The UK Government’s recent Cyber Security Breaches Survey 2022 found that over the last 12 months, 39% of UK companies experiences a cyber attack. It was also deduced that enhanced cyber security measures encourage a high idenficiation of attacks, suggesting that less cyber mature organisations may be underreporting,
Raising Awareness
‘We must therefore increase both the knowledge and awareness of data security, both among business leaders and employees,’ says Jan Terje Sæterbø at F24 Nordics. ‘There is far too great a degree of varying awareness and knowledge about the danger of, and how to deal with such a threat when it arises.’
Simple measures that improve safety
The biggest threat comes from the people within an organisation through such aspects like poor routines for passwords and a general lack of vigilance.
It should therefore be a minimum requirement that employees use complex passwords, use different passwords for each account or service and change passwords regularly, we can read in the downloadable checklist F24 has on its website.
The use of two-step authentication, as an additional layer of security, should also be a minimum requirement for all systems and services any organization uses.
All employees must understand the importance of cyber security, as well as be on the lookout for phishing, denial of service attacks, ransomware (cryptovirus) and other digital attacks.
Updating all software, and changing the default password, also on devices such as routers, printers, etc. is also a must in today’s modern companies where we are logged in everywhere and all the time.
A contingency plan
What must be in place is a contingency plan for this type of incident, Sæterbø believes. In the same way as the company has a contingency plan for fire and other unforeseen events.
‘The probability of a computer attack is far greater than the risk of fire, and the consequence can be at least as great when we disregard the risk of loss of life,’ he says.
Part of having a good contingency plan is to create good routines for emergency preparedness that all employees are familiar with, and well trained in.
Templates for handling cyber incidents, including alert lists and pre-defined messages, are also something that should be in place in the tool that the company uses for emergency preparedness and crisis management.
Alert and crisis management
A good example of secure crisis preparation is ensuring that the company’s emergency preparedness and crisis management tools are operated outside the organization’s own IT network.
Using cloud services for this type of tool can be a good alternative in that way.
‘But be sure that the cloud services you use for this purpose are safe,’ says Sæterbø. ‘Open, commercial cloud services can be more easily hacked than closed private cloud services, and it is also a question of where the data is actually stored when it comes to commercial cloud services. It is not always within Norway’s borders. This is very important to be aware of.’
CIM as a contingency tool
Since 2006, F24 has played a significant role in national preparedness across the globe, with its comprehensive crisis management system CIM. This is used by ministries, directorates, police, health, educational institutions, transport, local and regional authorities, in addition to a number of larger and smaller private companies.
If you use CIM as a contingency tool, notification and contingency management will take place in a tool separate from your normal IT operations. This tool will not be affected, thus ensuring that you can take the necessary steps to deal with the situation. Checklists and warning texts can be entered as ready-made templates and activated with the push of a button. In addition, the company can communicate both internally and externally directly from CIM, even when all internal systems are affected by an incident or inaccessible.
‘There are examples of companies that have had to put up posters around the company to ensure that employees connect their work PCs to the company’s network when the company has been under a digital attack,’ says Sæterbø.
‘You will avoid this if you use CIM for emergency preparedness and crisis management, as it is operated outside the company’s infrastructure. Then you have a good and secure communication network even when the company is under attack, and can notify on other channels than those affected.’
>> Contact us if you want to know more about how to set up CIM as a tool to monitor security threats and deal with cyber attacks.
Download free checklist
