finally, you should consider that, security is hard. While we can take every piece of advice, there can be little protection against a determined hacker or zero day vulnerability. However, having a high level of security in your business can make you a less tempting target. Considering the limitations hardware in your system is also important. While Firewalls, and antivirus systems can help, there is no "Magic Bullet" for cyber problems. Having a incident response and recovery plan, will help protect you if the worst happens.
Links
https://www.ncsc.gov.uk/ https://www.cyberessentials.ncsc.gov.uk/ https://www.ncsc.gov.uk/collection/board-toolkit