What is a cyber attack?
A cyber attack is an assault by a third party via a computer against another computer or computer system, which is intended to compromise the integrity, availability or confidentiality of that computer or computer system. For example:
- A remote attack on a business’s IT systems or website.
- Attacks on information held in third-party systems (for example, the company bank account).
Understanding the risks faced by the business
Every business should identify the key assets that need to be protected from a potential cyber attack. For example:
- Customer databases.
- Financial information.
- IT services (such as the ability to take payments via the company website).
Consider the impact that a cyber attack could have on the business
- Financial loss. Financial losses stemming from:
- theft of information, bank details or money;
- costs associated with cleaning up affected systems and getting them functioning again.
- Reputational damage. A business that has been the victim of a cyber attack will be keen to convince its customers, owners, employees and the general public that the incident was a one-off event and the situation is now under control. Reputational damage can often lead to a reduction in profits and the erosion of a business’s customer base.
- Regulatory sanctions. The business could be fined if personal data is lost or compromised due to a cyber attack. Data protection laws require businesses to implement appropriate technological and organisational security measures against unauthorised or unlawful processing, accidental loss and destruction or damage of personal data.
Planning for a potential cyber attack
Businesses should contact their suppliers, major customers and competitors to find out whether they have been the victim of a cyber attack. This information will help the business decide whether it may be the target of an attack.
Business continuity planning
- Produce a plan detailing who to contact for support if the business is attacked or its online services are disrupted. The plan should set out the business’s recovery procedures and explain how it would continue operating, particularly if the business trades online.
- Important business records (for example, sales information) should be backed up regularly and archived in a secure, off-site location that can be easily accessed after a cyber attack.
Implementing measures to protect the business from a cyber attack
Businesses can take a number of steps to improve their security controls:
- Malware protection. Install anti-virus solutions on all systems and keep software and browsers up to date. Consider restricting access to inappropriate websites to reduce the risk of being exposed to malware (malicious software).
- Network security. Increase protection of the business’s networks (including wireless networks) against external attacks through the use of firewalls, proxies and other measures.
- Home and mobile working. Home and mobile working increases a company’s cyber risk profile. A business should draft and implement a home and mobile working policy and train employees to adhere to it, especially if the business allows employees to use personal mobile devices (for example, laptops or tablets) for business use.