The average cost of a cyber security breach for a UK business is £19,400*. Businesses that aren’t prepared or protected not only suffer a massive financial hit but are also affected in other significant ways too, including:

• Business interruption

• Loss of productivity

• Reputation damage

• Stress and low morale

38% of UK businesses identified a cyber attack in the last 12 months, with 82% of these businesses reporting phishing attempts and 25% identifying a more sophisticated attack type such as a denial of service, malware or ransomware attack.

How can you protect your business from a costly cyber security breach? Read on to find out. We break down and analyse the steps you need to take to minimise the ever-present online threats to your business.

* HMRC Cyber Security Breaches Survey 2022

Risk: Password breach

What is it?

Passwords have been our primary method of securing devices and online accounts for decades. Even in today’s world of biometrics, password managers, and 2FA (Two Factor Authentication), passwords are a major vulnerability in the systems and websites that cybercriminals target.

An attack on your systems through a weak password could paralyse your entire network and result in significant data loss. 

How can you protect your business?

Password security is a critical factor in protecting your business against cybercrime. In addition to the common sense steps of avoiding passwords that are easy to guess, there are some essential steps to take so passwords aren’t a weak point in your IT security:

• Enforce 2FA or Multi-Factor Authentication (MFA) wherever possible
• Invest in a company-wide password management solution
• Enable Single Sign-On (SSO) wherever possible
• Make it easy for people to escalate issues (phishing emails and compromised website accounts)
• Provide training and regular reminders about password best practices

Risk: Unauthorised system access

What is it?

Unauthorised system access is when a person gains entry to a computer network, system, application software, data, or other IT resource without permission.

Any access to an information system or network that violates your security policy is considered unauthorised access. Unauthorised access is usually a result of one or more of these weak points in a company’s IT security:

• weak passwords that are easily guessed or hacked
• sophisticated social engineering schemes like phishing (tricking authorised users into exposing credentials)
• compromised accounts that have been hacked and taken over
• unauthorised physical access to a building 

How can you protect your business?

Preventing unauthorised system access requires a coordinated approach across your entire IT structure:

• Have a strong password policy in place
• Use Multi-Factor Authentication (MFA)
• Keep security patches up to date
• Stay on top of physical security (locking devices and doors)

Your IT security provider can help you catch and stop unauthorised access to your systems with dedicated professional services like zero-day anti-virus and endpoint detection and response.

Risk: Ransomware

What is it?

Ransomware is a type of malware (malicious software) that prevents you or your staff from accessing your computer or the data that’s stored on it. As a result, the computer may become locked, or the data on it might be stolen, deleted or encrypted so it can be held for ransom.

Imagine if your business-critical files, documents, networks or servers are suddenly encrypted and completely inaccessible. Not a pleasant scenario. Even worse if you must pay a considerable sum of money to cybercriminals to get access again.

Protecting against ransomware is a crucial aspect of business continuity – the planning and preparation that keeps you operational in the face of otherwise devastating issues like ransomware.

How can you protect your business?

Staying one step ahead in today’s threat landscape requires an awareness of emerging attack strategies and taking appropriate steps to provide an adequate defence.

Managed backups

You can protect your business against unknown risks with frequent backups of your entire business infrastructure, including files and applications on local servers, end-user endpoints, and in SaaS applications.

Backups should always be heavily encrypted and stored offsite for additional security and protection against access to your premises.

Asset management

You need to know what devices are being used across your business and their status in terms of their age, version number, usage, and when they were last updated.

An asset management service gives you a framework to document and manage the lifecycle of each IT asset throughout its lifespan. It’s impossible to adequately protect your devices and systems against cyber threats without an accurate and up-to-date hardware and software inventory.

Patch management

A patch is a set of changes to a computer program, app, or its supporting data designed to update, fix, or improve it. This includes fixing security vulnerabilities that criminals can exploit to infect a machine or even entire networks.

Patch management automates this process as much as possible, providing alerts when a patch becomes available and deploying it in a fast but controlled manner to vulnerable systems or devices.

Firewall

Attackers target centralised resources like major on-premise systems because this is where the most valuable information is stored. A firewall protects all of your central applications by monitoring and filtering incoming and outgoing network traffic.

Vulnerability management process

Vulnerability management means staying on top of the actions that will remove any vulnerabilities from your IT systems. It means taking steps like these:

• enabling automatic updates
• monitoring the status of devices
• vulnerability scanning

Risk: Mobile device vulnerabilities

What is it?

A pattern caused by the COVID-19 pandemic was a significant increase in mobile device usage. Not only do remote users rely more heavily on mobile devices for accessing websites, communicating, and using apps, but there has also been a large-scale adoption of mobile wallets and touchless payment technology.

According to Check Point Software’s Mobile Security Report, over the course of 2021, 46% of companies experienced a security incident involving a malicious mobile application downloaded by an employee.

A larger population of users presents a larger target for cybercriminals, who have also begun to target Mobile Device Management systems. Ironically, these systems are designed to enable companies to manage devices and keep business data secure. Yet they have become a weak point in mobile IT security.

How can you protect your business?

Your business needs an effective mobile threat defence solution to help detect and respond to a wide range of attacks. This will give you an accurate view of all mobile devices and apps used across your business to ensure they are up-to-date, protected and used appropriately.

Solution: Disaster recovery

What is it?

Only 19% of UK businesses have a formal incident response plan, according to the 2022 HMRC Cyber Security Breaches Survey. This is a shocking statistic when we consider that attacks on IT systems are incredibly persistent.

31% of businesses and 26% of charities estimate they were attacked at least once a week.

When disaster strikes and your IT systems have been attacked, and you may have lost data, what is your plan for limiting the damage and recovering from the attack? How can you safely recover lost data, assuming you are confident your backup is also uncompromised and accurate?

The fact that you’re reading this article means you are concerned about your IT security and ready to take action. Statistically, you are already ahead of some of your competition.

How does it protect your business?

You need a bullet-proof backup and recovery solution for when the worst-case scenario becomes a challenging reality. This solution takes the form of a pre-planned list of actions to back up and restore your critical data without any loss when there has been a security breach incident resulting in data loss.

Ensuring your business has a Disaster Recovery facility in place ensures you can recover from major issues rapidly and without data loss, helping you to get back to business as usual with minimal downtime.

You must put your recovery plan to the test by undertaking a full system restore. This ensures your backup and recovery process is actually going to work if the time comes!

You can outsource your disaster recovery to a trusted IT partner who can provide regular disaster recovery testing and preventative maintenance. This type of service is called Disaster Recovery as a Service (DRaaS). 

DRaaS offers scalable storage options, secure data protection, and rapid recovery times should something happen, as well as technical support and advice in an emergency. Not to mention considerable peace of mind knowing there’s a plan in place if the worst happens.

Solution: Cyber security training

What is it?

Cyber security training provides information about common security threats and explains the steps that should be taken to secure devices against those threats. This kind of training usually covers topics like:

• Password security
• Identifying suspicious links in emails, texts and on social media
• Using public WiFi safely
• Safe web browsing
• Safe file sharing
• Online meeting security and privacy

The goal is to empower your staff to be your first line of defence – sometimes known as the human firewall.

How does it protect your business?

Your business requires a policy ensuring comprehensive cybersecurity awareness training is mandatory for all staff members. This training should also be part of the onboarding process for new staff.

Cyber security training helps employees understand IT security risks and recognise when an attack is underway.

Many IT support businesses offer cyber security training packages, including RAD IT. Your business can also join the government-backed scheme, Cyber Essentials. This scheme is designed to help organisations of all sizes and sectors protect themselves against common online threats.

Get the IT security protection your business needs

To be fully confident that your business is protected from cyber security breaches, you need to contact the IT security protection experts from the RAD Group.

From our 24/7 IT management and support service to our data backup and recovery and enterprise-level security services, we have the solutions to protect your business against the cyber threats it faces today and in the future.