Of all the cybersecurity threats we cover, ransomware is by far the most high-profile. It often seems as though barely a week passes without another story in the news about the latest blue-chip victim.  

It’s not hard to see why the media devotes so much coverage to ransomware. It’s a rapidly growing threat. It usually includes a note of suspense as we all wonder whether the victim will pay the ransom. And, it’s claimed some of the biggest companies on the planet as its victims.

But beyond the media headlines, ransomware is poorly understood. How does it work? Why is it so hard to stop? And, more importantly, what can you do to protect your business? 

How does ransomware work? 

Most ransomware uses a special kind of encryption, called ‘asymmetric encryption'. That might sound complex, but it’s actually very simple. Like standard encryption, it uses a pair of keys to encrypt and decrypt a file. However, unlike standard encryption, the attacker is the only person with access to the key to decrypt the file. It’s this key that cybercriminal uses to hold the victim’s files for ransom. 

Or, to put it in simple terms, it’s a bit like leaving the office to find your car has been clamped and a ticket attached to the windscreen with a demand to pay £250 to have it freed. Unfortunately, that’s where the similarities end. While you might be able to remove a clamp with the help of a mechanic, it’s virtually impossible to decrypt an encrypted file without a key. 

And it’s for this reason that in most successful ransomware attacks the victim is forced to quietly pay up to get their files back. 

How does ransomware get in? 

Much like its cousin malware, ransomware comes in many forms and can enter your system in a variety of ways. However, the most common route is through email spam campaigns or through a carefully targeted attack – think March’s attack on Acer or the infamous attack on the NHS in 2017. 

Once it’s in, the ransomware drops off its malicious cargo and then searches for valuable files to encrypt. ‘Valuable’ files are usually things like Word documents, spreadsheets, images and databases. Ransomware can also exploit any system or network vulnerabilities you have and spread across your organisation and into your supply chain. 

Why is ransomware so hard to stop? 

If it poses such a huge threat, then why does ransomware continue to grow more common and payouts keep climbing? Surely someone has come up with a way to fight it? 

Unfortunately, ransomware is very tricky to counter for a few reasons.

Easy to set up

Cybercriminals no longer need to be coding wizards to launch a ransomware attack. Malware marketplaces have sprung up in the shadier corners of the internet, meaning would-be crooks can essentially order ransomware on-demand. Often all its creator will ask for in return is a share in the profits. 

Most people pay up

The success of ransomware rests on the same principle as any other type of ransom. Generally, if something is valuable to someone and they risk losing it forever, they’ll pay whatever is necessary to get it back.

Cybercriminals know this, it’s what makes ransomware such a lucrative scheme. 

It’s hard to track the perpetrators down 

Remember the old adage ‘follow the money?’ Sadly, it’s nonsense when it comes to ransomware. Most cybercrime is paid for using cryptocurrency and planned in the darkest reaches of the internet, making it very hard to track.

There are endless targets 

Wherever you are in the world, cybersecurity knowledge is low. It’s low among business leaders. It’s low among staff. And it’s low among the general public. This means potentially endless targets for cybercriminals.

As we mentioned earlier, ransomware typically enters organisations through pretty unsophisticated methods. However, ransomware doesn’t need to be sophisticated when so few of us understand what an attack looks like. 

How do you protect your business? 

We’ve painted a pretty bleak picture so far, but don’t despair. There’s plenty you can do to protect your business against ransomware. 

Training, training, training 

According to research, 95% of cybersecurity breaches begin with human error. This is especially true when it comes to ransomware, with most attacks starting through a dodgy email being opened or malicious file downloaded. 

But before we rush to condemn human failings, it’s worth asking whether your people have been trained to spot threats. After all, if your employees have no idea what a ransomware attack looks like, they’re far less likely to take the right action to protect themselves or your business. 

The best way to beat this is through training. Training can help your people better recognise and understand the threats they face. And, more importantly, learn how to counter them. 

The kind of training you need will be highly dependent on your business and the existing knowledge of your staff. But a great place to start is by reading our blog on all things cybersecurity training. 

Backup your data

As we mentioned earlier, most victims end up paying out to ransomers but there's a very simple way to avoid this. Always backup critical files and data, preferably in the cloud or on an external hard drive. That way, if you do get attacked, you can wipe your device(s) and reinstall everything from backup. 

This won’t completely remove the threat of ransomware, but it will remove the need to pay your attacker to get your files back.

Patch your software

Updating software is a hassle, we get it. There never seems to be a convenient time to reboot your device and the endless passive-aggressive reminders from your operating system can get very grating. 

However, it is important, particularly when it comes to protecting yourself against ransomware. Even the best software develops vulnerabilities over time. It could be that the software was built with vulnerabilities that weren’t anticipated at the time or it might be that a new cyber threat has emerged. Whatever the reason, software developers get around the problem by releasing security patches.

These updates fix the ‘holes’ in your software that can be exploited by ransomware. Without them, you risk giving cybercriminals a back door into your systems and data.

But the good news is all you have to do is regularly update any software or tools you use. It shouldn’t take more than a few minutes each week and it’s by far the most effective (and simple) way to protect yourself. 

Read more about the importance of patching here.  

Stick to secure networks 

Whether it’s at your favourite local coffee spot or on the train to that important client meeting, using public Wi-Fi networks is a bad idea. Most public networks have poor or non-existent security and are the perfect place for cybercriminals to snoop on your internet usage and launch attacks. 

If you need to connect to a public network for any reason, use a Virtual Private Network (VPN). A VPN allows you to connect to business systems securely and browse the internet safely, wherever you are. For everything you need to know about VPNs, check out our blog on the subject. 

Put security policies in place

It’s one thing to improve staff awareness of the threats posed by ransomware, quite another to ensure everyone is following security best practices. This is where a clear, easy-to-understand cybersecurity policy can work wonders. 

A well-crafted policy will help your people understand what they should and shouldn’t do and help them make the right decisions when faced with threats like ransomware. 

Stay informed

Last, try and keep an eye on the latest ransomware threats. To be clear, we’re not suggesting you become a cybersecurity expert overnight (unless you want to). However, having even a basic knowledge of what ransomware looks like can help prevent the worst. 

Is your business working remotely or considering making the switch? Don’t do anything without reading our guide to cybersecurity in a new era of work.

When you think about tools for improving your organisation’s cybersecurity, it’s likely things such as anti-virus software, firewalls and encryption that immediately spring to mind. And, if it appears at all, security training is probably some way down the list.

However, security training is one of the most effective ways to protect your business against cyber threats. Here’s everything you need to know. 

Why is training so important? 

According to research from Stanford University, 88% of cyber breaches can be put down to human error. Or, in simpler terms, if your employees aren’t aware of what cyber threats look like, they’re much more likely to fall foul of them. 

The best way to beat this is through training. Training can help your people better recognise and understand the threats they face. And, more importantly, learn how to counter them. 

88% of cyber breaches can be put down to human error

What does effective security training look like? 

Firstly, there’s no such thing as one-size-fits-all security training. Well, at least not if you want it to be effective. The sort of training your business requires will depend on your staff and their knowledge gaps. 

For some businesses, this means starting with the basics. Meanwhile, in others, training addressing specific weak spots in employee knowledge will prove the best route. To read more on tailoring security training to your business, check out this excellent piece from our UX Researcher Anete.

Whichever approach you choose, remember there’s such a thing as too much information. Learning about cybersecurity (especially for the first time) can feel overwhelming. 

There is a multitude of different threats and concepts to learn. So keep it simple. Your employees don’t need to know everything or become cybersecurity experts overnight. They just need the information that’s most relevant to your industry or business. 

Training should follow the little and often approach. Little, because no one learns best by bombardment. Often, so that your people get into the habit of thinking about cybersecurity regularly. 

Think short, sharp exercises that fit into a lunch break or the time between meetings. It’s important that the training doesn’t impact staff’s core work or become a chore they quickly disengage from. 

And, finally, make it engaging. Include a mix of text, videos and interactive tasks in your training. After all, few of us learn best when the method is boring or feels like a slog.  

How do you get started? 

By this point, you’re hopefully convinced by the merits of security training. You may even have a good idea of which knowledge gaps you need to address within your business. But where do you start?  

At CyberSmart, we’ve noticed a gap in the market for engaging, jargon-free training to help build cybersecurity awareness within SMEs. So, we’ve created CyberSmart Academy. CyberSmart Academy is a simple, do-it-yourself approach to security training. And it's available to anyone who uses CyberSmart Active Protect. 

Through a series of bite-sized modules, CyberSmart Academy helps your people sharpen their knowledge of cyber threats and develop the skills needed to avoid them. Through videos, articles and interactive quizzes, your staff will quickly boost their knowledge. And, with each module designed to fit into a lunch break, it won’t impact their work or bore them to death. 

We’ve even included a little healthy competition into the process. Once training is complete, staff enter into a company-wide league table, so they can see how they perform against their peers. 

CyberSmart Academy is set to launch in just a few weeks, but if you’d like to know more get in touch, we’re happy to answer any questions.

Looking to improve your cybersecurity but not sure where to begin? Start by getting certified in Cyber Essentials, the UK government scheme that covers all the fundamentals of cyber hygiene.

You’ve likely heard the term ‘cybersecurity policy’ before. But what is it? And why does your company need one? 

What do we mean by ‘policy’? 

A ‘policy’, in cybersecurity terms, is a set of principles that guide decisions within an organisation. These principles can inform the decisions senior management make or guide employees in their day-to-day activities. A great example of the latter is a password policy.

What is the purpose of a policy?

A well-crafted policy can help your organisation achieve its goals, say reducing the risk of phishing attacks or compliance with Cyber Essentials. Any policy worth its salt should outline what employees should or shouldn’t do, offer directions on best practices, and guidance for decision making. 

Why are policies so important? 

According to research,  90% of security breaches occur through human error. However, improving your cybersecurity isn’t about blaming employees for their all-too-human mistakes. It’s about giving your people the tools and knowledge to better protect themselves.

According to research,  90% of security breaches occur through human error

This is where policies come in. Policies and procedures provide a roadmap for day-to-day operations. They ensure compliance with laws and regulations, offer guidance,  and even help employees make better decisions. After all, if your people don’t know which behaviours are harmful, they can’t correct them.

But clear, readily available policies have benefits beyond merely reducing the likelihood of a successful security breach. Here are just a few.

Improved efficiency 

Sometimes clear policies are all that stand between a business and organised chaos. Sure, everyone’s working, but are they all pulling in the same direction? Or adhering to company values?

When everyone is following policies and procedures, a business will generally run smoothly. Management structures and teams operate as they’re meant to while mistakes and hiccups in processes can be quickly identified and addressed. 

What’s more, when everyone understands what’s expected of them and goals are clearly defined, time and resources are managed more efficiently. And this will ultimately help you meet targets and grow. 

Better customer service 

There’s nothing more frustrating than receiving wildly different service from two separate interactions with the same organisation. It could be your utility provider, GP surgery or bank, but we’ve all experienced the irritation it causes. 

Having clear, easy-to-follow policies in place is a sure-fire way to stop your business from providing erratic customer service. When policies are followed, tasks are performed correctly and every customer receives the same high level of service – enhancing your business’s reputation to boot. 

A safer workplace 

Workplace accidents and incidents are far less likely to happen if everyone’s working to the same standards and principles. This not only reduces liability risk for your business but also cuts downtime and disruption. And, even if the worst does happen, you’ll weather it much better with a clear procedure on how to deal with it. 

How can CyberSmart help? 

We’ve discussed why policies are important but now comes the tricky bit. How do you ensure that everyone in your business has access to the policies they need to work safely? And, more important still, how do you make sure they read them?

CyberSmart Policy Manager allows you to digitally upload and share policies straight to staff’s devices through our platform, CyberSmart Active Protect. Policies can easily be uploaded through the CyberSmart Dashboard and made available to your users instantly. 

What’s more, you can be sure your employees read them. Our Dashboard provides you with a digital audit trail of when policies have been read and agreed upon. 

But what if you’re unsure of where to start when creating a new policy? Well, we’ve got you covered there too. We’ve put together a handy set of templates to help you get started. These are free to download from your CyberSmart Dashboard and easily modified to suit your business. Our policy templates include: 

•  Data Classification policy 
•  Cyber Essentials policy 
•  Data Protection policy 
•  IT Access policy 
•  Security Awareness and Training Guidelines policy 
•  Work From Home Covid-19 policy

We also offer a GDPR policy pack as part of our IASME and GDPR certification.

And that’s all there is to know about policies. They’re a simple tool, but one that provides an important first line of defence for your business against cyber threats. Hopefully, this blog has armed you with all the knowledge you need, but if you have any questions please get in touch, our team are always happy to help.

Looking to improve your cybersecurity but not sure where to begin? Start by getting certified in Cyber Essentials, the UK government scheme that covers all the fundamentals of cyber hygiene.

Just about every business uses a server, but most of us only have a fuzzy idea of what they actually do. And it's easy to assume that it’s too technical or complex for us non-techy types to understand. 

In reality, servers are pretty simple, and, they’re a key part of your IT infrastructure as well as having a role to play in Cyber Essentials certification. 

Here’s everything you need to know. 

What is a server? 

When most of us think of servers, we think of huge, thousand-acre data centres like this. However, most businesses have a server and they’re often of a much more modest scale. 

Any computer using the right software can be a server. Essentially, all a server does is collect and distribute information across a network. The network could be local, say within your office, or a wider network across many locations, like the internet.

For more on the different types of networks and how they work, check out our recent blog on the subject. 

How does a server work? 

Whether it’s searching Google or pulling up a file at work, you probably access servers thousands of times each day.

Taking the internet as an example, the process works something like this: 

1. You enter a URL into your web browser
2. The browser requests the data for the site you’ve asked it to display
3. This information is sent to the server
4. The web server finds all the data needed to display the site and sends it back
5. The site you’ve requested appears on your browser

And that’s it. The whole process shouldn’t take more than a few seconds, depending on your internet speed. 

What is a virtual server? 

Servers are simple enough. But, things get a little more complicated when it comes to virtual servers. So, here’s the simplest explanation we could come up with.

A virtual server is a server that shares its resources amongst multiple users, each of whom has some control over it. It’s usually located offsite from the organisation using it, typically in a data centre. 

Think of it as a way of splitting a single, physical server into several smaller virtual servers, each of which can run its own operating system. The key advantage of this approach is cost saving. 

A virtual server is usually much more energy-efficient to run than a dedicated physical server and doesn’t require any upkeep by the businesses using it. And, you only pay for the server capacity your business actually uses – far more cost-effective than running an entire server and only using a fraction of its capability.

Servers and Cyber Essentials 

The Cyber Essentials certification questionnaire has several sections relating to servers, but what is it you need to do?

First, all servers whether virtual or physical need to be supported by the manufacturer. For example, Windows Server 2008 isn’t Cyber Essentials compliant because Microsoft stopped supporting it some time ago. This means its defences won’t have been updated to deal with new threats, making it vulnerable to attack. For more detail on the importance of updates, have a read of this.

For Cyber Essentials Plus, your servers only need to be tested by an auditor if they ‘touch’ the internet and a non-admin user can use it to browse. If you’re unsure of the difference between admin and non-admin users, never fear, we’ve put together a handy blog to help.

For both Cyber Essentials and Cyber Essentials Plus, you’ll also need to answer questions on who has access to your servers, the protections you have in place, and the software installed on your servers.

And that's all there is to know about servers; a complex technology with a very simple job. Hopefully this blog has armed you with all the knowledge you need, but if you have any questions please get in touch, our team are always happy to help.

Looking to improve your cybersecurity but not sure where to begin? Start by getting certified in Cyber Essentials, the UK government scheme that covers all the fundamentals of cyber hygiene.

There’s no disputing that cybercrime is on the rise. According to data from RiskIQ, $2,900,000 is lost to criminals every minute and companies pay out an average of $25 dollars every 60 seconds due to breaches. So it's hardly surprising cybercrime is set to cost the world $10.5 trillion annually by 2025.

But what is it about the internet that encourages cybercrime? In the second part of our series on cyberpsychology, we delve into how the internet nurtures cybercrime and why we often fall for scams we wouldn’t in the physical world.

Let’s start with the bad guys.

How does the internet enable cybercriminals? 

We’re not always aware of it, but all of us can be guilty of losing our inhibitions online. The internet can encourage us to be more confident and open. However, it can also have toxic side effects.

Some of us are more likely to be manipulative and deceptive online as we are less concerned about our peer's judgement. When interacting with each other using technology, communication has limited physical features. Often we can’t see or hear the person we’re talking to, offering perfect conditions for misleading messages and false identities.

$2,900,000 is lost to cybercriminals every minute

Online interactions can seem less tangible than our offline lives. And, because the online world feels less 'real', harmful behaviour can also feel more acceptable. Without the victim’s physical presence, attackers feel distant and detached from their target and are less afraid of being caught. This makes lying and misleading behaviour much easier. Criminals also feel safer due to the anonymity offered by the internet and the lack of regulation of online behaviour.  

Criminology theory suggests that the three key ingredients for more crime are a motivated attacker, a suitable target and a lack of ways to protect them. Let’s apply this framework to cyberspace. The motivation for cybercriminals is the belief they’re unlikely to be punished for cybercrime. The target can be just about anyone, such is the range of available victims. And, the lack of protection is provided by the way we conduct ourselves online. 

How do cybercriminals use the internet against us?  

There is a wide variety of methods cybercriminals use to ensnare victims. For example, phishing attacks create a sense of urgency and exploit it. It could be by creating a bogus 'emergency' in which the cybercriminals poses as a friend in need of help. Or, it could be something less altruistic, like the chance to win prizes.

Criminals can also mislead us by presenting themselves as an authority or trustworthy institution –  sometimes even using familiar names and logos. This could trigger us to be less critical when facing a request and respond out of habit, familiarity, or respect for authority.  To give an example, during the COVID-19 pandemic we’ve seen a huge increase in bogus vaccination emails. The threat has become so widespread that the NCSC has launched an awareness campaign, encouraging anyone who’s been targeted to use its scam reporting services.

Online communication can often appear hyperpersonal. And this is especially true if we don't know the person we're communicating with. Online interactions can make us idealise the person behind the avatar or email address. Without a physical appearance, body language or other non-verbal cues, we struggle to determine someone's intentions. The result is we often default to our better nature and develop a sense of having a close relationship very quickly. 

This can lead to us disclosing personal details without actually knowing the person we’re communicating with. Cybercriminals know this and are quick to exploit it. 

The situation is made worse by the ready availability of personal information on the internet. Take social media, for example. Through a person’s profile, you can often see friends or connections lists, recent locations, their interests, and any events they’ve been part of. This information is a great resource for attackers in making communication more targeted and personal. 

What can cyberpsychology do to help us improve our cybersecurity? 

Although it might sound like a slightly dusty academic concept, cyberpsychology has plenty of practical uses. For one, it can help us better understand our vulnerabilities online. And knowing that we're prone to hyperpersonal communication and letting our guard down is the first step towards correcting that behaviour. 

It also helps us understand the methods cybercriminals use to trick us and the behaviours that make us an easy target. This understanding can make us think more critically the next time we’re faced with a potential scam. What's more, it gives us the tools to avoid falling for scams in the first place and better strategies for protecting ourselves. After all, to defeat your enemies you must first understand them. 

Knowledge of how and why cybercriminals target us is important. However, knowledge alone isn't enough to protect your business.  You also need an understanding of the fundamentals of good cybersecurity. Fortunately, this isn’t nearly as difficult as it sounds. A great place to start is by getting certified in Cyber Essentials, the UK government scheme that covers all the basics of good cyber hygiene. It doesn’t require any cyber expertise and can help protect your business against 98.5% of the most common cyber threats.

User permissions aren’t normally something we associate with cybersecurity. In part because it isn’t quite as sexy as talking about the latest ransomware attack, but also because of simple confusion.

So, to help you understand how it can affect your cybersecurity, we’re delving into the world of user permissions. What are standard and admin users? What are the differences between them? And how are they relevant to Cyber Essentials certification? 

What is a user?

A user account is an identity created for a person in a computer or computing system. When you sign up for an online groceries account, that’s creating a user. Likewise, when you first purchased the device your reading this from you likely set yourself up as a user. 

But user accounts don’t have to be created for real, living breathing humans. It’s also possible to create accounts for machines. For example, service accounts for running programs, system accounts for storing system files and processes, and admin accounts for system administration.

What is an admin user?

Administrator accounts are created to carry out tasks that require special permissions. You wouldn’t want just anyone in your organisation to be able to install software or access certain confidential files, so setting up admin users allows you to control who can do what. 

These administrator accounts should be regularly audited, including password changes and regular confirmation of the right people’s access.

What’s the difference between admin accounts and standard accounts?

Simply put, admin accounts are the most powerful type of user. They have the power to do just about anything on a device. For context, think about the guy or girl in IT who you need to ask to perform tasks like setting up new software.  Every device or system will have at least one admin user somewhere.

Standard user accounts are much more limited. Just how limited often depends on the type of operating system you use. But, as a rule of thumb, standard accounts can’t typically install new software or access system-critical files. Usually, they can access the files they need for day-to-day work but are prohibited from making serious or permanent changes to their device. 

It’s also important to note that standard accounts are much easier to control than admin users. With user controls, administrators can place much more severe restrictions on accounts – everything from blocking access to certain applications and websites to setting a daily time limit. 

Although using a standard user account can appear limiting, it does provide security benefits that can protect you in the event of a breach. 

Why are standard accounts more secure than admin accounts?

At first glance, the choice between a user and an admin account might seem like a simple one. After all, who doesn’t want the power to change anything they see fit?

However, admin accounts do come with an added security risk. Due to the permissions granted to admin users, if malware is installed on your system an attacker has the power to do virtually anything they want to. In essence, the more permissions your account has, the more damage a cybercriminal can do should they gain access. 

On the other hand, standard accounts offer much less flexibility but greater security. Malware installed under a standard user account is less likely to do serious damage. The hacker won’t be able to make system-level changes or access files other than the user’s own. So when it comes to cybersecurity, having a ‘lower level’ account can work in your favour. 

Why is it important for administrators to have a standard account? 

While it’s inevitable there will always be a need for admin accounts in your business, it matters what those accounts are used for. Using an admin account for day-to-day activities like checking your email or browsing the internet dramatically increases the risk of being breached. 

When penetration testers are attempting to compromise a system, they are looking to “gain admin.” And the same principle applies to cybercriminals who also look to gain admin rights to a system or, better still, a network. 

Allowing a systems administrator – especially one with domain administrator privileges – to access the internet via their admin account presents an easy target for hackers using phishing or impersonation attacks. To counter, consider giving your admin users safer standard accounts for their day-to-day duties. 

How do user permissions relate to Cyber Essentials? 

User accounts are covered in the Cyber Essentials questionnaire and there are two sections you’ll need to answer. 

User accounts 

The questions in this section deal with how user accounts are created, who approves the creation, and the processes you have in place for when people leave the organisation or switch roles. They apply to any servers, laptops, tablets or mobile phones used in your business.

Cyber Essentials describes best practice for user accounts as: 

It is important to only give users access to all the resources and data necessary for their roles, and no more. All users need to have unique accounts and should not be carrying out day-to-day tasks such as invoicing or dealing with email whilst logged on as a user with administrator privileges which allow significant changes to the way your computer systems work.

Admin accounts 

The questions in this part of the assessment tackle your processes for choosing and setting up admin users and how regularly access to privileged accounts is audited. Once again, this applies to all servers and devices used in your organisation.

How should you set up user permissions in your business? 

Although every business has different requirements, there are some best practices we recommend you follow.

1. For SMEs, we recommend that no more than two people in your business have access to domain admin accounts for whatever software package you use – for example, Microsoft Office 365 or Google Suite.

2. You should regularly audit who has access to these accounts. In the hustle and bustle of daily business, it’s very easy for user permissions to slip and admin accounts to be used by unauthorised staff. 

3. Put in place policies and, if necessary, training to ensure that administrators don’t access the internet or their emails using admin accounts. 

4. Use two-factor authentication (2FA) or multi-factor authentication (MFA) on both admin and standard user accounts. This adds an extra layer of security for cybercriminals to breach in an attempted attack.

What about staff working remotely? 

Things do become slightly trickier in our current working environment, with many businesses working remotely. In many cases, staff working from home will need a local admin account for their device.  It’s often more practical for employees to be able to install software or make changes to their machine, rather than asking your IT team to do it remotely. 

Nevertheless, most of the recommendations above still apply. Your people still need to be educated on the importance of using standard accounts for daily work and using MFA. 

That’s all there is to user permissions. Setting up user and admin accounts safely is a simple change, but one that can instantly improve your cybersecurity. Hopefully, this article has helped you better understand how they work and some best practices for keeping your business safe. But, if you have any questions, please get in touch, our team is always on hand to help. 

Looking to improve your cybersecurity but not sure where to begin? Start 2021 the right way, by getting certified in Cyber Essentials, the UK government scheme that covers all the fundamentals of cyber hygiene.

Despite the common perception, VPNs aren’t just a tool for surfing the shadowy underbelly of the internet. A VPN is a vital defence against cyber threats for anyone working remotely. Here’s why your staff need one. 

What is a VPN?

In simple terms, a VPN (or virtual private network) allows you to connect to business systems securely while using a public network. A ‘public’ network could be the free connection you get on public transport, the WiFI at your favourite cafe, or even your home internet router.

How does a VPN work? 

The best way to think of a VPN is as a ‘tunnel’, used only by you, between your workplace and wherever you’re working from. 

Rather than using the public network, a VPN routes your traffic through specialised servers and encrypts your data. When you connect to the internet via a VPN, all your data is sent through this encrypted tunnel. This has a couple of key advantages over using a public network:

Greater privacy

VPNs obscure your internet activity from your provider and everyone else. This effectively makes you ‘anonymous’ on the internet. Not only is this great for privacy, but it also means your IP address and location are invisible, making it much harder for cybercriminals to intercept confidential company data. 

Improved safety

An encrypted tunnel is very, very difficult to hack. VPN Mentor has produced some interesting research on the subject and concludes that the only way hackers can break VPN encryption is either through a known weakness or by stealing the encryption key (more on encryption keys here).

Essentially, a VPN is a pretty sure-fire way to ensure your business devices aren’t vulnerable to attacks coming from public networks. 

Why should your business use a VPN for remote working? 

We highly recommend using a VPN if you have employees working remotely, but why? You may be wondering whether it’s really necessary. After all, won’t the existing security on employees’ devices protect them? 

Unfortunately, this simply isn’t the case. If your employees are using public networks or their home router it’s likely to be far less secure than your office network. According to a report from BitSight, home office networks are 3.5 times more likely than corporate networks to be infected by malware. 

There’s also the human element to all this. Research shows that many employees, whether consciously or not, engage in riskier behaviour when working from home. For example, sharing confidential files via email instead of the usual, safer channels. Without the added layer of security a VPN offers, this confidential data could easily fall into the wrong hands.

Why you need a VPN for hybrid working too

If you’re planning on adopting ‘hybrid working’ as the norm post-pandemic, VPNs will be essential to keeping your business safe. 

Picture the scenario, one of your sales team has dropped into a coffee shop on the way back from an important meeting. They like the ambience of the place, so they decide to sit and fire off some emails and run through their sales deck while they sip a latte and munch on a croissant. To do this they need to connect to the cafe’s WiFi, an unsecured public network. 

Seems innocent enough, but on this particular day, a hacker is targeting the customers of this coffee shop. They see that your salesperson is working using the cafe WiFI, and that’s all it takes. In a few seconds, the sales deck and confidential data have been stolen. Your business is facing a choice between a PR nightmare or a hefty bill to get it back. 

How do you set up a VPN? 

The first step is to pick a provider. There are hundreds of VPN providers out there each offers slight variations on the same service. Many businesses stick with the major providers such as NordVPN and ExpressVPN and with good reason, both regularly win tech magazine ‘Editors choice’ awards. 

However, if you’re looking for the highest level of anonymity, smaller providers such as Mullvad VPN that require no payment or contact details could be the way to go. If in doubt, check out Tech Radar’s Best VPN Service 2021 list, it compares most of the major providers. 

Once you’ve picked, setting up a VPN is relatively easy. The set-up process is almost universal among VPN providers so it shouldn’t matter which you choose. We won’t go into exactly how you do it here, but this guide from The Verge covers everything you need to know. 

Want to know more about how to switch to hybrid or remote working safely? Download our guide, Cyber Safety in a New Era of Work here.

The term ‘network’ causes a lot of confusion for businesses looking to complete Cyber Essentials certification. It’s not hard to see why. Much of modern living is enabled by networks, from the internet to mobile phone providers. In fact, there’s little we can do without using one. So which particular  ‘network’ is the Cyber Essentials questionnaire referring to?

It's all a little confusing. So let's answer some of the most common questions around networks and Cyber Essentials.

What is a network? 

For the purposes of Cyber Essentials, a ‘network’ is one or more devices that are linked in order to share resources, exchange files or allow communication. For example, think of the office printer. Typically, rather than setting up a separate printer for every employee, you’ll buy one for everyone to use (and argue over whose turn it is to change the toner). This is a perfect example of a network.

The devices on a network can be linked through cables, telephone lines, radio waves, satellites or even infrared light. 

What does a network look like in practice?

Most offices and workplaces use a Local Area Network (LAN). A LAN is usually confined to a small geographic area, say an office in Bow or a warehouse in Bolton. A LAN allows every device within the network to use a single internet connection, share files and access (or even control other devices). 

In the age of the internet of things (IoT), the devices you can connect to a LAN are almost limitless.  It's possible to connect everything from printers and phones to smart TVs, speakers and security cameras. You can even connect the office fridge. 

How does COVID-19 affect networks? 

Of course, with many of us currently working from home, the network your business is currently using may look a little different. However, this shouldn’t pose you any problems in completing Cyber Essentials.

Any single device connected to a router can be considered a network. So even if all of your employees are working remotely, using tens of different routers, Cyber Essentials certification is still possible. All you need to do is ensure that each router meets the requirements of Cyber Essentials. For example, asking each employee to change the default password on their router. 

We also often get asked how question A2.8 of the Cyber Essentials assessment (which requires a list of your network equipment) should be answered for businesses working remotely. Again, this is pretty simple. All that’s required is for you to list the equipment each employee is using, as though you were all in the same office.

How to list home network equipment for Cyber Essentials 

For a company with ten staff working from home, an equipment list may look something like this:

• 2 x Sky broadband with Sky router 
• 6 x BT broadband with BT hub router
• 1 x TalkTalk broadband with TalkTalk router
• 1 x Virgin Media broadband with Virgin Media router
• Any office router or firewall you used pre-pandemic

But what about other elements of the Cyber Essentials assessment process? Fortunately, as the entire assessment is conducted remotely, you can complete the process no matter where your staff are working from. 

Hopefully, we’ve cleared up most of the confusion surrounding networks and Cyber Essentials. However, if you have any further questions, please don’t hesitate to get in touch with our team. 

Looking to improve your cybersecurity but not sure where to begin? Start 2021 the right way, by getting certified in Cyber Essentials, the UK government scheme that covers all the fundamentals of cyber hygiene.

What do you think of when you imagine a typical cyberattack?

If you’re like most of us, then chances are you immediately thought of a high-profile attack on a single organisation, say, the Twitter or Mariott breaches in 2020.

In reality, cybercriminals rarely enter through the front door. Here’s why supply chains pose the greatest risk to your cybersecurity.

What do we mean by supply chains? 

As a small business, you’re almost certainly part of a supply chain. Depending on what your company does, you could be a supplier, vendor, distributor or retailer. Your part in the supply chain isn’t the important thing. What’s important is the symbiotic relationship this gives you with other businesses in the chain.

Think of it as akin to the way different species exist in nature. This relationship can be mutually beneficial; bees need the pollen from flowers for food and energy, and flowers need bees for pollination. Or, the relationship can be destructive, as the increasing number of zoonotic diseases (such as COVID-19 and SARs) passed from animals to humans proves. The same is true of the ties between businesses.

Worried about the threat posed by supply chain attacks? Check out our guide to protecting your business.

Why do supply chains pose a cybersecurity risk? 

When business leaders evaluate their cybersecurity, most know the first place to look is within their organisation – at their own people, systems and infrastructure. Unfortunately, that’s no longer enough. 

According to research, up to 80% of cyberattacks now begin in the supply chain. Cybercriminals have realised that to target high-profile businesses, you don’t need to attack the organisation itself. Big corporate enterprises often have the best in cybersecurity tools and processes, so breaching their defences is difficult.

However, the SMEs who supply or provide services to these big companies usually have far more modest defences. And, crucially, they provide a ‘backdoor’ into bigger organisations by being part of the supply chain. A breach at even the smallest link in the supply chain can have dire consequences for everyone within it. This makes SMEs a prime target for cybercriminals with an eye on big enterprises. 

A great example of this is the recent SolarWinds attack. By breaching SolarWinds (an IT infrastructure provider), cybercriminals were able to gain access to some of the world’s largest tech companies, including Microsoft, Intel and Cisco. 

How to protect your business 

So, if supply chains pose such a risk to your cybersecurity, what can you do about it? Small suppliers can’t help being targeted by cybercriminals. And large enterprises can’t control what everyone in their supply chain is doing all of the time. 

Fortunately, there are a few things you can do to reduce the risks. 

Get your cybersecurity in order

Although you can’t always control what everybody else in your supply chain is doing, good cyber hygiene begins at home. This means that your priority should be ensuring your own cybersecurity is up to scratch.

A great place to start is by getting Cyber Essentials certified. The government-backed certification scheme assesses your business against five key cybersecurity controls:

• Is your internet connection secure?
• Are the most secure settings switched on for every company device?
• Do you have full control over who is accessing your data and services?
• Do you have adequate protection against viruses and malware?
• Are devices and software updated with the latest versions? 

By ensuring these criteria are in place, you can protect your organisation against 98.5% of cybersecurity threats – including most of those that are likely to come through your supply chain. 

But don’t stop at certification. Consider using encryption and two-factor authentication on all company devices and implement a strong password policy and enforce it. 

Alongside this, put in place an easy-to-understand cybersecurity policy and make sure everyone within your business has access to it. More often than not, supply chain breaches come from staff acting in good faith. If your people don’t know which behaviours are harmful or how to spot a threat, then your business will always have a chink in its armour. Education really is the key. 

Talk to your supplier and partners 

The greatest defence against supply chain attacks is trust between partners. So talk to your suppliers and partners about their cybersecurity practices and share experiences and advice.

This may sound like something from a business self-help book, but poor communication or reluctance to admit a breach has happened can often turn a minor attack into a disaster. By fostering trust and a willingness to communicate across the supply chain, you’re effectively creating an early-warning system for your business. This can be vital in halting or at least containing the breach.

Aim to work with businesses that are Cyber Essentials certified 

Of course, building trust in any context takes time. And time isn’t always something you have when working with new partners or suppliers. So, an alternative is to insist on a minimum security standard for any business you work with. 

Cyber Essentials certification is tailor-made for this. By choosing to work only with businesses that display the Cyber Essentials logo, you ensure everyone you rely on is working to the same security standards, minimising the likelihood of a breach. How you approach this is up to you. Some businesses include it as a standard contractual clause, while others have more informal agreements in place. What matters is the assurance that your partners and suppliers take their cybersecurity responsibilities as seriously as you do. 

According to research from popular exercise app Strava, the second Friday of January is “quitters’ day”– the day when people are most likely to give up on New Year’s resolutions. 

It’s the day when all those promises made in good faith back in December go up in smoke. Running shoes across the land are hurled to the back of the nearest cupboard, never to see the light of day again. Gym memberships are forgotten about. And new hobbies fall by the wayside.

The biggest problem with most New Year’s resolutions is their difficulty. Sure, the long-term gains might be amazing, but what about the months of pain and effort to get there?

But not all resolutions have to be difficult or doomed to failure. Take, for example, our list of easy cybersecurity New Year's resolutions. 

Unlike attempting a couch to 5k or taking up a new hobby, they don’t require hours of your time to see results. Nor do you need to go out and buy expensive new tools or overhaul existing processes. All it takes is a few tweaks here and there to get your business’s cybersecurity fighting fit for the year ahead.

And the best part? Once you’re in the habit, you’re unlikely to break them. 

1. Start patching and updating software regularly 

We bang the patching drum a lot at CyberSmart. Regular readers of our blog will have noticed we mention it at every possible opportunity. But, as repetitive as it might be, there’s a very good reason behind our love affair with patching.

Regularly updating your software and operating systems is the easiest, most time-efficient way to improve your cybersecurity. Even, the best software becomes outdated or develops gaps and, when it does, cybercriminals suddenly have an easy route into your business. 

Fortunately, avoiding the worst is incredibly easy and it shouldn’t take you more than a couple of minutes each month. All it requires is that you check every now and then for any new updates to tools and software you use. Or, if you want an even easier solution, simply turn on auto-updates in your device’s settings, and you won’t even have to think about it.

To learn more about patching, check out our recent blog on the subject. 

2. Create a password policy

Of all the resolutions on this list, creating a secure password policy is by far the simplest. Most of us know the importance of strong passwords, but that doesn’t stop us using the same easily-guessable phrase we’ve been using since 2001 for everything. We’re only human after all. 

The problem is this poses a huge security risk. It only takes a cybercriminal to crack one insecure password in your business for disaster to strike. But the good news is fixing it is simple.

Set up a password policy and ensure everyone in the business follows it. Often, it doesn’t take much more than a well-worded email and a few friendly nudges to get everyone on board.

What should go in the policy? Well, a strong password policy should have four key points:

• Use complex passwords that are a combination of letters, numbers and symbols. In-built browser tools like Google Chrome’s password generator are great for this
• Change passwords regularly
• Set up different passwords for different accounts, tools and software. If you struggle with remembering them, consider using a secure password manager tool like LastPass or 1password
• Use two-factor authentication (2FA) wherever possible 

3. Use encryption 

Encryption is one of those technologies that everyone has a vague notion they should be using. However, many of us get put off by misconception that it’s difficult to set up or hard to understand if you’re not a techy type.

In reality, this couldn’t be further from the truth. You probably already use encryption a lot in your daily life, you just don’t know it. Ever sent a message using WhatsApp? That’s encryption. Bought something from a web store? Encryption.

We won’t go into exactly how it works (if you’d like to know more we have a whole blog on the subject) but, essentially, encryption randomises data so that only an authorised recipient with a key can see it. 

Due to the complexity of the randomisation process, encryption is near impossible to break so it offers a level of security passwords alone can’t match. Better still, once you’ve set it up and are used to using it, it’s unlikely you’ll ever have to think about it again.

4. Make cybersecurity part this year’s budget

Attacks on SMEs now account for 58% of all cybercrime. What’s more, small businesses’ ability to absorb an attack is limited. Research from insurance and risk consultancy firm, Gallagher, found that over 50,000 UK SMEs would collapse if hit by a cyberattack.

Given the risks, you would expect cybersecurity to be top of most businesses’ budgeting lists. However, that’s often not the case. It’s not hard to see why; if you’re an SME performing financial wizardry each year just to keep things ticking over, cybersecurity can feel like a ‘nice to have’ rather than a priority. It’s this that leads to many smaller businesses making do with anti-virus and little else.

Unfortunately, firms who do this are playing Russian roulette without being conscious of it. Sooner or later, an enterprising cybercriminal will take advantage of weak defences, no matter how small your business. It’s a simple thing, but make 2021 the year cybersecurity features in your annual budget.

5. Get Cyber Essentials certified 

If you’ve heard of Cyber Essentials, you’re likely questioning this suggestion. Isn’t Cyber Essentials certification a long, drawn-out process that takes weeks to complete? It’s hardly fitting for a list of ‘easy’ resolutions.

Well, the truth is that getting Cyber Essentials certified can be like that. However, it doesn’t have to be. At CyberSmart we offer a Cyber Essentials certification process that can take as little as 24 hours, with no need for constant back and forth. We’ll tell you whether you’re going to pass before you submit and help you address any problems, so you only need to do it once.

Getting Cyber Essentials certified is a requirement for many government tenders and can protect your business from 98.5% of cybersecurity threats. But the benefits don’t end there. It’s also a great indicator of your business’s commitment to security, marking you out as trustworthy and safe to potential partners and customers.

So concludes our 2021 cybersecurity New Year’s resolutions. Although we’d recommend doing everything we’ve suggested, even adopting just one will noticeably improve your business’s cybersecurity. So why not kick the year off with a resolution you’ll keep? 

Looking to improve your cybersecurity but not sure where to begin? Start 2021 the right way, by getting certified in Cyber Essentials, the UK government scheme that covers all the fundamentals of cyber hygiene.