Whilst the global pandemic has shaken the world and society still attempts to deal with its long-term effects in 2021 and onwards, cybercrimes are hitting organisations at an alarming rate. With remote working and digital solutions gaining more popularity amongst employers, in the first nine months of 2020, nearly 200 million ransomware attacks took place. Despite this, there is a concern that businesses are not taking appropriate measures to develop their security strategies, as 43% of SMEs do not have any defence plan, as BullGuard stated in a recent study. Even Deloitte, the largest professional services firm in the world, realising the importance of cybesecurity in the post COVID-19 era, decided to acquire Cloudquest recently, to strengthen its strategy. In this article, we take business leaders through the essential steps to consider and cover the ‘must-have’ services a successful cybersecurity strategy should include.

Why every business should have a cybersecurity policy in 2021

Cybersecurity statistics from around the globe and the UK highlight how ignoring existing threats in cyberspace can cause hardship to businesses of all sizes. During the past year, cybercriminals have also become highly effective in breaching defences. Underestimating the power of those attacks and the fact that new hacks are emerging every minute, not dedicating an adequate budget to strengthen cybersecurity measures can affect businesses regardless of their size in the long run. In fact, according to our UK Cybersecurity report, 42% of the cyber attacks affected UK companies with up to 250 employees.

● Maintain and improve business continuity by minimising downtime
● Increase team productivity levels
● Reduce operational cost by working with external sources
● Take responsibility off from businesses leaders’ shoulders by outsourcing data management, investing in managed firewall services or centralised and remotely managed services
● Help companies become more digital-savvy by implementing solutions like Cloud platforms and storage
● Protect and ensure privacy and business reputation
● Strengthen communications systems to handle remote or hybrid working

Cybersecurity strategy in the United Kingdom

Whilst the world was battling coronavirus, attackers used this time to develop more focused threats and, as a result, the UK has recorded an increasing number of breaches in 2020.

The list of the most common hacks included:

● Ransomware attack: It is a type of malware that encrypts a company’s files. After that, the attacker demands a ransom to restore access to the data upon payment. In 2020, 46% of all healthcare sector violations were caused by ransomware attacks.

● Credential theft: It is a cybercrime whereupon a hacker gains access to user passwords to attain and abuse critical business data or personal information. It was a popular type of attack against the retail sector in 2020 and a rather pressing one too, with 44% of consumers saying they would stop transacting with a business if they were breached during a cyberattack.

● Cloud computing-related breaches: As many applications are moving to the Cloud, such as  internet banking and payment gateway services, hackers are able to find loopholes in security systems and steal business-critical data. Despite security measures, 70% of the UK financial establishments faced a cyberattack in 2020. 

● Distributed Denial of Service (DDoS): A DDoS attack is designed to overwhelm websites with requests until they crash and stop responding to any user request, making the website unresponsive for hours or even days. However, only 22% of SMEs decide to encrypt their databases to protect their data assets.

Tip: For more details about the cybersecurity challenges in the UK region read our dedicated article here

Effective cybersecurity strategies for small businesses

Cybersecurity strategy #1: Choose a Managed Firewall service

● Why it is important for a business: It maintains business security and continuity without investing in expensive resources.

● Recommended solutions: Cisco Meraki, UniFi Security Gateway, DrayTek, Fortinet Firewall, SonicWall, Palo Alto Networks.

Cybersecurity strategy #2: Add on Endpoint Security

● Why it is important for a business: It offers business-grade support, meaning that instant access to specialist engineer knowledge is guaranteed when investing in an Endpoint Security service. They monitor potential threats and provide immediate remedy when an attack occurs. 

● Recommended solutions: Bitdefender, Cybereason

Cybersecurity strategy #3: Select the right Antivirus

● Why it is important for a business: Antivirus solutions are sufficient for smaller businesses that do not have a network architecture in place. It is very effective in detecting, quarantining and blocking malicious files. 

● Recommended solutions: Avast Business Antivirus Pro Plus, ESET PROTECT Cloud

Cybersecurity strategy #4: Consider your Workplace Recovery options

● Why it is important for a business: With transferring critical data assets to the Cloud, a secure working environment should be maintained with monitored activity. Backed up data can be restored in minutes without causing any financial or reputational harm to the business.

● Recommended solutions: Acronis, Microsoft OneDrive, Microsoft Azure, Datto Workplace

Cybersecurity strategy #5: Secure your connection with Cloud Direct Connect & ExpressRoute

● Why it is important for a business: By utilising the power of the Cloud and securing connections, businesses are able to create a safe working environment and connect services across all regions in the same geographical area.

● Recommended solutions: Amazon Web Services (AWS), Microsoft Azure ExpressRoute, Google Cloud Platform.

Cybersecurity strategy #6: Store your data securely with a Disaster Recovery Colocation data centre

● Why it is important for a business: Outsourcing data maintenance and storage can not only enhance data security, but grant access to resources at a low cost, like high network and power availability. But, most importantly, it can reduce potential downtime, thus protecting brand identity.

● Recommended solutions: The Bunker Secure Hosting, Equinix

Cybersecurity strategy #7: Deploy a Managed Local Area Network infrastructure

● Why it is important for a business: The network monitoring and any troubleshooting activities are controlled by an external IT Solutions provider to constantly update you about any emerging challenges. Immediate, real-time technical support hugely increases business continuity and reduces cost.

● Recommended solutions: Client/server LAN, Network switch/PoE switch

Cybersecurity strategy #8: Install high-quality Business Grade Internet

● Why it is important for a business: Business Grade Internet solutions come with prioritised customer service. The Service Level Agreement guarantees that any potential issues get fixed within seven (7) hours. In the event of a data breach, your data will also be recovered. 

● Recommended solutions: BT Wholesale, Colt, TalkTalk Business

Other important factors to consider for your cybersecurity strategy

● Focus on the amount of data and the process of collecting and storing this as part of business processes, as well as the company’s data location, e.g. Cloud data centres. 

● Examine current data protection measures in place, like data encryption or password policies.

● Work out the frequency of data backup and name the person/team responsible for it in your Disaster Recovery plan – this will set you on the right path.

General cybersecurity to-do list:

● Limit access rights: Determine the access level of employees regarding apps and Cloud software that runs on the company’s internal network.

● Control remote working: When working with external employees or operating remotely, it’s important to regulate access to the system and provide security connectivity tools, such as a Virtual Private Network (VPN).

● Add extra authentication: Introduce simple practices like a password policy and two-factor authentication for enhanced employee identification.

● Create clear instructions on security incidents: Ready-made guidelines on dealing with specific issues and security incidents can minimise the loss or make the restoring process faster. 

● Introduce regular audits: Carrying out cybersecurity audits can not only help you to stay ahead of emerging threats. Due to regulations like GDPR, companies can also get fined for data breaches. Making sure you tick everything off your checklist can save a company’s reputation as well as legal costs.

● Improve employee skillset: Every cybersecurity strategy relies on people who are part of your network, as you are only as strong as your weakest link. Introduce regular cybersecurity training about current trends, newest hacks and latest IT practices and help employees understand that their contribution is critical in maintaining high levels of cybersecurity and protecting company assets.

● Choose adequate business connections: Having a business-grade internet solution can guarantee a safe and high-speed, customisable connection with instant threat management to strengthen network security.

● Supply chain security management: It’s also essential to pay attention to factors such as where a product is coming from and how vendors are securing their devices prior to sending them to resellers or IT professionals. 

● Replace outdated equipment: With all trusted devices, there comes a time when the model is no longer supported by the manufacturer, not compatible with the latest patches or firmware updates and can therefore become vulnerable to cyberattacks. It’s advisable to take an audit on an ongoing basis and replace older equipment gradually to avoid huge expenditure.

● Outsourcing vulnerable data: Keeping your sensitive data at a secured location like a Cloud-based or a physical data centre can help mitigate most primary threats.

Build your cybersecurity strategy with the help of an expert