What can businesses do to protect themselves from cyber attacks?

After nearly a third of UK businesses fell victim to cyber crime in the past year (DCMS Cyber Security Breaches Survey), it’s become increasingly clear that these risks need to be taken seriously. Without a properly thought-through cyber security strategy, your company could just be a sitting duck for the next attack. 

The good news is that, while it’s always better to work with an external partner on a complete security solution, there are some steps that you as a business can take to start protecting yourself today.  

1 – Conduct a risk assessment 

The first key step to keeping your business safe from cyber attacks is to go through a thorough risk assessment. While it’s usually a good idea to seek outside professional help, you can also do a more basic internal assessment to get things started. 

Start off by identifying which digital assets are most critical to your business operations – that could be your customer data, financial records or other sensitive information.  

Then figure out what the potential vulnerabilities and risks are. It’s a good idea to use an external guide like the MITRE ATT&CK Knowledge Base to cross-reference and check against your business’ situation.  

Evaluate each of these risks based on both the potential impact it could have and the likelihood of it happening. If you’re just doing this yourself rather than with expert help, this is likely to be more informal than purely quantitative but could still give a good rough roadmap for future planning.  

2 – Educate employees 

Your employees may be the most vital asset in your business, but unfortunately, they’re also its biggest vulnerability.  

That’s why they need to be properly educated to become a strong first line of defence against any potential cyber attacks. This means making sure that all employees go through thorough training to learn about how to protect themselves against any phishing attempts, create strong passwords and keep data secure. 

A large part of this is about creating a culture that’s more focused and aware of cyber risks. Get people talking about this stuff and, crucially, don’t lay blame on people if there is an issue – that will only lead to people trying to cover their tracks, potentially making things worse.  

3 – Implement access control 

To help limit the chances of a breach, either intentional or accidental, implement controls so that only certain employees have access to specific data or resources as needed by their role. Like every aspect of your cyber security strategy, these access rights should be regularly reviewed to make sure that only the right people have access.  

It’s also always good practice to make sure that access to sensitive information and systems is protected by Multi-Factor Authentication (MFA). This gives you an extra layer of protection, typically something like a fingerprint or a code in an app, making it much harder for hackers to be able to gain unauthorised access. 

4 – Regularly update software and systems 

When it comes to cyber security, ‘set and forget’ just isn’t good enough. 

Cyber criminals are constantly adapting the techniques and tools they use to try and attack. They’re always on the lookout for any potential vulnerabilities that may arise in the software and systems that you use at work. If these programs are outdated, there’s a good chance there could be a vulnerability that cyber criminals can exploit. 

That’s why it’s crucial to keep these updated to the latest version, as the developers will also be working to find and fix any bugs or weaknesses.  

5 – Secure your network perimeter 

Securing your network perimeter is like building a fortified wall around the castle of your business. A solid firewall will be able to filter all the incoming and outgoing traffic from your network and can block certain types of traffic if they are deemed suspicious based on a defined set of rules. 

The other key aspect to securing your network is with endpoint protection. Endpoints are all of the connected devices that the employees use in their day-to-day work. This can be computers, phones or even things like printers. Endpoint protection works to protect these devices by detecting and dealing with threats like malware at the device level. 

Generally, a trusted IT partner will be the best bet to help your business get set up with these sorts of solutions as they’ll be able to figure out the best solutions for your business and customise them to your exact needs. Here at Thinc, we work with industry leaders SonicWall and CrowdStrike to provide the cutting-edge technology behind our consultative cyber security approach.  

6 – Backup and disaster recovery plan 

Even if you’ve already taken all the steps above, you still need to be prepared in case an attack succeeds or some other disaster occurs. 

That’s why it’s essential to make sure that all your business-critical systems and data are regularly and securely backed up. Figure out what things would cause the most damage to your businesses if they were to be lost and prioritise these.  

Whatever method you choose to backup on, make sure it’s kept separate from your computer. That’s because ransomware and other forms of malware can often automatically infect attached storage, rendering a local backup useless.  

Cloud storage generally forms a key part of any backup strategy. This is a good option as it’s stored off-site, easily available and flexible in the amount of storage you get. Having a hybrid mix of cloud and on-premises storage can also give you some of the best of both worlds, depending on your needs.  

7 – Regular security audits and monitoring 

To keep your business safe, it’s not enough to just get some cyber defences set up and forget about it. Staying safe from cyber attackers is a constant game of cat and mouse. That’s why you need to be regularly checking your systems. 

The most effective way to give your systems a thorough checkup is with a complete vulnerability assessment from an external party. This will give you a clear picture of any potential weaknesses in your cyber security strategy that criminals could look to exploit.  

By using the same high-tech tools as the best hackers, we’re able to simulate potential attacks and give you a thorough report of the risks and weaknesses.  

8 – Collaborate with a cyber security provider 

Most of these steps so far are things you’ll have been able to at least get started on doing yourself. But to really build a proper cyber security strategy, it’s a good idea to get professional help. After all, something as important as your business’ security shouldn’t be left to chance or be somewhere you cut corners.  

At Thinc, we give you the complete package of everything you need to keep your business safe. That means you get the initial assessments, a range of products and services as well as the ongoing support, monitoring and testing to make sure everything’s running smoothly.