WANNACRY and ransomware will be the talk of boardrooms and management meetings this week.
The virus, which affected the NHS in Scotland and England, went global – and led to a clamour for IT systems to be reviewed.
However, cyber security should constantly be on the agenda – not only when it’s highlighted in the media.
This is an issue that is not going to go away: 33% of small businesses and 65% of large businesses reported a cyber breach or attack in the past 12 months. The result is a financial hit, disruption to everyday operations and reduced confidence in IT infrastructure.
There are a number of steps that can be taken to ensure companies are primed to defend themselves from attack.
Software updates
The risk of being infected can be reduced by ensuring patches and updates are installed as they are released by software firms.
It sounds obvious, however, some firms wait to see if there are any issues with an update, or the process is not in place for these updates to be made. Delaying updates creates a potential risk.
Shut the door
It’s important to disable any unnecessary protocols. If an update has been made to a protocol, then businesses must ask if there is still a need for previous version of the protocol to exist.
WannaCry exploited vulnerability in Microsoft’s SMBv1 protocol which should be disabled if no longer used. It’s good housekeeping to ensure that all unnecessary protocols are removed or blocked.
Who’s on your network?
Your suppliers or project partners may have access to your network. Again, ensure that the right people have the right level of access. This should also be monitored to check for any discrepancies or unusual activity.
Failure to have authentication mechanisms in place can leave you exposed. For example, your guest wi-fi must be kept separate from your business network.
Follow the rules
Staff should not – under any circumstances – transfer files to or from a personal USB stick. It may be the case that some people find it easier to work with files between their work and personal computer but it’s a bad practice that can have severe consequences.
Your IT team, or partner, should be made aware of any hardware or software requirements.
Think twice
Companies should have a cyber policy – and strategy – in place. If you work in a department that’s unlikely to be sent an invoice then think twice before opening such an attachment.
Anything out of the ordinary should be reviewed. Any issues or doubts, highlight them to IT. Vigilant employees have a key role to play here.
Smart monitoring
This is perhaps the fastest growing area in the networks and communications sector. The capability to spot trends or discrepancies to your network profile can lead to potential threats being identified early.
Erratic behaviour will be highlighted and action can be taken. This level of networking monitoring would likely involve engaging with an organisation specialising in network security.
Solid foundations
The setting up of a robust networks and communications infrastructure can lead to better security measures further down the line.
For example, a smart network set-up may mean issues can be isolated – put in a ‘sandbox’ – allowing other parts of the business to continue to flow, while suspect devices or systems are analysed.
Check, check and check again
Smart organisations will be constantly reviewing IT functions from traditional support and cloud-based solutions to their networks and communications infrastructure.
An external review by a reputable networks and communications specialist to look for gaps or potential issues is worth considering – the saving in the long run could make a world of difference.
Emergency response
Finally, despite your firm’s best efforts, you fall victim to a virus. What are the processes and procedures to ensure business continuity?
Who is doing what, where, when, how and why? What is your 24/7 support strategy? How will you restore systems from back-ups? Make sure robust processes are in place to ensure incidents are managed and resolved swiftly.