Cyber security is how individuals and organisations reduce the risk of cyber attack.
National Cyber Security Centre (NCSC) definition of Cyber Security
Cyber security’s core function is to protect the devices we all use (smartphones, laptops, tablets and computers), and the services we access – both online and at work – from theft or damage.
It’s also about preventing unauthorised access to the vast amounts of personal information we store on these devices, and online.
Cyber security isn’t just for large, complex organisations, it’s for everyone. The same way we all lock the doors and windows to our homes and workplaces, lock our cars and bikes, and ensure we keep our bags safe, we need to protect our devices and data from those that want to misuse them.
A government survey of UK businesses published in March 2021 found that four in ten businesses (39%) and a quarter of charities (26%) report having security breaches or attacks in the last 12 months. Of those organisations that identified breaches or attacks, around 20% end up losing money, data or other assets. (Department for Digital, Culture, Media & Sport – Cyber Security Breaches Survey 2021).
So, where do you start?
You’re probably already doing some, or even a lot of the right things, like having data security policies in place, reminding your employees not to click on links in unexpected emails… and researching cyber security by reading articles like this.
We take a very straightforward approach; we work with you to identify what you already have in place, what additional controls you should have to protect your specific business environment, propose options and agree priorities to close the gaps, then work with you to implement the remediations.
The NCSCs Cyber Essentials is a great place to start, it focusses on the foundation of 5 technical control themes:
- firewalls (on all your devices and network boundaries)
- secure configuration
- user access control (e.g., passwords)
- malware protection
- security update management
We then build on these taking into account specific certifications you’re looking to achieve, like IASME Governance, MOD Defence Standard 05-138, etc.
Tools
There are lots of great tools available that implement the necessary controls, some of which you may already have licenses for but don’t know about or need help implementing. The Microsoft 365 suite of licenses includes most, if not all of the tools you would need, with each of the tiers providing additional / deeper capability.
Device Management / Mobile Device Management (MDM): enforce settings on computers, laptops, tablets and smartphones, and control their ability to connect to your company data / systems based on their compliance. This covers things like password settings, encryption, and security patching. This also typically allows you to remotely wipe lost devices.
Sensitivity Labels & Data Loss Prevention (DLP): tag your files and emails based on your data classifications, apply rules to manage what can happen to those different classes of data (e.g., warn a user that they are about to email sensitive data to an external email address or automatically block it from being sent). These tools can also automatically discover and prevent the sharing of confidential data based on pattern matching, e.g., National Insurance numbers, driving license numbers, etc.
Cloud Backup: your data in the cloud will typically be protected from accidental / malicious deletions in some limited way, but recovering it may not be as easy as you would like, and the retention period will most likely not be sufficient for your business needs. As an example, files deleted from Microsoft Teams, SharePoint, or OneDrive end up in a recycle bin for 93 days, but can be purged by an administrator before that. Microsoft also backs up your data and retains it for 14 days, but you will need to contact their support team and they can only restore an entire site, not individual files. Microsoft recommends you implement a separate backup solution; this will securely back up your data to a separate cloud environment, encrypting your data, enabling you to restore the level of granularity you want (e.g., individual files, folders, libraries, or sites), and retain those backups for as long as you need.
Contact us
If you would like to learn more and explore how we can help you improve the protection you have for your devices and data, please don’t hesitate to contact us.