1 – Ensure systems are properly patched & all Updates are installed and not left vulnerable.

Throughout your organisation you may use many different systems all of which may need to be updated from time to time. When an update is made available make sure that it is completed as soon as possible and that it the

system is updated on every device that it is used on. Using an old version of a system will leave you vulnerable and will put you at greater risk of being hacked. This includes operating systems, email, browsers, instant messaging, mobile device operating systems and any specialist third party systems that you may use.

Don’t forget that the UK NHS was crippled by Wannacry in 2017 as the result of reliance on unsupported versions of Windows that were no longer supported and had stopped receiving serviced updates some six months before the attack. Microsoft stopped supporting Windows 7 in January 2020 and any machines still using it will be increasingly vulnerable now that updates and patches are no longer being routinely provided.

2 – Plan your incident response.

The number of cyber-attacks and data breaches that occur is increasing at a rapid rate. It is very much a matter of when you will have an incident, not if. Therefore, you need to make sure that your company knows how to respond in such situation. You should be asking yourself questions such as:

• What would you do if the worst happens?
• If your entire system went offline how would you work out the method by which you have been attacked?
• Would your back – ups and fail safes work when you need them the most?
• Would your staff in different locations know what they are expected to do?
• Who would you report the incident to? It might be external hackers have compromised your system and are demanding a ransom for you to regain access to your data. Can you report this at your local police station?
• How long is it likely to take for your organisation to recover from a large scale cyber attack?

3 – Minimise logons from unauthorised locations and devices.

In recent times a lot of companies have decided to adopt remote working to allow flexibility within their workforce. If this is something your company allows you may want to consider limiting logons to specific authorised IP addresses and to specific authorised devices in order to ensure only those with authorised access can get into the system. This adds an extra barrier between your system and the cyber-attacker.

4 – Block known attack sites.

Many systems can be set up to blacklist websites that are known common sources of cyber-attacks. By putting such systems in place to block these types of sites can limit exposure to most common threats. Hackers no longer need sophisticated knowledge and experience – some complex yet easy to use tools can be accessed for just a small fee from the dark web and used to devastating effect. By blocking the known sources of the majority of attacks risk can be commensurately reduced.

5 – Introduce multifactor identification.

Adding two factor or multifactor identification to your systems and devices will not prevent a cyber-attack however it may minimise the risk. It will take a lot longer for a determined attacker to breach your defences and gain access to your systems. This will hopefully motivate them to move on to an easier target.

All of the 5 above points are good ways to reduce risk. However, the most important point to take from this blog is training. You may have heard this before but providing your staff with cyber security, phishing and data protection training is essential. If they don’t know what a cyber-attack, data breach or phishing is how are they meant to help you prevent a breach from occurring. Your staff are your first and best line of defence. They can ensure that a phishing email is safely dealt with, that a spurious attachment sent via social media should not be opened and, in the event that an attack takes place staff need to know what needs to happen and in what order for your organisation to swiftly bounce back.