YOUR BUSINESS SPRING 2019 - 169

Cybersecurity

o business can
afford to ignore
cybersecurity. IT
and the internet are
so all-pervading -
and the number of
threats they enable
so high - that doing
business without a cybersecurity
policy is like operating a bank with no
security guards, no locks on the doors
and no safe - in a town inhabited
by millions of potential thieves.
Traditionally, the perceived high cost
of information security has proven to
be a barrier. However, SMEs should
focus on the potential costs of doing
nothing - which can be so high as to
destroy the company entirely - as well
as feeling reassured that a great deal
can be done at little or no cost simply
by maximising awareness among staff
and adhering to sensible policies.

Recognise the problem

The first step is to be aware of the
scale of the problem. Cybercrime is
not limited to large-scale hacking. Any
company storing and/or using valuable
data - which includes almost any
type of data - is at risk from criminals
breaking into its systems and stealing
that data, either for their own purposes
or for sale on the black market.
A desire to steal isn't the only reason
a criminal gang may set its sights
on your business. Cybercriminals
working on behalf of your competitors,
or anybody with a grudge, could
be paid to break into your systems
and wreak havoc, by changing or
deleting key data, for example, or by
preventing your customers accessing
your organisation's website.
You may think your business is
too small to attract cybercriminals
but smaller companies are often less
well resourced and easier to attack.

Research your strategy

Once you've familiarised yourself
with the nature and scope of the
cybersecurity problem you're facing,
you need to formulate an appropriate
approach to fix it. It's common
to assume a cure-all technology
solution exists. However, while

technology can help, it isn't a panacea.
Technical controls should be used to
support the policies and procedures
you've developed in response to
the results of your information
risk management methodology.
Start by conducting a full audit of
your system to identify where any
sensitive data is stored, processed and
transmitted. Public-facing applications
such as social media should be a focus,
as these can provide a route to your
internal network. Think seriously
about deploying a web application
firewall to defend against attacks that
could overwhelm you and leave you
vulnerable to further infiltrations.

Inform your staff

The simplest - and cheapest - way
to protect yourself from cybercrime
is to make sure that the behaviour

of you and your team minimises
opportunities for attack. A staggering
proportion of such crimes are
facilitated by human error, be it an
employee clicking on a link sent as
part of a phishing attack, someone
losing a data-drenched flash drive
or passwords being leaked. Some
even occur by design. How sure are
you that your staff aren't colluding
with criminals for their own gain?
Several high-profile cybercrimes have
originated within the organisation.
When your staff understand
the value of information security
and the steps it is necessary to
take in order to safeguard your
SME's information, you'll find your
workforce's entire approach and
attitudes change. Soon reducing
cybercrime will become embedded
within your organisation's culture.

Make sure your mail is safe

Lenny Wood from Frama UK explains how to protect communications
Whether you're a recruitment firm,
accountancy firm or lifestyle coach,
chances are your emails contain your
clients' private information. Emails
are similar to sending a postcard
written in pencil - the data can be
intercepted and altered along its
journey by anyone with a small
amount of experience in hacking.
It makes sense to ensure such data
is kept from prying eyes, not only
to be GDPR compliant but to also
maintain credibility with your clients.
Common misconceptions around
the use of standard emails include:
1 A READ RECEIPT IS PROOF OF
DELIVERY These are easily forged
and are legally meaningless.
2 STORING EVERYTHING IN
THE SENT FOLDER PROTECTS
YOU These emails aren't legally
verifiable and can easily be edited.
3 A PRINTED EMAIL CAN BE
USED AS EVIDENCE IN A LEGAL
TRIAL Printed emails are denied

admission into evidence on the
basis of content authenticity.
4 AN EMAIL IS DELIVERED UNLESS
A BOUNCE BACK MESSAGE IS
RECEIVED There are many reasons
an email may not be delivered and
not all produce a bounce notice.
If an email being sent contains any
personal or sensitive information
and is compromised, resulting in
a data breach, it will be deemed
as a contravention of new data
protection legislation (GDPR)
and can lead to fines of up to
€20m or 4% of global turnover.
There are plug-ins available to
reduce this risk. Frama provides one
that is simple to install and can be
added to a company's current email
client. An button is added that is
clicked if the information needs to
be sent securely. And it's still easy
for the recipient to open the email
- they don't have to sign up to any
third-party web applications, log in
or download additional software.

169
YOUR BUSINESS SPRING 2019

Table of Contents for the Digital Edition of YOUR BUSINESS SPRING 2019
