17
Special Report
software within your organisation. “Most business PCs are built to a standard which includes all the soft - ware which the user needs to do their work. There’s rarely any need to add to this. So, if you deploy an ‘applica - tion control’ system which only allows software within that standard build to run, then any ransomware attempting to execute will simply not work. It’s like the bouncer on the night club door – ‘if you’re not on the list you’re not coming in’,” he says. He adds: “This approach avoids all the grey areas around the complicated
es jumped 152% globally between 2021 and 2022, outlining a trend that sees hackers moving away from ‘big game’ and increasingly targeting the mid-market. “Malicious actors are increasing- ly targeting SMEs – either to gain access to their sensitive data or to reach larger organisations through the supply chain – but despite the risks, SMEs don’t necessarily have the skills or resources to build an advanced security architecture,” observes Censornet’s CTO Richard Walters. So, what steps can SMEs take to defend against ransomware? The re - ceived wisdom within cyber security used to be that firms should have multiple vendors of firewall technol- ogy to prevent a ransomware attack. However, having seven or more dif - ferent services to manage risk often requires a bigger team of IT security engineers, which SMEs don’t typically have the capacity for. Our security experts agreed that smaller firms would do well to kick start their security by learning to do more with less – consolidating security solutions to a single platform to manage the number of alerts that come through. “Operating one single platform is eas - ier to manage, eliminates complexity and enables business to respond to more complex threats at faster speed and with greater accuracy,” says Walters. Forcepoint’s Willshire advises SMEs to create a unified strategy with a product “that can encompass the en - tire environment instead of a patch - work of products that can introduce risk inadvertently”. Others point out that there are also plenty of free or inexpensive meas - ures that provide effective baseline protection against known risks. Illing - worth of NormCyber, suggests setting passwords to three random words. “Organisations needn’t bother with numbers and symbols anymore – cyber criminals can crack passwords like ‘BusinessName2020!’ almost instantly. Instead, the NCSC now advises organisations to use three
random words, made up of upper and lowercase letters.” Illingworth also points out that multi-factor authentication is a free feature built in to most software applications today. “Even if a cyber criminal obtains the password, a unique six-digit passcode is often enough to stop them from gaining access to vital accounts – it’s your second line of defence.” Keeping systems updated, rather than ignoring updates and installing antivi - rus software are other key measures all firms can take. Training Given that the weakest link in any organisation is generally agreed to be its people, Mark Brown, a behavioural psychologist and founder of cyber security training platform Psybersafe, believes that arming employees with training is an essential part of ran - somware prevention. “Cyber security is all about human behaviour. Every individual is a potential target.” Mark Brown, Psybersafe “Cyber security is all about human behaviour. Our research shows that the biggest issue in developing a cyber secure workforce is target awareness – the realisation that you and I – every individual is a potential target. “Once a person accepts this and believes it, their motivation to pay attention to cyber security messages increases, as does their willingness to adapt their behaviours and current ways of doing things,” he says. However, Brown adds that taking a ’tick-in-the-box’ approach, provid- ing a video or webinar once or twice a year, just doesn’t work. “Training
Nigel Thorpe, technical director at Secure Age
effort of trying to work out if every application, script or macro is likely to be malicious or not; it’s a simple case of checking to see if it’s on the list or not.” Given that ransomware attacks are rapidly evolving to counter preventive technologies, experts also believe that firms should also be taking a less static and more strategic approach to defence – which involves looking at recent data and pinpointing the most likely threats. Securing SMEs Research from cyber security risk rating firm RiskRecon reveals that data breaches within small business -
techinformed.com
Powered by FlippingBook