“She’ll be right”, is not cyber event protection!

A cyber event is not a punch line.   It is a serious effort to derail your organisation.

Cyber event protection?

If an attack is intentional then you need to manage the risk.   If the attack is accidental or random then you have to understand the implications.

Understanding what is happening in your industry, your supply chain or other areas of the digital world is important.

The implications to your organisation could be a flow on effect of a cyber event on the other side of the planet.

To us humans it is 10,000 kilometers away in the digital world it is just a click.

Our understanding of the digital world for most organisations is mainly focused on client management, communication and service delivery.

CRM, sales, marketing, email, data and information are all woven into the fabric of improving the bottom line.

What can we do with the tools available without spending too much money but with a significant return on the money invested in the organisation.

10 years ago any business who was on the cutting edge of technology had the ability to multiply their revenue by a factor of 10.

Today everyone is using the same products and services to improve the bottom line.

Technology is no longer the multiplier that it use to be.

But, security of that technology is!

The news of significant hacks like Ashley Madison, Target, Yahoo and Equifax have created startling headlines but have they changed the attitude of business organisations world wide?

No they haven’t!

The problems with raising awareness to the true cost of a cyber event is not understood by most people.

“It will not happen to me” or the colloquial response of Australians – “she’ll be right” significantly reduce your ability to handle a cyber event and to come through one with the organisation intact and still functioning.

Making the simple attitude change, “it could or may happen to me”, has a significant impact on any organisation.

The change in mindset, a couple of words in a statement, starts people down the road to better protection.

Isn’t it about time that you made that change?

Once you have made that change, questions and answers start to be heard.

  • How about we put a policy around this process.
  • How about we put processes and procedures around the database.
  • How about we put together a disaster recovery plan.
  • How do we get back to business as usual – lets put together a business continuity plan.
  • How about we educate our troops so they can recognize an attack.
  • How about we invest in new technology.

All good ideas that would never come about if we believe we do not have a problem.

If we persist with an attitude of “she’ll be right” I can guarantee that we will not.

Roger Smith is funny, scary, on point and is focused on one thing – increasing everyone’s awareness and understanding of the problems and issues associated with the digital world.

He was Runner up in the 2017 worldwide Cybersecurity Educator of the Year award and has been nominated for the 2018 Cybersecurity Educator of the Year award.  

He is a highly respected expert in the fields of cybercrime and business security and is a Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity) on Cybercime, Cybersecurity and the hacking techniques used by the digital criminal.   

He is an Amazon #1 selling author on Cybercrime with his best selling book, Cybercrime a clear and present danger, going to number one on Amazon.   

He is the primary presenter for the Business Security Intensive (BSI) and author of the Digital Security Toolbox which is given away for free at the BSI.   He is a speaker, author, teacher and educator on Cybercrime and an expert on how to protect yourself, your staff, your clients and your intellectual property from the digital world.

What every CEO and CIO should know about cybersecurity

The problem with cybersecurity is it is not sexy.

In most cases it is down right boring.

Although not sexy and down right boring it is still something that every CEO, manager, owner and board member has to focus on.

With all of the automated attack vectors available to the cyber criminals, we can no longer say we are not a target. We cannot say we have nothing worth stealing.

The more and more reliant business has on the digital world the greater the chance that a cyber event will cripple the organisation.

What are the main things that every management type needs to focus on when it comes to prevention of a cyber event.

Here are a few!

The cost of a cyber event.

The cost of a cyber even can range from lost time and functionality within the organisation to more money than the organisation can find to pay for the breach.

Cryptovirus is an example of lost time and functionality. If you do not have a functioning and tested backup of the data, you have to rebuild the offending device but you will also have to also replicate all of the data.

A full blown breach by a dedicated black hat hacker can steal everything and then use your system as a platform to target your clients, suppliers and staff. When that happens you realize that you are NOT too small to be a target

How they get into your system

The go to weapon of most cyber attacks is social engineering. Two parts of a very effective attack strategy. The technology to effect change, follow a link to an infected website, click on an ad in social media or open an attachment in an email, combined with getting you to trust them where you let them in.

Either way they are now in.

Risk and problems just compounded.

Simple ransomware for instance, the initial encryption of data is only one of the stages of the attack. What about stage 2,3 and 4.

Wannacry showed us that a combination of 2 attack vectors allowed a single infection to traverse a whole network. One computer is a problem for any organisation. All of the computers is a nightmare.

The protection challenges

In most situations managers, owners, executive and board members do not understand the digital realm. Risk management of data (a critical component in today’s business world) is often overlooked and considered an ICT problem.

Its not! Today’s digital security challenge is everyone’s issue and the sooner it gets noticed as a business risk and treated as such the faster we will see a reduction in attacks.

From the largest organisations to smallest single entities, we all keep critical data in places that are easily accessed, relatively unprotected and mobile.

What are you doing to manage the expected cyber events that could cripple your organization?

There is no single, simple fix. If there was everyone would be safe.

It is a complex issue and one needs to dedicate some time, money and expertise to understanding the issues and risk associated with a cyber event.

Come to one of my intensive workshops it will open your eyes on your business requirement to be safe as an organistion.

Roger Smith is funny, scary, on point and is focused on one thing – increasing everyone’s awareness and understanding of the problems and issues associated with the digital world.
He was Runner up in the 2017 worldwide Cybersecurity Educator of the Year award and has been nominated for the 2018 Cybersecurity Educator of the Year award.  
He is a highly respected expert in the fields of cybercrime and business security and is a Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity) on Cybercime, Cybersecurity and the hacking techniques used by the digital criminal.   
He is an Amazon #1 selling author on Cybercrime with his best selling book, Cybercrime a clear and present danger, going to number one on Amazon.   
He is the primary presenter for the Business Security Intensive (BSI) and author of the Digital Security Toolbox which is given away for free at the BSI.   He is a speaker, author, teacher and educator on Cybercrime and an expert on how to protect yourself, your staff, your clients and your intellectual property from the digital world.

Why Securing your data is so important!

Like all organisation in today’s business world, we all collect information!

That information is used in your core business.

Your core business requires you to collect information.

This information is used in your client relationship management system for sales and marketing, your messaging system including email, your R & D, your accounting and financial system and your HR and pay systems.

Today, all this information is digital.

If you do not keep your information safe and secure it can have an impact on everything you do.

You can lose your clients!

You can lose your money!

You can lose your edge in your industry or

You can even lose your ability to function as a business entity.

No business entity!

No pay packet!

So it is in everyone’s best interest to keep that information or data safe.

As an organisation you may have put in second generation firewalls, intrusion detection systems, anti-virus, SPAM detection and management systems to protect your information from outside the organisation.

Technology is important but there is something that is more important.

That critically important part is to educate your most valuable asset, your staff and users, and give them the knowledge to help themselves.

We want to help you understand why it is so important to protect yourself in the digital world.

Roger Smith is a highly respected expert in the fields of cybercrime and business security and is a Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity) on Cybercime, Cybersecurity and the hacking techniques used by the digital criminal.   
He is an Amazon #1 selling author on Cybercrime with his best selling book, Cybercrime a clear and present danger.   
He is the primary presenter for the Business Security Intensive (BSI) and author of the Digital Security Toolbox which is given away for free at the BSI.   He is a speaker, author, teacher and educator on Cybercrime and an expert on how to protect yourself, your staff, your clients and your intellectual property from the digital world.

Can you be a great CEO by ignoring Cyber?

The digital world, the cyber world, is creating huge problems for business.

People like me and the security community have been screaming for the last 10 or so years about the problems, issues and dangers that the digital world delivers to business.

We have shown numerous times that the digital realm is a huge problem for anyone who thinks that:

  • they are not a target,
  • have nothing worth stealing or
  • cyber security is too expensive.

Time and time we have seen data breaches and ransomware attacks that have crippled organisations, both large and small.

We have seen the most secure people in the world get breached time and time again.

Still no one is listening!

We are told we are being scare mongers, unrealistic, even calling our reputations into question. BUT, we still see the problems and although we are screaming we cannot convince people to do something about it.

Like me there are a number of people or organisations who are more interested in education and the process of education and training than selling tin (unnecessary technology) to a business.

We are more interested in raising awareness, and raising awareness is where we need to start.

As a CEO, manager, owner or board member you already have a handle on risk management. You live and breath cashflow, revenue streams, management teams and HR, it is all part of the process of being in charge. All this is taught in managers school or more importantly the school of hard knocks.

If you don’t learn these basics then you are going out of business. Slow or fast you will eventually go out of business.

There is a saying that “you don’t know what you don’t know”, in todays business world that is a specific reference to the digital realm.

We are all focussed on new and shiny, even I get caught up in the hype of new “whatever”. Most of them have a digital component incorporated into that new shiny thing.

We seldon look at the complex systems that make that part of the digital world work for you. It is complex!

As a CEO you need to understand the risks that cyber delivers to your organisation. Where do you get that understanding?

In most organisations business security lands smack bang on the desk of the IT section, the person who knows computers or the risk compliance officer.

They do not know what to do, they need guidance, direction and most importantly they need the AUTHORITY to enact change.

Business security is a very specialised area of expertise. You need to enact a framework.

You need to spend money wisely.

You need to continiously work on making the organisation more secure. Today we are more secure than yesterday!

Without understanding the risks, implementing change and giving a responsible person the authority to make change you are ignoring the Cyber Realm.

Without enacting a framework, you are at the mercy of the next cyber event.

Without a framework for business security you are not a very good CEO. That would really hurt.

Roger Smith is a highly respected expert in the fields of cyber crime and business security and is a Lecturer at ADFA (UNSW – Australian Centre of Cyber security) on Cyber crime, Cyber security and the hacking techniques used by the digital criminal.   

He is an Amazon #1 selling author on Cyber crime with his best selling book, Cyber crime a clear and present danger, going to number one in 3 sections of Amazon.   

He is the primary presenter for the Business Security Intensive (BSI) and author of the Digital Security Toolbox which is given away for free at the BSI.   He is a speaker, author, teacher and educator on Cyber crime and an expert on how to protect yourself, your staff, your clients and your intellectual property from the digital world.

The importance of a NIST rating

10 very good reasons you should know your NIST score!

NIST is not new.
In fact it has been around since its first iteration in 2014.
The National Institute for Science and Technology (NIST) developed a cybersecurity rating system to make it easy for any organisation to show where they are in protecting their digital information, systems and organisation.
Like other frameworks, and there are a few, it has its good points and bad.  One of its better points is that it is easy to implement although it can be a little labour intensive to start off.
The most important part is that it is a standard.  A standard figure that any business can compare with any other business, no matter the size, who they are or where they are located.
NIST is not a competition.   It is just a rating system, but it does become competative, both internally and external.
It is a way for any organisation to compare its cybersecurity capability internally as well as a standard for anyone else who may ask for it in the process of doing business.
It allows management to make decisions on who and how they want to do business with other organisations.
This framework is based on 5 areas of expertice: identify, detect, protect, respond and recover.
Each area of expertice has a number of questions and each question has a range of predetermined responses.   The answers are scored ranging from 0 (nothing is in place) to 4 (a process is inplace, used at all times and supported and signed off by management).   Once all the questions have been answered the score is talied up and devided by the number of questions (98).
This gives everyone a score beteen 0 and 4.
Most organisations when first questioned come in under 1.   Still it is not a competition, so this is your start point.

1 – NIST is easy to understand

Every organisation can have a NIST score, it takes a couple of hours to sit down and honestly answer the 98 questions.   This gives everyone the ability to have a starting point in protecting their organisation from a cyber event.

2 – NIST can be used to compare with others in your industry and across all industries

When it comes to camparing one NIST rating to another it is easy.   If your score is 2.8 and you want to do business or a joint venture with another organisation who has a NIST score of under 1 then you need to be able to manage the risk associated with that score.

3 – You can use your score to track your progress

If your original NIST score is 1.2 and you have upgraded your technology, implemented policies and added proceedures then your NIST score will start to increase.   For every change for the better that you put in place it increases your score.   Small infremental changes that have a big impact on your protection in the digital world.

4 – NIST is Objective

We all have an opinion and we all look at life differently.   NIST takes this into account and delivers an objective view of your business.   The 98 questions are designed to apply objectivity to a sometimes subjective decision.

5 – A NIST Score is credible

Giving every organisation the ability to compare their cyber event capability on a level playing field means that you are comparing apples with other apples.   You get a true rating of your cyber risk visibility.   It also weeds out the unscruptious who think that can bluff their way through the world.

6 – NIST shows your cyber event risk

The difference between a rating of 1 and a rating of 3 is very different.   A rating of 3 means that the risk of a cyber event is greatly reduced.   Greatly reduced, faster recovered from and easier managed.

7 – Your NIST score is easy to understand

If the policy within your organisation is to only do business with organisations that have a NiST rating above 2 you have an understanding that the information that is going to go between the organisations is correctly managed.

8 – NIST is community based

There is a huge community that is starting to use the NIST rating as a measure for their cyber event resilience.   They are there to help and best of all they have been there and done that.

9 – NIST adapts to the future

One of the best things about NIST is that in will handle the changes that are on the horizon.   they will handle those changes not because the changes are known, no one knows them, but because it is a framework designed to protect your organisation.   That framework allows an organisation to adapt its protection no matter what the changes are.
Not many people predicted the impact of social, mobile and IOT but it didn’t matter with a NIST environment because all you had to do was ADAPT to the changes.

10 – NIST gives your business a competitive advantage.

Any advantage in business is better than no advantage but the advantage that NIST gives to an organisation can be significant.   NIST allows an organisation to develop policies and procedure that can be deployed within the organisation that predicts how other organisations will interact with it.   In addition it allows an organisation to make management decisions based on fact.   Nist can also be used in the marketing of the security around your organisation.
Management has now got a scientific way of managing the internal and external risk to the organisation in the digital and cyber arenas.  This allows them to make objective based decisions, create systematic policies and invest in the right technologies to protect the organisation.
NIST is also great at weeding out those people that you are going to do business and organisation that are looking to do business with you.   A NIST rating allows you to manage who you are going to do business with.
If management has a policy of only doing business with organisations that have a NIST rating above 2.5 it means that information passed to that organisation is going to be secured in the same way and with similar protective practices that you have in place.
So what is your NIST rating?
Contact me: to discuss your cyber risk and business security
If you want to know more then come to one of the Business Security Intensive Workshops in a city near you.   https://www.business-security.com.au/intensive
Roger Smith is a highly respected expert in the fields of cybercrime and business security and is a Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity) on Cybercime, Cybersecurity and the hacking techniques used by the digital criminal.   
He is an Amazon #1 selling author on Cybercrime with his best selling book, Cybercrime a clear and present danger, going to number one in 3 sections of Amazon.   
He is the primary presenter for the Business Security Intensive (BSI) and author of the Digital Security Toolbox which is given away for free at the BSI.   He is a speaker, author, teacher and educator on Cybercrime and an expert on how to protect yourself, your staff, your clients and your intelectual propert from the digital world.

Cybersecurity is all about Infosec!

“Using smart technology is not smart unless infosec procedures are set in place.” Laith Alkhouri

We are inundated with shiny and new.

The newest mobile device, the newest computer, the newest operating system, the newest application or apps, all that newness.

All of that smart technology!

Individuals and organisations often forget, in the rush to get things to market, the first reiteration of shiny and new can have some serious flaws and issues.

We forget it too!

Going back a couple of years when everyone was jumping on the band wagon of “you need an app for that“, some of the NFL teams released apps for you to track you favorite team, keep up with the stats and buy their merchandise.

They forgot that a financial transaction needed access to either credit card information or bank account details.   These transactions were in plain text in transmission as well as when stored on the device.

No encryption.

If you purchased that jumper then you had a really good chance of having your financial details stolen.

To stop themselves from being sued they put all of the onus on everyone using the system through a comprehensive waiver.   You agreed to the terms and conditions probably without realising it, you agreed when you installed the app.

The way all of the software companies manage their apps are the same.   You want to use the app then it is your problem because you agreed to the terms and conditions.

The legal beagles have not caught up with this yet.   As a user, are we not entitled to have some semblance of security and safety when using a product.

Are we not entitled to sue someone when using their product and something happens?

When did that change?

I suggest that when you install your next app that you have a look at the terms and conditions before you say yes.   In most cases you have no rights what so ever if something is stolen, according to them.

Oh look something shiny and new, I just have to have it!

 

Roger Smith is a highly respected expert in the fields of cybercrime and business security and is a Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity) on Cybercime, Cybersecurity and the hacking techniques used by the digital criminal.   He is an Amazon #1 selling author on Cybercrime with his best selling book, Cybercrime a clear and present danger, going to number one in 3 sections of Amazon.   He is the primary presenter for the Business Security Intensive (BSI) and author of the Digital Security Toolbox which is given away for free at the BSI.   He is a speaker, author, teacher and educator on Cybercrime and an expert on how to protect yourself, your staff, your clients and your intellectual property from the digital world.

What is the difference between a Penetration Test and a vulnerability scan?

Ransomware for Medical devices – what happens then?

One of the biggest problems with our bright new shiny digital world is everything we do or use today has some level of digital components.
We know that everyday computers, smart devices, mobile devices and gaming platforms, are digital in nature.
We forget that Fitbits, Internet of Things devices and medical devices also have some level of digital incorporated into them.
So what happens to these devices if they become infected with malware, even worse if that malware is a ransomware.
If I had a pacemaker installed in my body and the medical staff lost control of it (that is what malware and Ransomware does, removes their control and gives it to someone else) I think that I would get a little panicky.

Definitely a WTF moment.

Most medical devices are either WiFi or blue tooth enabled.   That makes them relatively easy to break into.
Researchers have been looking at compromising medical devices and in 2015 there were 25 known vulnerabilities in some of the most popular devices.   What about the unknown ones, how many of them were there?
We all saw what happened with IOT devices when Mirai was released on the internet late 2016.   It compromised a certain level of device that had a hard coded username and password in the system.
We also saw what happens when the wannacry ransomware hit and the fall out from that in May 2017.

Now imagine a wannacry variant that targets your pacemaker.   “Give us $1000 or we stuff around with your heart!”  That would certainly make your life pretty interesting.
What’s to stop it happening?   Whats to stop it happening right now?
I keep coming back to people taking responsibility for the code they write.   I think we need to have a serious look at our new and shiny world and do something about it.  Before it is too late and people start dying!

We need to think things through.

Think like the bad guys.
Oh, and before you say “why would they target my pacemaker?” In most cases it is because they can.
Roger Smith is a highly respected expert in the fields of cybercrime and business security and is a Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity) on Cybercime, Cybersecurity and the hacking techniques used by the digital criminal.
He is an Amazon #1 selling author on Cybercrime with his best selling book, Cybercrime a clear and present danger, going to number one in 3 sections of Amazon.   
He is the primary presenter for the Business Security Intensive (BSI) and author of the Digital Security Toolbox which is given away for free at the BSI
He is a speaker, author, teacher and educator on Cybercrime and an expert on how to protect yourself, your staff, your clients and your intellectual property from the digital world.


What is the difference between a Penetration Test and a vulnerability scan?

Duty of Care in a cybercrime world!

We are all connected in today’s world through the invisible and mostly unknown world of the internet.
We practically do everything in “cyber” space.   From ordering food, organizing a date to storing our whole lives in bits and bytes.
Email, social media, web and mobility are all driving our world.
Everything is connected to the internet!
So who is responsible for making sure all that information, all of those little bits of information is safe.
Is it the person who supplies that information?
Is the organisation collecting it and storing it?
Is it the Governments responsibility?
We all know that it can’t be the people who are are collecting and storing the information.   The giants of the internet tell us they are just a platform!
We click through all of these legal documents, acceptable use policies, that have been designed to protect them from practically every eventuality.
SME’s don’t have that luxury.   Our reputation is our only constant and we need to keep it safe.   When it comes to SME’s, ask these questions.
What is the difference between a Penetration Test and a vulnerability scan?

What is the difference between a Penetration Test and a vulnerability scan?

If you are collecting that information – What’s your duty of care?   

Have you done everything in your power to protect that information?
Have you done everything to comply with all of those regulatory requirements that make doing business difficult?
To support your clients, customers and staff are you protecting their information?
If you are supplying the information – what is your duty of care?
Have you asked the simple question, how much information am I putting out there.   When I take a photo and upload it to social media have I removed the geo tags.
When I get into a conversation with someone on social media am I checking their “humanness”, are they really that person?
Am I mistrusting everyone, am I paranoid about everything, am I aware of some of the things that can significantly impact my life, both in the real world or in the digital.
These are the questions that we need to ask and here is some advice.
In today’s world have you done this?
  • “TRUST NO ONE”
  • Be aware
  • Get paranoid and
  • Use some common sense.

Roger Smith is the CEO of R & I ICT Consulting Services, Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity), Amazon #1 selling author on Cybercrime, Presenter for the Business Security Intensive, author of the Digital Security Toolbox and Digital Security Framework.   Rapid Restart Appliance Creator.   He is a Speaker, Author, Teacher and Educator on cybercrime and how to protect yourself from the digital world. 

Why do we still believe these 6 idioms about the Internet?

For 25 years the internet has been around.
Since its inception, thanks Tim, we have seen how it can be used for ‘good’, but we have also seen, in the last 10 years, how it can be used for bad, evil and nasty stuff.
The bad utilization is starting to have significant impact on the business world but we still have a number of areas where we do not see the dangers.
These are some of the internet attitudes that we come across constantly:

It will not happen to me

In one word, OK two – automated systems.
The free automated systems that are now available to any bored 14 year old cause major problems for anyone connected to the internet or digital world.

I have anti virus, that’s all I need.

We are constantly shown that most business organisations think in one dimension when talking about the Internet.
The fact that the bad guys and even the automated systems think in a multi faceted approach when it comes to targeting us.   Anti virus will find 95% of attacks and stop about 85%.
That leaves a significant number of areas where AV will not protect you at all

My password is strong enough for me

I was recently watching an interviewer on one of the late night shows that was sent out to the streets to ask people for their passwords.   The ridiculous easy way, in which she got that information, was astounding.
One of the other features to come out of it was people still use dictionary words, personal information, easy to remember sequences.
Passwords have to be complex, unique and more than 9 characters.   Its not easy for you it is easy for them.

I only trust my friends on social media

On my Facebook recently there has been a spate of people who are already my friends asking to hook up on Facebook again.
It can be very difficult making sure that you do not fall for this type of scam

3d people – man person with umbrella and arrows. Protection against problems

I am not rich and famous why would they pick on me

On the Internet everyone has something of value.
Even though you may not have money or access to money, trade secrets or you think your personal information is not important you still have one thing that the cyber criminal considers important.
You have some sort of technology that they can then use to target other people from and hide their attack behind.

Digital security is very expensive

The fundamentals are not.
Use a firewall, use an anti-virus, back everything you consider important up, patch it all and use a decent password.
None of these are expensive, but they all lift anyone out of the realms of easy targets.
In addition here are a couple more – Trust no one and be paranoid.

I don’t need a back up because it will never happen to me

If you think that your information on your digital device is not worth backing it up then ask yourself this question – if I lost my laptop, dropped my phone in the toilet or my tablet was stolen what information could I not live without.
That’s the information that needs to be backed up.
Backups are for any digital device that has your information on that is irreplaceable.
The bad guys have changed, we have not.
They’re are smarter, more persistent and definitely more brazen.   We have to adapt to their changes and make sure we are protecting ourselves, if we don’t no one else is
Roger Smith is the CEO of R & I ICT Consulting Services, Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity), Amazon #1 selling author on Cybercrime, Presenter for the Business Security Intensive, author of the Digital Security Toolbox and Digital Security Framework.   Rapid Restart Appliance Creator.   He is a Speaker, Author, Teacher and Educator on cybercrime and how to protect yourself from the digital world. 

6 cybersecurity countermeasures your organisation needs right now

Modern organisations use and need access to today’s technology but understand little of the actual underlying systems.

This creates a huge problem for the cybersecurity of the organisation.

With due diligence to the fore you would think that implementing a cloud solution would be relatively easy, everyone is doing it and of course it will make the organisation more competitive.

But will it?

Today’s organisational technical environment are a hash of unrelated systems needed to fit a niche requirement, combined with the least available spend and with the best return available.

It is no wonder that inter operability becomes a huge problem when combined with the cybersecurity aspects of protecting the organisation.

Now tie that in with the business compliance requirement and you can see how big a problem business security becomes.

There are a number of strategic requirements that can be used to make the organisation more secure.

They are:

Education

Teach your children well, never mind the children, teach your staff an understanding of cybersecurity and securing your business. Your staff are usually the first line of defence and the last line of resistance.

They will see something happen, open an attachment, follow a malicious link and they need to be able to recognise what they have done and then do something about it.

Realise that they have gone to a malicious website and unplug the network card.

Technology

Invest in the best.

The newest operating systems and applications, the best firewall you can afford to buy, the most secure wireless and VPN system.

They are all important in protecting your organisation.

But, they all need to be updated and patched as required.

Data management

Who has access to what and what can they do with it. Where is it stored and have you got a backup of all critical data.

Those questions are all part of the risk management component of an organisation.

When it comes to risk and data always err on the best protection that you can afford.

User access

Restrict access to system.

Need to know, yes its an old saying but it still has currency in today’s world.

Make it a rule that no administration account has access to the internet or has an email account. These are the primary attack vectors for a cyber criminal.

Policies, procedures and processes

Build them and they will protect your organisation. There is a fine line between over restrictive and non existent.

All of the three P’s should be designed to support business functionality.

Back it up

No matter the expense, an investment in a backup strategy, a disaster recovery plan and a business continuity plan can mean the business will survive a silly mistake.

No matter the situation a decent strategy around recovery will save you every time.

Your organisation can come to a complete stop with one interaction with a dedicated bad guy. Make sure that you are not exposing your organisation to that problem

Everyone within the organisation has a requirement to look for the signs that depict a cyber attack.

Use them, educate them and make sure that everyone knows that the requirements are within their job purview.

Roger Smith is the CEO of R & I ICT Consulting Services, Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity), Amazon #1 selling author on Cybercrime, Presenter for the Business Security Intensive, author of the Digital Security Toolbox and Digital Security Framework.   Rapid Restart Appliance Creator.   He is a Speaker, Author, Teacher and Educator on cybercrime and how to protect yourself from the digital world.