Cybersecurity: actions for 2022 | The Law Society | #cybersecurity | #cyberattack | #hacking | #aihp

Staff digital behaviour

Most successful attacks rely on human error at some stage, which is why staff training, combined with proper governance, is so important.

1. Passwords: how disciplined are you? Do staff use strong passwords, and do they know how dangerous it is to use work emails and passwords for non-work purposes? Do you really know if the rules you set are being enforced?
2. Information transfer: are you really in control of the way data is transferred and stored? Could company information be easily found in G-drives, Dropbox, and on WeTransfer?
3. Speed and trust: how quick are staff to trust and press links on their mobile phones? Might your staff fall for the criminals’ ever more sophisticated tricks?

Cloud services

At its worst, using cloud services can mean loss of control and a lack of risk visibility.

Mitigo have a video providing some advice on how well you’ve set-up your cloud services.

Supply chain weaknesses

Third parties who provide services to your organisation are often one of the weakest links in your cybersecurity. Most commentators are predicting a growth in supply chain attacks this year. The National Cyber Security Centre (NCSC) have published a good explanation of the risks involved.

Cybersecurity action plan for 2022

Cyber security vulnerability assessment

You must start by identifying your biggest risks and the vulnerabilities, so they can be addressed.

The list of common vulnerabilities mentioned above is a good starting point for this process. Consider how well each of those areas has been set up. Do you have evidence that cybersecurity has been properly considered? Make sure you review where your valuable information is kept and the way your payments process operates, as these are common targets.

You may have heard of cyber security buzz words like penetration testing, vulnerability assessments, and network security scanning, which will all help you assess your vulnerability to attack. A good starting point would be to use our assessment tool here.

Cyber security policy

Define how the business will work to reduce risk, e.g. clearly define acceptable personal use of a work device.

We recommend that you focus your policy in key areas; digital usage and behaviour, passwords and access management, and information storage and transfer. Then, make sure all staff are aware of the rules and what is expected of them.

You must have a defined policy in place for software patching, back-up testing and virus protection to include clarity on actions and responsibilities. It is also important that you find a way of measuring compliance.

This may sound onerous, but it is absolutely necessary and an expectation of your regulators and the Information Commissioner’s Office (ICO).

Vulnerability closure, strong controls and alerts

Once you have completed the steps above, you need to make sure you close the vulnerabilities identified, that technical policies are implemented and that the right system controls are set up to protect you. It is essential that someone suitably qualified advises on how properly to configure your software and hardware from a security perspective.

The work here obviously depends on how your firm operates, but here are just 3 examples of what we look for during our assessments.

1. Anti-virus software: is it on every device; is it being kept up to date; can it be locally switched off; has it been ‘loosened’ too much and is someone centrally viewing the critical alerts?
2. Windows network patching: are Windows patches being deployed on time to laptops, PCs and servers? How long can a laptop go without a critical patch being deployed?
3. Email account login failures: if you are on Office365 someone should be being alerted to suspicious login attempts and you should be configuring the controls to restrict who has access to your systems

Cyber security training

Make sure that regular training keeps staff alert to the risks. It’s time to invest in some good cybersecurity training, and we believe that having simulated attacks done frequently will improve your cybersecurity culture.

Incident response planning

Yes, the worst does sometimes happen. In most cases that I have been involved with, fast, pre-planned emergency response arrangements can massively reduce the impact on your business.

This is a subject for another article, but start by getting the key people in a room and discussing how you would go about dealing with a ransomware attack. Write down your plan, communicate it and practise it.