Have You Considered These Risks to Your Business?

The dangers of cyber risks and threats to a business aren’t at the top of the agenda for many small and medium sized companies, but they should be. In recent years, the increase in high-profile data breaches has increased dramatically, and affected millions of people globally.

And because of the increasing commonality of these threats, society is becoming somewhat desensitised to the alarming numbers of risks that affect thousands of large-scale corporations that hold masses of personal information.

It’s often reported that big businesses are hit all the time. For example, Facebook, Tesco Bank, Talk Talk, Travelex and Three Mobile are recent prime examples. It can be forgiven to think that start-ups and small businesses are less of a target, but the reality is that no business, big or small, is 100% safe in the current climate. In fact, International Data Corporation (IDC) recently revealed that approximately 71% of data breaches are now targeted at small businesses.

What is a Risk and what is a Threat?

Before you strategically plan how to prevent your business from being affected by cyber-attacks, it’s essential to understand the difference between a risk and a threat.

Risks are business issues with technical aspects that impact, and is impacted by, all areas of the organisation. The risk element is the potential for uncontrolled loss of something of value, so in the case of data, this would include sensitive information or programs, for example.

A threat can be both unintentional and intentional, targeted or non-targeted attack. A threat can come from a variety of sources, including foreign nations engaged in espionage and information warfare, criminals, hackers, scammers and even disgruntled employees and contractors working within an organisation.

In a nutshell, a risk means the potential for loss, damage or destruction of an asset due to a threat exploiting a vulnerability. While on the other hand, a threat is what we’re trying to protect against. This can be in the form of vulnerability, weaknesses or gaps in a security program that can be exploited by threats to gain unauthorised access to an asset.

In most cases, small and medium sized businesses will deploy several technical defences such as Firewalls and Anti-virus software to protect their organisation from such threats. While these technical defences help protect the business, additional steps do need to be taken.

These additional steps are often forgotten about or not considered as they aren’t seen as technologically positioned, but they are a critical starting point for reducing the overall risk to the organisation. These additional steps include:

Leadership

In all organisations, information security needs to be driven from the top down. Most information security initiatives will fail without the support and sponsorship from the Board. The information security strategy needs to align with the business strategy and objectives to ensure the business is doing all it can to prevent serious attacks.

Behaviours and Culture

Information security isn’t just about technology, people also play a critical role. Everyone in the organisations plays an active role in information security and should be tooled with the knowledge on what to do and what not to when faced with a cyber risk or threat.

Asset Management

The organisation should maintain an up to date asset register of hardware and software in use within the business. Each asset should be assigned an owner and a level of criticality. As the saying goes, “you can’t protect what you don’t know you have”.

How can I mitigate these Risks and Threats?

Leadership

Leaders of any organisation, big or small, must have support from the Board or whoever is the ultimate decision-maker and change-enforcer of the business. First and foremost, it can be beneficial to become Cyber Essentials accredited. Cyber Essentials helps guard you against the most common cyber threats and demonstrate your commitment to cybersecurity.

A business must align the information security strategy with the business strategy and objectives, ensuring that this is communicated with all employees. To get started and equip you with the tools, the National Cyber Security Centre (NCSC) offers a comprehensive toolkit designed to encourage essential cybersecurity discussions between the Board and their technical experts. They also provide a free service called ‘Exercise in a Box’ which can help determine how resilient a business is to a cyber-attack.

Behaviours and Culture

The practical implementation of a measurable security awareness program can be incredibly beneficial in mitigating cyber risks and threats within a business. A security awareness program should include security news on the latest threats, information posters and regular employee training to enable your employees to detect threats within the business. What’s pivotal to employee security awareness is that they everyone within the business, no matter job role, should be trained on who to report any security threats and suspicious behaviour to.

Asset Management

Asset management is vitally important. Every piece of hardware and software that’s used within your business must be accounted for. If not already in place, the first thing to do is to create an asset register of all hardware and software within the business. Use the register to prioritise the implementation of security controls, starting with the most critical assets first.

How can CYAN help your business?

When it comes to the cyber safety of your business, it’s our number one priority. When you choose Cyan, we follow steps to ensure your business is safe against the ever-growing cyber risks and threats. Here’s how:

  • We start by understanding your business
  • We assess the security maturity of your people, processes and technology
  • We identify risks and provide recommendations
  • We can create and implement a security strategy to reduce risk within your organisation
  • We can provide and manage the latest technology to secure your company assets
  • We can provide the platform and expertise to deliver a security-aware business

For more information on how we can help secure your assets and data, get in touch.

What Is Cyber Insurance and Does My Business Need It?

Cyber-attacks are not a new phenomenon, but they are, unfortunately, on the rise. A cyber-attack on your business can be utterly detrimental, leaving computers and computer networks exposed, disabled, and even destroyed.

Due to the rise in cyber-attacks, cyber insurance (also referred to as cyber risk or cyber liability insurance) has become a hot topic in recent years, and it makes sense as it’s always better to prevent a cyber disaster than deal with the consequences. Cyber insurance pretty much does what it says on the tin; it’s a type of insurance for businesses that’s put in place for digital threats. With so many cyber threats affecting businesses, no wonder it has become a highly popular service for SMEs and businesses, large and small around the globe.

Should My Business Have Cyber Insurance?

In a nutshell, yes. Your business more than likely should have cyber insurance in place. However, it’s important to understand what it does and doesn’t cover.

What are the Benefits of Cyber Insurance?

As technology continues to become increasingly important for a business to operate successfully, the value and need of a robust cyber-insurance policy will continue to rise. No matter the size of your business, its location or industry, the technological nature of the modern-day world exposes vulnerable businesses to cyber-threats every single day.

A cyber-attack will not only threaten your finances and disrupt your operations, but it can also tarnish the reputation of your business. In order to protect your business from the devastating effects of a cyber-attack, it’s essential that you protect yourself with a strong cyber-insurance policy that covers all grounds.

10 of the most significant benefits of taking out cyber insurance are, but not limited to:

  1. Forensic support – When you have cyber insurance in place, forensic support provides your business with near-immediate around the clock support from cyber specialists following a data breach or hack. They will be able to confirm the impact of the breach and establish solutions.
  2. Consultancy fees – Your insurer may reimburse any costs of a consultant that has helped manage a response or solution to the incident.
  3. Interruption of business – If your business experiences an IT failure or cyber-attack that disrupts the operations of the business, your insurer may cover your loss of income during the interruption. In addition, increased costs to your business operations in the aftermath of a cyber-attack may also be covered.
  4. Privacy breach costs – A breach costs clause is a single clause that provides cover for security breach costs, such as notifying customers or recovering files.
  5. Privacy liability clause – A privacy liability clause provides cover for privacy infringement claims plus any legal costs in the event of a cyber breach. This is critical for all businesses that handle or store personal information in line with GDPR.
  6. Cyber extortion – A policy may cover your business if it’s infected by ransomware or other malicious software that attempts to seize control of or withhold access to operational or personal data until a ransom or fee is paid.
  7. Digital asset replacement expenses – In the event that your business’ digital assets are corrupted, lost, or altered in any way by a cyber-criminal, your policy may cover the costs incurred.
  8. Reputational damage – Your policy may recover lost profits directly attributable to cyber-attacks. Particularly those that have been detrimental to the reputation of the business and/or any of its employees.
  9. Management liability – Your policy may cover costs associated with defending senior management from cyber-attack fallout.
  10. Restoring data – After a massive security breach, your insurer can help to cover costs for restoring vital business data.

While there are many benefits to having cyber insurance in place, it’s equally important to understand what’s not included. For instance, if you’re using outdated or unsupported software or systems, many cyber insurance policies will not cover you.

Examples of this are using end of life operating systems such as Windows 7 or end of life equipment such as a Firewall that is no longer receiving firmware or security updates. However, when you do choose to take out cyber insurance, speak with the insurer about the terms and conditions and what potential breaches could affect your policy.

How Much Should I Expect to Pay for Cyber Insurance?

First and foremost, when it comes to buying the right cyber insurance for your business, what’s important to understand is what your business’ assets are worth. An example of an asset could be a laptop, workstation, server or database, and, more importantly, the information or data that it contains.

In most cases, a robust cyber insurance policy will cost in the region of £1000 per year. It’s also important to invest in training employees to recognise and react at the first signs of cyber compromise. Often, cyber insurance can create a false sense of security, so splitting your budget between a robust cyber security policy and trained and knowledgeable staff can strike the perfect balance.

Something to remember is that once you’ve taken out an insurance policy, you shouldn’t just leave it and get on with things. Your cyber insurance policy should be reviewed regularly and updated based on the continually evolving needs and current cyber-threat dangers directly related to your business. Above all, invest your budget wisely with a certain per cent in preventive controls with the leftover percentage invested in insurance.

What Level of Cover Do I Need?

The insurance policy requirements of every single business will differ based on a number of factors. But a good starting point would be to speak with different insurers to see what they can offer you. Things to consider include, but are not limited to:

  • The amount of sensitive information stored
  • Where sensitive or confidential information is stored
  • What measures would need to be taken if your business experienced a data breach
  • What the costs would be to replace the damaged software/hardware
  • Does your business have trained employees to mitigate the damage?
  • Does your business require the assistance of external security specialists?
  • Does your business have PR staff to deal with crisis management if a data breach occurred?

Answering the above questions and gathering as much information about your business as possible will help you get an idea of how much insurance coverage your business may require.

How to Pick the Right Insurance Provider?

It’s essential to shop around and speak to different providers, understanding what each can offer your business in times of crises. Word of mouth is the strongest form of marketing, so it may also be beneficial to speak with other industry professionals for recommendations.

At Cyan, we’ve got a great track record of helping small and medium-size businesses put the right cyber security measures in place. We can work with you to develop a strong cyber security policy document that will act as a protective umbrella for your business. We can also help audit and review any policy that you may already have in place to ensure that it is fit for purpose. Contact our expert team today to find out more.

How to Create a Cyber Security Policy for Your Business

Whether you are a new start-up, an existing small or medium size business or a large corporation, dealing with cyber security risks is vital in the modern commercial environment.

According to the Government’s Cyber Security Breaches Survey 2019:

  • Nearly a third of businesses have identified cyber security breaches or attacks in the last 12 months.
  • This resulted in a negative outcome, such as a loss of data or assets, in 30% of cases.
  • Only 33% of companies have a cyber security policy in place.

This last statistic is astounding when you consider the threat from cyber criminals that we face at the moment. While a cyber security policy can’t fully guarantee you won’t become a victim of cybercrime, it greatly improves your chances of avoiding a breach and gives you the tools to respond if one does occur.

What is a Cyber Security Policy?

All businesses have certain assets, including data and software, that they need to protect. A cyber security policy is a formal document that can be used by a whole range of stakeholders to understand their responsibilities and what measures are in place to protect the technology and assets of the business.

Most importantly, it is not a document that is set in stone. It needs to be reviewed regularly and updated to respond to current and future cyber security threats.

Who Should Be Involved in Creating Your Cyber Security Policy?

A cyber security policy is not simply put together by your IT service provider. It involves input from a wide range of individuals. That includes management and leaders within your organisation, HR departments that may need to enforce dissemination of the policy to employees, and even a legal team who may need to input on the wording of the document.

Main Elements of a Cyber Security Policy

The core part of your cyber security policy should outline the risks that your business faces and why the measures you are taking are important. It should also outline who is accountable for implementing the policy and the processes that need to be followed in respect of a breach, including following current GDPR guidelines.

Obviously, the complexity of the cyber security policy will depend on the size of the business and the number of different departments that may be affected.

From the perspective of employees, providing guidelines on the daily use of technology within the business is also important. It should include guidance on:

  • Password control: including how to store passwords, how to create robust passwords and how often these must be updated.
  • Email protocol: including how to spot potential phishing emails, not opening links or attachments from dubious sources, deleting suspicious communications and methods for blocking spam, scam or junk emails.
  • Dealing with sensitive data: including how data such as customer details are stored, how they are used and who has access to them, as well as measures for deleting data that is no longer needed or legally required.
  • Using removable devices: including the safe use of USB/flash sticks and preventing malware attacks by scanning before opening removable devices.
  • Using technology and hardware: including using BYOD and accessing hardware such as laptops outside of the business environment.
  • Social media and accessing the internet: including protocols for what is appropriate information about the business to share on social media and guidelines on which sites are allowed to be accessed during work hours.
  • Managing cyber security breaches: including who takes the lead and has responsibility, who needs to be informed, and what action must be taken.

The last point is an important one for all businesses nowadays, especially in light of the introduction of the General Data Protection Regulation in 2018. Businesses that don’t have the appropriate measures in place and fail to follow the current guidelines not only face damaging their own reputation they can be liable for huge fines or prosecution.

Auditing Your Cyber Security Policy

As we said at the beginning, your cyber security policy should be a live document that is regularly updated. There should be regular times where the policy is reviewed and assessed in line with current business goals and cyber security threats. This should include:

  • How the current cyber security policy is working in the real world.
  • The exposure of your business to both internal and external threats.

Using Your Cyber Security Policy Properly

It happens in a number of businesses that the cyber security policy is developed and covers all the bases required. Unfortunately, it is not disseminated properly to those who need to know. If you have a policy that is stuck on the equivalent of a shelf gathering dust, it’s not going to be much use.

Included in the policy and implemented by your business in the real world is how this information is going to be conveyed to relevant stakeholders, including employees. That can involve, for example, training new and existing staff to spot phishing emails, regularly updating the current security threats facing the business and ensuring that robust passwords are used for accessing data and software.

How Cyan Solutions Can Help

There’s no doubt that cyber security is a serious concern for businesses across the UK, whatever their size. It’s also a huge challenge to get all the pieces in place that deliver the protection individual businesses are looking for.

Creating a cyber security policy is a vital process in setting up the infrastructure to keep your business safe online. You cannot entirely trust, for example, that all your employees will follow the right protocols all the time. But you at least need to have a formal document that outlines and reinforces what their responsibilities are.

At Cyan Solutions, we’ve got a great track record of helping small and medium-size businesses put the right cyber security measures in place. We can work with you to develop a strong cyber security policy document that will act as a protective umbrella for your business. We can also help audit and review any policy that you may already have in place to ensure that it is fit for purpose. Contact our expert team today to find out more.

IT Security Strategy: What You Need to Know

Most businesses are critically dependent on the internet. Survival means having a strong IT security strategy in place. The hacking of telecommunications giant Talk Talk in 2015 reminds us that it’s not just smaller businesses that are at risk either.

The Government has taken steps to build a national cybersecurity strategy and this acknowledges that threats can come from many different sources: foreign governments or state sponsored actors, terrorists, hackers, hacktivists concerned about a particular issue, and even insiders, people who work for a company and who have a grievance of some sort.

Protecting your business has never been more important or more challenging. Having the right tools and processes in place is key if you want to stay safe.

How to Develop an IT Security Strategy

The digital landscape has become increasingly complicated over the last couple of decades. Businesses will not only operate online through portals and third-party sites but use tools such as social media to market their services and products. On top of that, they will have key IT requirements within their office environment that need solutions. Many will use remote working and promote collaboration and better communication through cloud-based services.

All this means that there is no clearly defined, one-size-fits-all IT security strategy for modern businesses.

1. Understand What You Have

The first major step to developing the appropriate IT security strategy is defining what you are trying to protect in the first place. Yes, you may have lots of customer and employee data but what about documents relating to your business such as your plan for the future or a new product you are intending to bring onto the market?

To make sense of everything, you need to understand what each asset is and clearly define its value to your business.

2. IT Security Risk Assessment

The next part of the process is to look at the current state of your IT security in relation to these assets and whether it fulfils its purpose. A risk assessment looks at a range of different aspects of your business, including the software you have in place, who has access to data, what they do with it when they are using it, and what protocols other than digital that you have in place to ensure security.

3. Elements of Strong Cybersecurity

The Government has produced a useful infographic (download here) relating to IT security which includes 10 steps all businesses and organisations should be taking:

  1. You need to implement a risk management regime that allows you to regularly review your cybersecurity processes.
  2. You must protect your network from attacks using anti-virus software and other technological solutions.
  3. You need a process in place to educate users and build awareness through activities such as staff training and the production of easy to follow practices (such as having a definitive password policy for your business).
  4. You need to establish anti-malware practices and defences to protect your business like having the appropriate software and educating staff on threats such as phishing emails.
  5. You need to limit or control the use of removable media such as flash sticks which can hold malware.
  6. You need to update your systems when a new patch or update is available and ensure they are configured properly across your whole business.
  7. You should carefully manage user privileges particularly for parts of your network that have access to sensitive data.
  8. Your business should have a process in place for handling any breach incidents or disaster recovery and be able to test these plans. If you lose data for whatever reason, being able to get up and running again may be vital to the survival of your business.
  9. Your business also needs to have in place a system or protocol for monitoring your IT and cybersecurity, producing reports and understanding if you are at risk of attack.
  10. You need to develop a policy for home and mobile working especially if you advocate using BYOD. Your company needs to create a secure baseline for all devices and build this into its cybersecurity activity.

While many businesses will be able to implement some of these measures, it can be challenging to get them all in place. That’s why it’s important to work with an IT and cybersecurity specialist to make sure all the bases are covered.

At Cyan Solutions, we have the teams in place who will be able to help you develop a robust IT security strategy that will safeguard your business now and in the future. Contact us today to find out more.

Essential Recommendations for Business IT Security

One of the key factors that effects almost every business with a digital profile is IT security. It’s a constant challenge to get right whether you are a small start-up or a large corporation.

Unfortunately, there are organised criminal gangs in this world who are fixed on trying to do us harm. It’s something that has been with us since the birth of the internet.

The biggest question we get asked at Cyan Solutions, is what best practice can be employed to ensure better business IT security.

Here’s a list of things you can do right now to help protect your business:

1. Don’t Assume It Won’t Happen to You

This is something we find with many SMEs. They think they’re too small for hackers to worry about. It’s simply not true.

Most attacks come through automated delivery such as Phishing email. The hackers and malware developers are looking for someone, anyone whose system they can get into. Whether you are just a one-person outfit or have many staff, treat cybersecurity with the same level of seriousness as you do other aspects of your business.

According to a recent report by Verizon, 71% of cyberattacks happen to smaller companies with less than 100 staff on the payroll. That is in part because there are more of them but the clear message is to be aware and have robust cybersecurity policies in place.

2. Use a Firewall

The first line of defence against cyberattacks is an effective business-grade firewall. Think of this as a barrier that repels common attacks and prevents malicious threats getting to your network. Companies often neglect to invest in this area as they don’t understand the importance of good perimeter security. They assume a generic router does the same job, it doesn’t. You need to improve network security measures if you want to remain safe online.

And, it’s not just external firewalls that are important – if you have sections of your network that contain sensitive data, for example, you may want to protect these with additional cybersecurity measures.

3. The Challenge of BYOD

Bring Your Own Device (BYOD) has largely been accepted in the business world over the last decade after some initial reticence by employers. It can often be easier for an employee to use their own smartphone or tablet or even laptop to do their work.

The trouble is that these are not generally as secure as the hardware and software that you have for your business. Staff can download the wrong apps or visit the wrong sites that open them (and your business) to potential cyberattack.

This is something that is unlikely to change in the future. BYOD offers too many benefits. The challenge is to make sure that mobile devices are updated with the right security and that staff understand their obligations.

4. Having Comprehensive Cybersecurity Policies

This brings us to the strategy for your cybersecurity protection. All businesses, whatever their size, need to have a robust set of policies that staff can adhere to. Many smaller companies do this in an ad-hoc manner which can mean their business IT security is missing vital core components. Ensure that you document your policies and make them readily available to all members of staff – including senior managers and executive teams.

5. Password Protection

It might seem like a simple thing to include in a best practice list but passwords are a real issue for businesses. Enforcing a robust policy in this area is important and could well protect your business from cyberattack. Passwords should ideally include upper- and lower-case letters, symbols and numbers. For more sensitive areas of your business, you also want to consider multi-factor identification.

It might seem like a simple thing to include in a best practice list but passwords are a real issue for businesses. Enforcing a robust policy in this area is important and could well protect your business from cyberattack.

Passwords – when implemented correctly – are an easy and effective way to prevent unauthorised access to systems. Always change the default password that comes with a new device.
If two-factor authentication is available, make sure it is enabled and use it. A common and effective example of this involves a code sent to your smartphone which you must enter in addition to your password.

6. Educating Staff

One failing, particularly for smaller businesses, is not educating their staff on the right IT security protocols. There’s plenty of evidence to suggest that, even if a company has a password policy in place, in the majority of cases it is not enforced.

You have to bring your staff into the loop and make sure they are well educated with regards to cybersecurity risks. For example, User Awareness Training is a great way to educate staff to the dangers of email threats, such as Phishing attacks, which are not always easy to identify.

7. Regularly Update Your Devices and Software

It’s quite worrying the number of small and midsize businesses that do not make the effort to patch their systems, devices and software. Manufacturers release regular updates which not only add new features, but also fix security vulnerabilities that have been discovered. Applying these updates (a process known as patching) is one of the most important things you can do to improve security.

8. The Right Level of Protection

Finally, the fight against cyberattacks is a never-ending battle and you should have the appropriate virus and anti-malware software in place which is regularly updated. One big mistake businesses make is to assume that standard anti-virus software alone is adequate protection for their needs. How security should be tailored to better protect your organisation is something you need to discuss with your IT provider. Understanding what threats are targeting and putting additional layers of security in place to protect against them is an essential part to any cybersecurity strategy.

At Cyan Solutions, we deliver cutting edge IT services and support. If you want access to the best cybersecurity expertise for your business, tailored to your needs, contact our team today.

Digital Transformation Of Social Housing – Top Five Trends

It is necessary for every business in every industry to adapt and change their business model to accommodate their customer’s changing behaviours and expectations, and housing associations are no exception. Digital technology is not only about conversions, transactions and growing revenue; it is vital for streamlining processes, optimisation and improving the customer experience.

As digital technologies take the world by storm, embracing these is vital for a housing association to grow and thrive. Some have already begun to tackle this challenge by transforming their IT infrastructures to keep up the high demands of today’s digital world.

Social housing is a rapidly changing industry with many housing associations struggling because of funding cuts, rent freezes and reduced investments. When it comes digitalisation, the social housing sector is not as far advanced as other industries, with many housing associations sceptical of investing in a digital transformation or not having the budget to do so.

However, this is slowly beginning to change as more and more housing associations are starting to see the benefits of going digital. Here are the top five trends we expect to see a rise with the digital transformation of social housing:

Five Digital Trends For Social Housing

 

1. A Remote Workforce

With the rise of cloud technologies, it is now possible for housing association teams to work remotely, allowing them to focus their time and energy on being out among their tenants. Having a digitally enabled and mobile workforce reduces the need for physical office locations within neighbourhoods.

Remote working allows workers to be more connected with those that need help the most. Less time will be spent on the mundane transactions, and more focus can be made on what really matters; enabling the organisation to become more human with greater face to face interactions.

2. Online Processes

Embracing advances in technology can reduce the amount of paperwork and manual processes required. Customer applications can be moved online which will not only provide a seamless and easy experience for customers but also reduce costs and response times compared with manual, offline applications.

Removing paperwork will free up resources for employees to focus their time and effort on other areas of the business. Moving transaction processes online also offers excellent cost savings for housing associations, with online payments being 20 times cheaper than phone transactions and an incredible 50 times cheaper than face to face.

3. Better Connected

The Internet of Things (IoT), connected devices and smart metres offer a great opportunity for housing associations to diversify their offerings. Embracing these innovative technologies within social housing can detect how people are using their accommodation and allow providers to alter services, such as heating, in real-time.

When used effectively, this technology can help housing associations to anticipate and handle issues faster, as well as be more proactive and strategic in commissioning repairs or replacements quicker in order to minimise costs and disruption.

4. Enhanced Customer Service

One of the most significant benefits that digitalisation has in the social housing sector is that customers will receive a better all-round service. Advice and help can be made available 24 hours a day, seven days a week with the help of a knowledge base and online account information that is always accessible.

The digital transformation of the housing industry will allow most actions to be completed online, meaning customers have no restrictions on when they can resolve their issues or speak with the correct department. Housing association workers will also be able to provide a better service to customers by spending more time out in their neighbourhoods offering a face to face service as opposed to stuck behind their computer screens.

5. Data Analysis and Record Keeping

In a world of GDPR, there are some real benefits to those within the social housing sector making a move to keep all customer data and records online as opposed to offline. A well planned online infrastructure can provide greater security for keeping online records safe and secure.

Utilising digital technologies for customer data is also an excellent opportunity for better data analysis and upkeep. Maintaining customer records online allows them to access and edit them as required, providing housing associations with current information that is easy and simple to manage.

How to embrace these digital trends

Embracing the digital transformation of social housing will bring significant efficiencies, financial stability and customer engagement. Currently, the social housing sector is being squeezed by reduced investments, funding cuts and rent freezes. At the same time, there is a growing demand from increasingly vulnerable and diverse citizens. Those housing associations that want to thrive rather than simply survive should be utilising and embracing digital solutions to transform their organisation for the better.

To help your housing organisation transform, speak to our IT specialists at Cyan Solutions. We can help your team to implement a digital strategy that can cut costs and increase the service experience.

Top 5 Ways To Avoid Phishing Emails

Five top ways to prevent phishing attacks

Cyber attacks are on the increase, and it is vital to protect yourself and your business against the rising security threats. For most companies, the employees are the weakest security link, leaving the company open to potential attacks and breaches. Over 90% of cyber attacks start with a phishing email, and recent studies suggest that the fastest growing security threat to businesses is no longer malware but impersonation email attacks.

The reason employees are often the weakest link in your security is due to human error, and cyber attackers have learnt it is easier to trick someone into revealing secure information such as logins and passwords, rather than trying to exploit a secure system. The number of impersonation email attacks sent has increased by 50% quarter-over-quarter compared with malware and harmful files being sent rising by 15%. This means your business is seven times more likely to be subject to an impersonation email attack than a malware attack.

The figures are staggering, and even still there are thousands of companies out there who are not doing everything they can to protect themselves against phishing emails. The most common type of phishing emails is spear phishing; a highly targeted scam email that is sent to a business or individual. If the cybercriminal does enough research into an individual or business, spear phishing can be very effective, and research has shown that 97% of individuals can be tricked by a spear phishing email attack. Here are some of the top 5 ways to avoid phishing emails and protect your business.

Invest In Your Systems

One of the best ways to protect your business from phishing emails is to prevent them from getting through to your employees in the first place. There are many technological approaches to avoid phishing attacks, such as powerful filters and protection systems. Implementing a smart security system can help to identify phishing emails and block them from being received by your employees.

This is a great place to start when it comes to avoiding phishing emails, but even the best technology can’t detect every single phishing email. There will always be some that slip through the filters, so it is vital to have other precautions in place as well.

Educate Your Employees

As personnel are often the biggest downfall for a company’s security, it is essential that they are provided with appropriate training and knowledge to protect themselves against phishing emails. While many phishing emails are poorly written and easy to detect, there are often highly sophisticated attacks that are much more difficult to spot.

To properly protect your business against phishing emails you should develop an effective security education programme to raise awareness among staff of the growing cyber threats.

Go Phishing

One very effective method to identify the weak links in your security and determine where further training is required is to send phishing emails to your employees. Craft an email based on the kind of ones that your employees do receive and then measure for these main four metrics: clicking on the link, opening attachments, reporting the email and response time.

After the ‘attack’, discuss the results of the tests with your employees; it is usually best to keep results anonymous or break them down by department or team to avoid employees feeling like they are being individually called out. Your goal with this exercise should be to raise awareness and educate your employees, not to embarrass them.

Develop A Strict Protocol

Ensure you have a strict and well thought out protocol in place for phishing attacks. Encourage all employees to report all attacks or potential attacks immediately so that they can be dealt with effectively and quickly.

Make it clear that every employee can ask for help if they think they might have been a victim of a phishing email attack and be sure never to punish staff if they do get caught out; it will only discourage your employees from reporting the attacks in future. Once an attack has been reported, take steps to scan the affected devices for malware and change all passwords as soon as possible.

Review Your Digital Footprint

Cybercriminals will use information that is publicly available about your business and employees to make phishing emails more convincing. This information can be found on your website and social media accounts and is known as your digital footprint. Carefully consider what information is necessary for your website visitors and what could be used by potential attackers.

It is also vital to offer support and training to your employees on how to best manage their digital footprint; you should not expect them to remove themselves from the internet entirely but help them understand what information isn’t necessary to share.

Increase your phishing protection with Cyan Solutions

At Cyan Solutions we can develop robust IT security to reduce the risk and prevent cyber attacks. If you would like friendly advice on how to increase your IT security, talk to our experts now.

Myth-busting Cloud Technology

Five Top Cloud Technology Myths

Cloud computing has been growing in popularity in recent years. However, there are still some regular misconceptions about the platform and how it works. In simple terms, cloud technology refers to storing and accessing programs and data over the internet as opposed to using a computer’s hard drive.

With an online connection, cloud computing can be done at any time and from anywhere, which is just one of the reasons that it is so popular among businesses and individuals. For something that has become so mainstream in recent years, cloud computing is still not properly understood by many. This article will reveal the truth about cloud technology and most common myths associated with it.

The Cloud Isn’t Secure

Many people seem to believe that using cloud technology is less secure and safe than traditional IT solutions. In actual face, maintaining cybersecurity is all about staying ahead of the attackers, and this is the same whether you are using cloud technology or traditional solutions. The main difference when using cloud technology is that both you and your cloud provider have a shared responsibility for maintaining the security of data stored in the cloud.

As cloud providers are professionals in the field of cloud technology and security, they usually have the investment resources, experience and knowledge to maintain high-end security technology. When it comes to both security and compliance, a cloud provider can generally invest vast amounts of resources that far exceed what an independent business could realistically manage.

The Cloud and The Internet Are The Same

There is often confusion about what the cloud really means, and usually, we interpret saving something to the cloud as saving it to the internet, which is figuratively true, but the two things are not the same. Put simply; the cloud is a network of remote servers that can only be accessed using the internet. The internet is one huge global network of connections, and within it, there are hundreds of thousands of clouds.

Many people make the mistake of thinking there is one single cloud when in actual fact there are thousands of different clouds located on the internet. These various different clouds could be either public or private. A public cloud is a service that can be accessed by anyone from anywhere with their own individual account, such as Dropbox or iCloud. A private cloud is dedicated to one specific company and can only be accessed by those with access to that particular server.

Cloud Migration Is Difficult

Years ago, when the cloud was a relatively new technology, there were plenty of horror stories around from early adopters who moved their business onto cloud technologies. Just a few years ago, cloud technologies were still a relatively new thing, and the power of them was unproven, leaving enterprises to figure them out on their own with little guidance or help. This led to implementation nightmares and gave cloud technology a bad name.

The technologies have come on in leaps and bounds since then, and now implementing cloud technologies could not be easier. The technology has improved significantly in recent years, and there are experienced and knowledgeable professionals out there to assist businesses in implementation and training. If your current servers are outdated, then some cleaning and architecture revisions may be necessary to migrate to the cloud, but with the help of a professional, the migration process can be seamless.

Cloud Technology Is A Fad

Many people still have this common misconception that cloud computing is simply just another fad. Its fast rise in popularity makes some people believe that the cloud is just another marketing buzzword that will be soon forgotten, but this is not the case. Cloud technology has actually been around since the 1960s and has become increasingly popular in recent years as technologies have advanced and improved.

Hundreds of companies across all industries rely on cloud computing for their day-to-day. IT needs, making it far too big and popular to be regarded as a short-lived fad. Cloud computing is expected to continuing growing and advancing over the next few years and is showing no signs of slowing.

Cloud Technology Is Cheap

It is a common belief that cloud technology is a cheaper way to run a business than traditional methods, but this is not always the case. Moving a company’s systems and data to a cloud platform will reduce the need for expensive hardware and in-house servicing costs, but there is also a financial investment involved in migrating everything over.

While the initial cost of moving over to the cloud may be pricey, the ongoing management costs are generally low and make up for it in the long run. Cloud technology also provides a more significant amount of flexibility and scalability once the transition is complete, resulting in a better performing business.

At Cyan Solutions we are experts in working with our customers to smoothly transition them onto the right cloud platform, tailored to their needs. Contact us now to discuss how cloud technology could transform your business.

Using The Cloud For Your Disaster Recovery Strategy

One of the priorities for every IT department is to ensure there is a sufficient recovery strategy in place should a disaster happen. Small businesses can lose thousands of pounds for every hour that their IT system is down. The best way to limit the costs and the damage of IT failure is to prepare for the eventuality and ensure there is a backup plan ready.

With over 60% of businesses using cloud technology in some form or other for their infrastructure, it is clear that a cloud solution can significantly help with the day to day. However, the cloud can also help with secondary workflows that include backup and archiving to help with your disaster recovery strategy.

Traditional disaster recovery strategies for businesses are expensive and inefficient; they often require multiple solutions as well as labour and maintenance which can increase the costs dramatically. Cloud-based solutions already offer increased security for businesses, and with a cloud-based disaster recovery strategy, you have a secure, scalable disaster recovery strategy.

If you want greater agility and protection for your business, should the worst happen, then a cloud-based disaster recovery could be a cost-saving solution that will help your business to feel prepared for every eventuality.

The benefits of using the cloud for your disaster recovery strategy

Reduced manual backup

A cloud-based disaster recovery strategy will automate the backup process for you. This helps to free up time and resources needs for manual backup. This is particularly helpful for businesses with a small IT team who need to dedicate their time to strategic aspects of IT and the company as a whole.

Taking time to manually backup data means time is taken away from troubleshooting, improving systems and creating efficiencies. Instead, the manual backup will require reviewing archives, monitoring progress and ensuring there is sufficient space and storage for backup. All of these processes could be significantly reduced with an automated cloud solution.

Predictability

Using a cloud-based system for your backup helps to ensure predictability not only for automated backup but also for knowing your costs. Having a cloud system for your disaster recovery strategy typically comes with a set monthly fee which can help you when it comes to budgeting and ensures you know your costs beforehand.

Utilising another provider for your backup and disaster recovery strategy also frees up IT staff, as well as the cost of time and resources, to give you better reliability and assurance that backup is always taken care of through immediate automation.

Immediate backup

When it comes to internal backups, companies rarely check their systems to see if they can recover and restore all data should the worst happen. Many businesses will only complete a backup process at night which means retrieving all data in a situation is almost impossible.

Cloud-based solutions use a continuous backup method which means you’ll lose minimal data should a disaster strike. As the cloud automatically detects and transmits changes to files, there is no manual process involved, and you do not need to worry about when the backup takes place. All of the data restoration is taken care of for complete peace of mind.

Off-site

Even if your business has a robust data recovery and disaster management plan, if your equipment for backup is on the same site as the business then it may not help you at all. Should the workplace suffer from an unforeseen accident such as a flood, storm, burst pipe or fire, then your servers and backup systems are likely to suffer, and you will lose all of your data.

With a cloud-based solution, you have backup data in an external location. This means that should there be a problem in the workplace, your data will remain safe. As cloud backup occurs within minutes, you know that data is safely stored offsite from your organisation which gives peace of mind and can help to relieve any backup issues such as loss of revenue, lower productivity or negative customer feedback.

Security

As many customers who already take advantage of the cloud for their day to day running will know, a cloud-based system can give an organisation additional security. A cloud-based solution keeps data secure by being offsite and using data encryption; this means that only authorised users can access and decrypt the data.

Data encryption in the cloud is also applicable to backup and archived data which can significantly add to the security of the organisation which can help to reduce the risk of security breaches for organisations as well as providing peace of mind to customers.

Plan your disaster recovery strategy

When it comes to planning your disaster recovery strategy, it is essential to not only prepare for the worst but make sure there is always a robust system in place that works for your business. At Cyan, we can help to make sure you have a secure and effective disaster recovery plan in place using the cloud. If you want to protect your business and prepare for every eventuality, get in touch with our team of expert advisors.

Managing Security With Remote Workers

Remote working is increasing rapidly. Staff who are travelling for business, working at home or commuting still want access to the same information they can receive while in their workplace. The increase of remote working undeniably helps organisations as well as assisting remote workers to stay in the loop and be efficient.

With remote working, staff can be more productive, there is a contingency plan in place and data can be shared with ease. However, with the increase in remote working comes an increased risk of security breaches. Those who are accessing work data inappropriately could be breaching the security and confidentiality of the business. For the organisation, particularly with GDPR in place, it is essential to manage and bolster security systems, so that remote working does not leave your business vulnerable.

Why is managing remote working important?

With employees that are keen to access work information outside of the workplace shows a commitment and conscientiousness to your organisation. However, many employees do not realise the risk they pose to the security of your business.

Recent studies have shown that almost a quarter of employees would use free WiFi hotspots to access their work emails. As well as this, 28% of employees will email work documents to and from their personal email address. Many employees do not realise that unsecured connections such as WiFi hotspots can pose a significant threat to cybersecurity, with cybercriminals being able to access information on low-security connections.

Fortunately, there are several ways that organisations can reduce the risk and help to manage security with remote workers.

How you can manage security with remote workers

Strong passwords

Having a secure password can give protection from hackers and more peace of mind if a device is lost or stolen. Organisations can implement password requirements such as having a minimum number of characters as well as asking for multi-characters. Organisations can also ask employees to have different passwords for different systems as well as imposing a two-step log-in process.

Create public WiFi guidelines

It is not always feasible for remote workers to connect to trusted networks, particularly when travelling or staying in a hotel. However, you can create a cybersecurity policy which explains how to use public WiFi with the most care. It is wise to define what systems they can access and which they need to refrain from when using a potentially unsecured network.

Mobile device management

As well as securing mobile devices with passwords, it is also essential to help boost your security if laptops or mobiles are lost or stolen. Utilising mobile device management software or applications can help your business to track lost or stolen devices as well as implementing additional security to protect business assets on the device.

Use the cloud

Hosted cloud desktop providers will use data encryption technology to transport data throughout the company intranet. If employees log in to your system using a cloud-based virtual desktop, there will be added encryption for confidential information between the remote worker and the business. Providers of cloud-based hosted desktops will typically have a range of security certification for additional peace of mind.

Monitoring

Your business can take advantage of 24/7 monitoring of your security systems which can help to quickly identify a threat and help you to prevent or reduce the issue rapidly. 24/7 monitoring will also help your business with future security planning as you can start to uncover common problems that your business faces. Using monitoring to protect your network will include analysing all remote workers as well as all of the mobile devices in your organisation.

Training

Many employees do not receive robust cybersecurity training that includes remote working. Staff should regularly receive cybersecurity training that helps them to understand the risk and how specific actions such as using public WiFi and public computers can threaten security. Using monitoring alongside training can help you to enforce your cybersecurity policies and make it easier to focus the training on specific issues that threaten your business.

Email encryption

As emails are one of the most popular technologies for remote workers, one of easiest ways to improve your organisation’s security is by using email encryption applications. Investing in the management of corporate email and using the safest technologies for email is essential for many businesses who use email without even thinking about its vulnerabilities.

If you need help securing your IT for remote workers, call us today so we can help you plan and implement a robust cybersecurity strategy.