Published: 4/10/2018
Keeping guard against Cyber attacks
I've just read a fascinating article about whether or not we are entering a new Cold War with Russia over recent cyber attacks. It also ties in with me investigating the UK response for businesses and individuals - Cyber Essentials.
Wierdly the world of Cyber attacks and warfare hasn't really changed much over the last 10-15 years, rather it has become who is behind them rather than the means they use (it use to be criminals, now it seems its governments). As such with a bit of key knowledge it is possible to keep your self or your business better guarded from external attacks.
How do Cyber attacks occur?
- Viruses
These are generally sent through emails, a user inadvertantly opens an attachment and the virus is installed and runs. - Malware/Spyware
The user has downloaded software which may inadvertantly include malicious software, or the software itself leaks too much information about the user - Out of date software
When bugs are found in software, they are updated regularly. If a user doesn't run the latest versions for whatever reason, then security issues that have become public can still be triggered as an attack. - Staff
One of the big ways that attacks occur is through staff. It may be accidental or deliberate but particularly in sensitive areas - staff who aren't thoroughly vetted may be given access to information or data that would be vulnerable were it ever released (The NSA spying on the US citiziens being a good example!). - Trickery (aka phishing)
Emails or fake websites trick users into revealing their passwords for various applications such as Email platforms or Banks. This is how information about Hillary Clinton was leaked and also many millions defrauded from individual bank accounts. - Weak network interfaces (aka your broadband router)
If your broadband router is allowing people to view it or access it from outside your house/business then network traffic may be intercepted, viewed and used. - Theft and weak physical access
If your PC was lost or stolen - what would be on it that you wouldn't want anyone to see? Its an interesting point. Many a laptop has been accidentally left on trains or stolen and especially now under GDPR this would be considered a data breach!
How can we defend against them?
The UK Cyber Essentials scheme aims to protect users in the above areas under the following 5 key headings:
- Boundary firewalls and Internet Gateways
- Secure Configuration
- Access control
- Malware protection
- Patch management
I would suggest that steps 1,4 and 5 are absolutely critical to any business operation. The other two steps could well be argued relate more to multi-person businesses where the aim is to protect from Staff as mentioned earlier (for example the self employed person working from home will authorise all the software he uses!).
Whilst the CE scheme is good and covers the "technical" elements, its worth considering 3 more steps:
- Staff training
This relates to advising staff how to interact with the software on their machines and the internet safely. There are only a few entry points for a Cyber attack and technology alone won't stop them all. Therefore good staff training is essential. - Secure your buildings and machines
If data on your machine is encrypted then should someone gain access to it - it would be considered fairly secure. Likewise if you've used good passwords on your machines and your building is secure then access to the ultimate goal - your data and information is protected. In reality most burglars won't be after your data but you never know! - Backups
If your machines were infected with ransomware and were completely lost would you be able to recover as a business? If not, then backups are essential in case a machine has to be wiped and data recovered.
In reality most businesses won't face a Cyber attack like the ones Sky refers to. Hatton Web Solutions can advise you on how better to stay secure along with running staff training and assessments on your machine to beef up your defences against Cyber attacks.
