Poorly administrated technologies can threaten a firm’s survival
Modern technologies bring convenience and speed. But they also involve serious risks that don’t exist in the analogue world.
Previously we’d write a memo or send a letter and wait for a response. Now, someone on the other side of the planet can access information in milliseconds, including that which a business considers critically important if not confidential. Worse, a malevolent trouble maker can cause chaos from afar with a key stroke.
And there are plenty of examples.
Between July 2017 and April 2018, Dixons Carphone saw 14 million personal records and 5.6 million payment card data hacked. The company took a year to start dribbling out information about the attack. The Information Commissioners Office (ICO) subsequently levied a £500,000 fine.
In March 2020, the personal data of 900,000 Virgin Media customers was stolen and made publicly accessible for some ten months. Following the incident, Virgin Media reportedly faced a class-action lawsuit of nearly £4.5bn.
So, how vulnerable are firms? What can they do to protect themselves? Importantly, do Small and Medium-Sized Enterprises (SMEs) realise they’re an easier target than big corporates?
David Baskerville, head of IT at law firm Wright Hassall LLP, sees multiple angles of attack from ‘technical’ vulnerabilities such as direct hacks and physical data theft, as well as ‘human’ from the likes of phishing and ‘grooming’ of staff to hand over data and passwords.
Baskerville knows that hackers exploit technical vulnerabilities regularly and considers ‘zero-day’ attacks – flaws that are known but not yet patched – the most significant risk.
He says: “Most firms undertake security patching every couple of weeks, which is seen as good practice, but this may not be enough. The largest risk remains the human element, both in terms of users falling for increasingly authentic ‘whaling’ attacks (a targeted attack on high profile staff or company owners) and the swiftness with which hackers adapt to new security protections.” He gives the example of QR codes, which were meant to make systems secure. However, they are now the top way in which hackers gain entry to systems.
But beyond this, Baskerville argues that the largest risk firms now face is understanding the supply chain they use for their IT and what risks those suppliers bring.
He says: “Often businesses think they are secure because they have moved to the cloud or outsourced to security experts. But this is simply not the case. For example, recently, there was a situation where CTS, a well-known managed service provider to law firms, had a security breach. CTS failed to patch its security systems, leading to outages for hundreds of law firms. This issue was so significant that it hit the national news because of the number of conveyancing transactions that could not be completed. It took several months for some of those firms to be fully operational again.
To this, Baskerville adds: “There have also been other occasions where, due to the action of a single engineer not following the correct process, firms using cloud-based solutions have been subjected to data loss or outage.” The July 2024 outage caused by CloudStrike, which caused 8.5 million Windows PCs to ‘blue screen’ and required manual restoration, illustrates this.
As to preventative measures, Baskerville believes that “technical solutions can certainly help, and security precautions, such as two-factor authentication, drive encryption, and auto-screen locking, are an absolute must.” He also thinks firms “should use layers of protection rather than be reliant on one security tool or provider as well as controlling physical access and regularly training staff on the emerging threats and social engineering.”
When it comes to site security, Baskerville is of the view that firms are far too lax: “Whilst most undertake external penetration tests, very few take that a step further and go to a site security audit. It is very often the case that it is scarily easy to gain access to offices.” He notes that gaining access to the server room is normally harder, but “once you have access to the building, it is not too difficult to plug in devices to the network or into the USB of PCs.”
He worries that even firms that have security desks and provide badges tend to be “laxer when visitors, especially regular ones, are on the premises.” He cites the case of cleaners operating in a business who were paid to plug in USB keys into PCs that contained software to capture activity.
Consequently, Baskerville strongly advises that all visitors are provided with badges and escorted. He also recommends that computers make use of systems which encrypt the data stored on their drives and should all auto-lock screens. Further, laptops should have Mobile Device Management and ideally use biometric logins.
And where paper is involved, Baskerville sees no substitute for a clean desk policy and ensuring that confidential information is stored in lockable cabinets and drawers when not needed.
If a breach occurs, Baskerville advises being “completely honest and disclosing as much information as you can regarding the cause of the problem and the steps you have taken to mitigate the situation.”
He comments that dealing with the Information Commissioner’s Office (ICO) or the fraud office can be daunting. However, he says: “If you have followed good practice in the selection and implementation of your technology, then firms don’t need to be overly worried about the ICO.” The ICO, he believes, only come down hard on firms that have blatantly disregarded good practice.
Ultimately, Baskerville highly counsels management to role-play a critical cyber event at least once a year; the response must be reviewed and ready at a moment’s notice.
Summary
There’s no two ways about it, as the world becomes ever more digital, the malicious human mind finds new ways to abuse systems that are ordinarily meant to be productive.
For those on the right side of the law it’s a perpetual game of catchup. Firms, regardless of the sector that they’re in, need to continually invest and train staff to stay on top. Good advice here is not just essential… it’s critical.
National Cyber Security Centre
Deputy director for Economy and Society Sarah Lyons, thinks that “it’s crucial all organisations stay alert to the risks they face online and put appropriate security measures in place, from technical controls to cyber awareness training for staff.”
She details that practical guidance, and free services are available on the NCSC website to help “improve cyber resilience, and we strongly encourage businesses to engage with these resources to help realise the benefits of digital technology securely.”
In particular, there’s the Small Business Guide: Cyber Security, which provides an overview of steps that can significantly reduce the chances of businesses becoming victims; the Cyber Security Small Business Guide Actions, a checklist for firms wanting to bolster their defences; and Secure design principles, guidance on creating secure-by-design systems.
Lyons also highlights the NCSC’s Cyber Essentials scheme, which provides simple and effective advice for organisations on mitigating the most common cyber-attacks.