According to UK Government statistics, four in ten businesses suffered from either cyber security breaches or attacks from March 2019 to March 2020. Medium-sized businesses were the worst hit, with 65% of attacks being targeted at them. So what’s to be done?

We’re not here to frighten, just to say that having a robust cyber security strategy in place is vitally important when operating a well-performing, profitable business. Plus, it’s really not all doom and gloom. While criminals are getting more cyber-savvy, so too are people in general. 

Now more than ever, businesses are shoring up their digital defences, becoming more secure as they move key internal processes onto cloud-based services. So what exactly does a cyber security strategy need in order to work in today’s business environment? 

• The Business Case for Cyber Security
• Assessing Your Cyber Security
• What Does a Cyber Security Strategy Need?

The Business Case for Cyber Security

The cost of cyber security is expected to exceed $1 trillion globally by the end of 2021. That’s a very significant investment. 

However, what if we told you it was an investment well worth being made? In the past, business leaders have eschewed proper cyber security because there was no proof of value in things that didn’t happen. Essentially, if the cyber security software worked, there was no way to show how much had been saved because nothing had been lost. Effective prevention is a hard thing to make tangible if it’s doing its job right. 

However, studies have now shown that the economic value of preventing a cyber attack can range anywhere from £287,000 up to £994,000. These kinds of figures are more attributed to larger businesses that have more at risk. However, with the average cost of a cyber security breach in the UK for medium to large businesses being £3,930 per breach, the costs and loss of productivity can soon add up. 

So really, while ROI is hard to prove, it makes perfect business sense to start investing in proper cyber security as soon as possible. 

Assessing Your Cyber Security

Did you know that 49% of UK companies experience a cyber breach at least once a month? There’s also a minority (7%), who experience breaches several times a day.

What these statistics tell us is that many businesses across the UK need to audit their current cyber security efforts. They can do this themselves by selecting a framework, such as the NIST Cybersecurity Framework, and assess through different categories how robust a current strategy is. 

You can use a framework like this to plan for the future, determining where your business could be within the next five years, according to the findings within each category. For example, if you’re particularly struggling with ransomware, developing upon backup and recovery capabilities will be key. 

You can also work with an experienced cyber security specialist who can inspect your systems and determine the risks you’re facing, as well as advising on the necessary solutions that help keep your business secure, such as breach simulations, expert threat detection and rapid remediation.  

On top of this, you’ll need to consider onboarding the tools and commitments that any robust cyber security strategy needs. 

What Does a Cyber Security Strategy Need?

A robust cyber security strategy needs a number of inclusions, such as multi-factor authentication. According to Microsoft, this technology alone can block up to 99.9% of fraudulent sign-in attempts.

One thing an IT department needs to do is understand its threat landscape. It’s no use simply choosing cyber security software because it’s expensive, as it may not be the right one for your specific business needs. 

Have you experienced threats in the past? Malware, phishing, ransomware? What about your competitors? Developing insight into your threat landscape will give you specific points to focus on and protect against. 

Here’s what a robust cyber security strategy must include:

Multi-Factor Authentication

Multi-factor authentication (MFA) is an authentication process that uses additional sign-in forms to help secure an account. In general, we’d log on to a platform with a username/email and a password. That’s not the most secure way of doing things, as sophisticated hackers use processes to guess these passwords. 

What MFA does is ask for further proof of identity after that initial stage. In practice, MFA may ask for:

• A password
• A phone or hardware key 
• Biometrics, such as a fingerprint or face scan

Software such as Microsoft’s Azure AD Multi-Factor Authentication really does the trick for protecting accounts against password phishing attacks.

Software Patch Management

Patch management is a pretty simple idea. Essentially, it’s the practice of routinely applying updates to software used within a system. Over time, software can develop weaknesses or bugs that cause vulnerabilities, so patches are brought in to resolve them. 

Patch management is needed because it provides the benefits of:

• Fixing those aforementioned vulnerabilities and reducing security risks.
• Improving compliance as many regulatory bodies demand a certain level of data protection. Without robust protection, not only is a business likely to be breached, but they’re also liable for fines due to sensitive data loss. 
• Optimising the functionality of commonly-used software. Patches usually represent an update that improves the performance or usability of a system or platform. 

Incident Response Plan

Every organisation needs a plan of action for what happens in the event of a breach. Hopefully, they’ll never need to be used (if your strategy is good enough), but they’re definitely worth having in order to mitigate any damage. 

The National Cyber Security Centre (NCSC) recommend an incident response plan should include the following:

• Key contacts: These include the IT team, senior management, legal teams, PR, HR and insurance, who should all be notified of a breach.
• Escalation criteria: After determining the severity of an attack, escalation criteria will identify a specific path to follow in how the incident should be handled. 
• A full incident lifecycle flowchart: This would include stages such as triage, escalate, responses, reporting, analysis, remediation, mitigation and recovery.
• A conference number: For direct or urgent communication with relevant parties.
• Guidance on legal or regulatory requirements: This means when and how to engage legal or HR support, depending on the severity of the breach. 

Cyber Security Training

Within businesses up and down the country, employees tend to wear many hats. They’re accessing multiple parts of an organisation’s network, usually through more than one endpoint — like their phone or work computer. This means there could be a numerous amount of people working with little knowledge of cyber security policies and best practices. 

Undertake training to get people up to speed and then regularly update employees when protocols change or new practices are brought on board. 

Overall, cyber security training is vital as a large portion of breaches are made possible by human error or carelessness.

What’s Next?

Ultimately, a cyber security strategy is never truly complete. It will continually need updating, assessing and improving so that your business can always stay on its toes when it comes to cyber security risks. 

So instead of waiting around and scratching your head while trying to audit your company’s threat protection yourself, why not get an expert to do it? 

We’re offering an extensive IT security risk and compliance audit to help determine your business’ current safety and how you can improve your security for peace of mind in the future. 

Click the link below to find out more.