First published 31/10/2022, updated 31/10/2025
Appropriately my final article in this series falls on Halloween!
The story so far
With the recent high profile cyber-security breaches at Marks & Spencer, Jaguar Land Rover and Harrods to name a few, it may be a good time to review your own cyber-security. Do not think as a small organisation you are of no interest to cyber-criminals, small businesses are breached every day and are often easy pickings.
Today’s cyber-criminals are constantly developing more advanced techniques of attack and your cyber-security strategy needs to take a layered approach utilising the latest tools to proactively protect and monitor your IT environment.
Just to recap on what I have covered this month, to help you develop your cyber-security strategy and keep those cyber-ghouls at bay:
User Awareness & Security Culture
Cyber Security is not just about implementing technical measures and controls to secure your data, a business should instil a culture of security awareness in all its staff. Data security should be seen as everyone’s responsibility. Unfortunately your users are often your weakest link, with around 85% of breaches coming from phishing attacks. Read More…
User Account Security
Protecting your user accounts and data by utilising the principle of least privilege, device security, Multi-factor Authentication (MFA) and a Password Manager. Read More…
Advanced Threat Protection
Advanced Threat Protection (ATP) works directly in Microsoft 365 and detects and neutralises cyber-threats before they even reach your endpoints and users.
ATP is an email filtering service that helps protect your business against unknown malware and viruses by providing zero-day protection and safeguarding against phishing and other unsafe links, in real time. Read More…
Advanced Phishing & Malware Protection uses advanced AI to identify trusted profiles from your employees business relationships and then adds a clear interactive banner on suspicious and un-solicited emails, giving your users the option to Mark as unsafe, Block as junk, or mark as safe. Marking an email as unsafe or junk immediately removes the email from the user’s inbox. Read More…
Endpoint Security
Traditional anti-virus is no longer adequate to detect and respond to the advanced nature of today’s cyber-threats. Every device that employees use to connect to your business networks and systems represents a potential risk that cyber-criminals can exploit to gain access to your company data. Continuous monitoring of those devices is critical to ensure they remain secure. Read More…
Securing your email with DMARC Email Authentication
Over the last few years, the occurrence of email fraud such as phishing and spoofing has been rising to such an extent that it is now a real threat to any organisation of any size. Securing and authenticating your email delivery has become essential and no longer optional. Read More…
Software Patching and Updates
Operating systems (OS) and application software are constantly updated to release new features and to fix bugs and security issues. Unpatched OS and applications can leave your computers vulnerable to cyber-attacks. Read More…
A combination of some, or preferably all of the above should be used to enable a robust cyber-security strategy to enhance Prevention, Detection and Response.
Be prepared
Even with the most robust cyber-security strategy in place, there is still a risk your business could suffer a security breach and/or data loss. All businesses should have a Disaster Recovery (DR) plan in place to be prepared for the worst.
Don’t assume you are not a target, approximately 43% of cyber-attacks are targeted at small businesses. Cyber-crime can cost your business time, money, reputation, and customers.
Backup
Despite the importance of digital data to any business, most small businesses and charities do not have adequate backup and disaster recovery plans in place.
It is estimated that 60% of small businesses, who do not have a backup plan in place, will close within six months after experiencing a significant data loss.
Should the worst happen, you need to be confident that you can recover systems and data as quickly as possible, with minimum impact to your business and your clients.
Cloud services such as Microsoft 365 are great environments for businesses of any size as they provide a very resilient and redundant infrastructure that is available from any location. However, your data within them is still susceptible to ransomware and deletion by cyber-criminals.
For more information on backup and DR see my previous article Are you backing up your Business Data?
What the future holds…
The great thing about technology is that it is constantly changing and evolving, as well as the benefits this always brings risk.
The more recent advancement and availability of Artificial Intelligence (AI) for example, brings many benefits such as advanced analytics, automation, improved productivity, and advancements in medical applications. AI is already being used in cyber security applications for advanced analysis and rapid detection and response to cyber-threats.
Unfortunately the technology will also enable cyber criminals to develop more sophisticated and convincing attacks, so please be vigilant!
One newer security technology that has been gaining traction over the last year, which are already supported by the larger technology companies such as Microsoft, Apple and Google are passkeys. Passkeys will eventually replace passwords and are more secure and less easily compromised. You will no longer be required to remember a multitude of passwords and will only require a username and biometric authentication to login to services in the future.
I will be discussing passkeys in more detail in a future post.
Happy Halloween and don’t let those cyber-ghouls get you!
I hope you have found this series helpful to develop your own cyber-security strategy.
If you require any further help or advice, please Contact Us
