6 ways to prevent a security breach in business

As you would protect your business premises from intruders by investing in a strong lock and alarm system, so should you protect your IT infrastructure from being similarly infiltrated by criminals. 

Almost 10,000 small businesses in the UK fall victim to cyber attacks every day. The majority of those carrying out these crimes are not, contrary to popular belief, master criminals. Those

 super-skilled hackers are going after much bigger fish, such as multinational companies and governments, but cyber criminals still pose a very real threat to small- and medium-sized businesses. 

Any business that stores confidential information will be of interest to cyber criminals, who can sell that data on the black market. Many of the criminals targeting smaller businesses are opportunistic and looking for an easy way in – the equivalent of a burglar trying a front door to see if it’s locked, or looking for a key under a plant pot. 

Most small businesses do not have the relevant measures in place to protect against such an attack, either because they don’t believe they have anything of value to cyber criminals, they don’t understand how critical cyber security is for businesses of any size, or they don’t know how easy cyber security can be to implement. 

Why must businesses protect against cyber attack? 

Cyber attacks hit businesses hard. Not only is there the financial loss incurred through theft of information or money and disruption to business, but there could be reputational and legal consequences, too. 

Security breaches result in a loss of trust from customers, suppliers and business partners, while compromised data may lead to regulatory sanctions and fines for breaching data protection and privacy laws. 

Tackling your business’s cyber security doesn’t need to be difficult. Here are the six most important ways to protect your business from a security breach. 

1.Make a plan

Before you can implement an effective cyber security plan, you need to understand what it is, what is at risk and how that risk can be minimised. You must ask yourself key operational questions and audit your existing security measures. 

Consider questions including:

• What sensitive data does the business handle?

• How is it currently being protected?

• Where are the vulnerabilities in our network?

We have compiled a full list of the 12 key operational questions businesses must ask. It is a helpful starting point for anyone keen to improve their business’s cyber security efforts.

Once you have a plan in place, you will also need a disaster recovery plan. You must test your cyber security and practice your response to a security breach on a regular basis. 

2.Encrypt and back up all data

Encrypting and backing up your data is the number one thing businesses can do to secure their sensitive information from attack. 

Encryption

If it’s encrypted, even if it falls into the wrong hands, it is useless to them and you haven’t lost anything. 

Additionally, as long as your data has been backed up recently, ransomware attacks, which lock your files and demand money to unlock them, will fail. You can simply reinstate your latest back-up with little time lost or damage done and ignore the threat. 

Most modern operating systems, including Windows and OS X, have encryption built in, or you can invest in additional data-encryption software.

Back up

Backing up data not only protects it, but also allows you to recover essential operational data should it be lost through either an attack or hardware failure. 

Cloud storage is a great way to back-up your business data as it keeps the data off-site, protecting it from physical loss, such as flood, fire or hardware theft. It is also readily available from any device, anywhere.  

Cloud storage is already routinely used by businesses, such as with email servers, and its use is growing with the implementation of digital transformation. Cloud technology automatically backs up data, making it convenient and cost effective.

Before investing in any cloud technology, ensure you have considered their security credentials. The National Cyber Security Centre have a useful guide to cloud security for small- to medium-sized businesses.  

3.Invest in software – and update it regularly 

Cyber criminals are continually looking for software loopholes they can exploit, but so, too software developers are constantly testing their product and updating it to ensure it’s as secure as possible. Security breaches don’t look good for anyone.

Software updates are free and will go a long way in protecting your data from being breached. You should check for new updates or security patches routinely, at least twice a week, and take the time to install them. 

You must also make sure that all network users are following this procedure. A lot of updates will be installed automatically every time a computer restarts. However, it is common for employees not to properly shut down their computer at the end of every shift. This means they are missing out on these automatic updates, leaving your system vulnerable. 

4.Educate your employees

Cyber security awareness needs to be built into the culture of an organisation. It is not, and cannot be, the sole responsibility of the IT department. 

Your employees are the gatekeepers of your organisation’s security, but people are fallible and as such are the weakest link when it comes to cyber security in any organisation. 

If you are serious about addressing your business’s cyber security needs, you must prioritise educating your employees about the risks and what they can do to prevent any breaches. 

Take time to train your staff in what cyber security means, why it is important and the simple things they can do to help, such as properly shutting down their computer, using a password manager or understanding what a phishing attack looks like. 

To help get you started, check out the Government’s free online training courses to help business protect against cyber threats and online fraud.

5.Implement the usage of a password manager across the whole organisation

The use of strong, hard-to-guess passwords is even more important now that more employees are working from home or using additional devices to access your organisation’s networks, such as mobile phones and tablets. 

There are two schools of thought when it comes to passwords. The most important rule is that a password should be impossible to guess, so a truly random string of letters, numbers and characters, a minimum of six characters long, is non-negotiable. 

Whether you should get your staff to change these passwords on a regular basis or not, however, is the subject of much debate in the industry. 

Traditionally, IT departments encouraged this from their employees, however, many experts now believe that forcing people to constantly change their password is counterproductive. People hate having to remember yet another complex password and so, the more they are required to change them, the more likely they will fall back on easy-to-guess combinations or write their passwords down. 

The prevailing theory now is that a complicated, random password is the safest. But how can you help your staff to remember these? Implement a company-wide policy of using a password manager. There are several free password managers on the market, all with built-in encryption, such as LastPass, 1Password or Keeper.

6.Test and practice your response to a cyber attack 

Cyber threats are constantly evolving. Once you have cyber security measures in place, you must regularly test their effectiveness against new threats and practice your organisation’s response should a breach take place. 

Melius Cyber Security’s pioneering vulnerability-scanning technology, MELCaaS, automatically works in the background of your operational systems to carry out a daily simulated penetration test. This checks your network for any vulnerabilities and offers recommendations for eliminating potential risks.

MELCaaS is easy to use, requires no technical knowledge or specialist installation, and costs less than the price of a coffee per staff member per day.

Get in touch with us today to learn how MelCaaS can protect your business from the near-certain threat of an information security breach and receive your free mini Cyber Audit on your company URL and email. This will show if there are any security vulnerabilities on your website and what to do if there are. It will also show if there is any activity around your email address on the dark web.

Why not learn more about our current special offer for a years subscription of MELCaaS