Summary

• Many company leaders lack the familiarity with business systems to adequately assess cyber risks in their business

• There is no easy framework for IT

• It is easy for business leaders to assume if they use ‘big cloud hyperscalers’, they are compliant, backed up and safe

• Basic starter questions you can ask in your business to assess the level of security you have in place and more importantly, whether it is at the right level for your business

In a week that saw one of the world’s biggest IT disruptions that affected 8.5 million Windows devices, a new Cyber Security and Resilience Bill was announced in the UK.

A Bill is being introduced in response to the increasing frequency and severity of cyber-attacks which we’ve recently seen affect critical functions of the Ministry of Defence, the British Library, Royal Mail, and most recently, the NHS.

While I applaud the UK government taking action to mitigate this serious threat to our infrastructure, those at the top of businesses also need to take notice.

Are You Protected?

Many company leaders lack the familiarity with business systems to adequately assess cyber risks in their business asking the IT team ‘Are we protected?’ with ‘Yes, we’ve Cyber Essentials, ISOs and the last time any disruption happened we were fine’ being the response. It’s difficult to go beyond that without knowing what to ask.  Until an attack happens. Like house insurance, it is only after a burglary you realise what the true impact is.

One of the reasons is that there is no easy framework for IT. Take Health and Safety, with straightforward certificates and policies that can be easily adhered to and a regulator that strikes the fear of god into most businesses if not. There is no real equivalent for cybersecurity risk management and yet the risks to your business are just as critical to your customers, employees and shareholders.

Your Critical Systems

It is easy for business leaders to assume if they use ‘big cloud hyperscalers’, they are compliant, backed up and safe. Cloud services are a tool, and it’s down to you to make them safe.

The recent IT outage was a big wake-up call. It demonstrated the impact of a global outage. If you have critical systems, you should consider that cloud-hosted systems could pose a heightened risk factor in your IT profile assessments.

I work for Claritas Solutions, a Wetherby-based IT company and we see businesses sleep-walking into cloud-based services they assume are safe and impenetrable because everyone else is doing it.  The problem is, as we saw, when everyone else is doing something, everyone is impacted when things go wrong. At Claritas Solutions, we have UK-based data centres and none of your data or traffic is routed overseas.

Starter Questions

Here are some basic starter questions you can ask in your business to assess the level of security you have in place and more importantly, whether it is at the right level for your business.

They are:

1. How do you manage IT risk?

2. How do you protect your business against cyber-attacks and how often is it tested?

3. How do you detect incidents once they’ve happened and how are they reported to you?

4. How do you get yourself back up and running afterwards?

Knowing these answers may start to help you understand your business’s current risk exposure. Having a single provider for core critical systems is always a risky strategy that needs careful consideration, with built-in robust mitigation capability in the event of failure.

Understanding IT Risks

Take time to seek a deeper understanding of IT risks in your business and responsibility for them, asking these four questions today to help prevent future cyber attacks.

Feel free to reach out and have a chat with the team.