Taking the threat seriously is a major part of protecting your business.
It’s become something of running joke that workplace health and safety in this country has ‘gone mad’. Yes, there have been some decidedly odd decisions made in the name of injury prevention, but for the most part it’s just a myth. There are hundreds of thousands of workplace injuries every year, and health and safety rules help to keep that number down. We have these rules for the same reasons we nominate workers to be first aiders and fire marshals. What’s odd is that we don’t do the same for cyber security.
When you do a fire drill at work, in most cases, everyone will know what they’re supposed to do and where they’re supposed to go. Staff will stop what they’re doing, then calmly leave the building through the nearest fire exit, congregating at the agreed meeting spot. Fire marshals will do a headcount and check how long it took everyone to get out. It’s all well planned, and there’s a policy that lays out what to do if something goes wrong, such as discovering someone is still in the building.
In contrast, many businesses barely think about cyber security, if at all. Of course, cyber attacks don’t tend to have fatal results like fires do, but like fires they can destroy businesses, and there are some key similarities in how companies should aim to prevent and tackle them. Essentially, it comes down to preparation, response and recovery.
Preparation
For the same reason businesses have fire extinguishers and first aid boxes, they should also have cyber security and disaster recovery measures in place, long before anything goes wrong. Naturally, you hope never to need these things, but you should act as if you definitely will at some point. It’s far too easy to think that bad things only happen to other people.
So make sure you have a firewall, email filtering, anti-virus and so on, and make sure they’re kept up to date at all times.
Response
Let’s return to our fire drill example. Imagine if these weren’t organised properly. In the event of an actual fire, there could be confusion and chaos, as workers head to the wrong exits and don’t meet in the same place. This lack of organisation could have tragic consequences. Well-practised fire drills help maintain order and can save lives.
A similar approach should be taken to cyber security. In the event of a cyber breach, whether large or small, workers should know exactly how they should respond. If they receive a phishing email, for example, they should be trained to recognise it as such, and there should be a clear policy for how to deal with it.
And instead of fire marshals, you might consider electing one or two cyber security officers within your organisation to champion the cause.
Recovery
With all the will in the world, you can’t always prevent bad things happening. Fires still happen and cyber breaches still occur. What you can do, however, is have a disaster recovery plan that gets you back on track as soon as possible.
A fire could gut your office, for instance, but you should have insurance that will help you rebuild. And you may have a contingency plan, such as alternate premises, which will enable you to continue trading until your new location is ready for you.
The same applies to cyber breaches, and backup and disaster recovery. Cyber attacks can result in downtime and lost data, both of which can hit you in the pocket. Should the worst happen, a robust backup and disaster recovery solution will be a lifesaver.
Final Thoughts
Reports such as the governments Cyber Security Breaches Survey 2019 suggest businesses are starting to take this subject more seriously. However, 30% said they have made changes in response to GDPR. Although that’s not a bad thing, it’s important to remember that cyber security is vital not just because of legislation, and now that the initial hubbub surround GDPR has faded, businesses should not let their defences slip.
The simple fact is more and more business is done digitally than ever before, and it’s going to continue growing. We all need to recognise the threat and act accordingly. Otherwise, it’s the hackers who will win.
