How to Reduce Cybersecurity Risk

Cyber-attacks are swiftly accelerating globally and also closer to home here in the Wellington region. SME's are continuing to be a target. Investing a few minutes thinking about how to reduce cybersecurity risk is well worth it.

Cybercriminals look for vulnerabilities which is why your risk needs to be repeatedly evaluated, with plans in place should you experience a breach. Do not think of it as a big job to be done, think of it as an ongoing series of smaller steps.

Director of the kiwi Government Communications Security Bureau’s NCSC, Hamish Beaton, says “Effective response is about more than just what you do when an incident occurs; it is about having systems in place, constantly reviewing and updating your approach, and ensuring you learn from experience – whether that is a significant incident or a near miss.”

But how do you get your head around this, and turn it into a plan you can action? Consider it as five distinct steps – identify the threats and risks; take proactive steps to protect against them; detect them if they happen; then respond; and finally recover quickly and well. Taking this approach alongside your trusted proactive IT partner will help to you to decide how to reduce your cybersecurity risk.

Identify

The first step is about identifying and understanding potential areas of risk to your business. Right up front you need to be the leader and walk the talk on taking cybersecurity risks seriously. From there you can do thinks such as identifying and controlling who has access to your business systems. Whether intentional or accidental, threats can often present themselves through employee activity. Creating individual user accounts for each employee can help isolate and troubleshoot a potential threat. Additionally, ensure you conduct thorough background checks and implement strong policies and procedures for cybersecurity within your business.

Protect

Although you cannot control the activity of individuals within your business, there are multitude of steps you can take to reduce the risk of threat. Possibly the simplest yet most valuable action is to take the time to effectively train your employees in threat awareness and detection. Additionally, Multi-factor authentication (or two factor authentication) is a security mechanism that requires an individual to provide two or more credentials in order to authenticate your identity. Following on from this, implementing a strong password policy can further protect your business. You can read more about this in our Strengthen Your Password Policy blog.

Detect

Ensuring you have reliable anti-virus, anti-spyware or anti-malware programs installed and updated is vital. Yet this is often something that slips out of date and frighteningly not prioritised. Anti-virus software scans your network and devices looking at data from web pages, files, software, applications. It searches for known threats and monitors the behavior of all programs, flagging suspicious behavior. An anti-virus is one of the most low-cost and effective solutions to stop incoming threats. If you are unsure about the status of your anti-virus, take action and call your Managed Service Provider or IT specialist today.

Respond

Develop a response plan for disasters and information security incidents. This can help stop a breach snowballing into something devastating. In the first instance, turn off your equipment immediately a breach is suspected and contact your IT provider. In addition to this, your IT provider can practice or test data and system recoveries before they are needed. This gives you confidence that when you do need them, they will actually work! Ensure your response plan is recorded in policy and procedures and have your employees well versed in this in the case of a breach.

Recover

This is where your preparations pay dividends. Because your data was safe and recoverable; because you had a plan that was practiced; you can recover quickly. Should an attack occur, it is likely to cost you less, disrupt your people less, and be unlikely to result in reputation damage.

Remember, it’s not just your files that need to be backed up, it’s also your data. Find out more about why you need to back up your Microsoft 365 data here.

Taking Action

If you’d like to find out more about your options for back up, or what measures you can take to build a strong cybersecurity framework - how to reduce cybersecurity risk, contact us today on 04 297 1040. If you’d like to visit or email us, you can find our details below.

Sources:
NCSC, Incident Management: Be Resilient, Be Prepared, August 4, 2020

NIST Cybersecurity Framework