Cyber Attacks: Why Prevention is Better than the Cure

Cyber Attacks: Why Prevention is Better than the Cure

The Cyber Governance Health Check assesses and reports levels of cyber security awareness and preparedness in FTSE 350 companies (i.e., the UK’s 350 largest firms). The report allows these leading organisations to compare how security risks are managed and helps them to identify and address their different vulnerabilities.

According to the latest figures from the Health Check, over half (54%) of FTSE 350 companies list the risk of cyber-attacks as their number one concern (compared with other business threats like economic uncertainty or the unease surrounding Brexit). This figure is up from 29% just three years ago.

It’s likely that the recent spate of ransomware attacks in the UK, and the devastation that followed instances such as the NHS’s WannaCry scare, is cause for the unrest amongst Britain’s market leaders. Whilst it is positive to see the new priority given to limiting cyber-security risks by these leading organisations, the report also highlights a less optimistic statistic: the fact that one in ten organisations currently operate without a response plan for cyber-attacks, and over two-thirds of employees have not received any training as to how handle an event such as this.

However, as Marco Cova, Senior Security Researcher at Lastline, suggests:

“If one was to find a silver lining, I would say that these ransomware attacks will probably do more to raise the security awareness of vendors and organisations than many security measures have in the past.”

Indeed, faced with the seemingly ever-present threat from cyber-criminals looking to steal data (or else hold it hostage) at the moment, it seems obvious that organisations ought to conduct their due diligence and prepare for the worst. More than this, though, and with new GDPR legislation on the horizon for 2018, companies are now more accountable than ever for keeping their clients’ data safe. This means that investments in technology and thorough cyber-security training that is preventative rather than reactive are imperative. This type of risk-mitigating training could mean the difference between keeping confidential data safe and compliant with GDPR, and having to fire-fight the aftermath (financial, reputational, or otherwise) of a data-breach.

It remains true that the biggest risk to any company’s digital security is its own employees. More often than not, users inadvertently create an entry-point for cyber-criminals to take advantage of – by visiting unauthorised websites, re-using weak passwords, or opening an attachment from an unknown sender, for example. This is why VinciWorks offer a range of information and cyber-security eLearning courses, all specifically designed to reduce the risk of a security breach.

Ensure your employees are aware of how to prevent a data breach with our Data Protection and Preventing a Data Breach eLearning courses. For added online security, we can also provide an off-the-shelf cyber-security bundle of courses, which includes full and short-course training to ensure your employees have a full awareness of cyber-security policies and best practices.

Is your organisation safe from the ransomware that crippled the NHS?

Is your organisation safe from the ransomware that crippled the NHS?

On 12 May, hundreds of NHS employees turned on their computers, only to be greeted by a message stating that their files had been encrypted and could only be unlocked by paying $600. Their computers had succumbed to WannaCry, a particularly vicious type of virus known as ransomware. The on-screen message that now dominated the screen could only be removed by transferring $600 worth of Bitcoin to a given address. Instructions for obtaining Bitcoin were also provided.

Forty-eight NHS organisations were affected by this cyber-attack, leading to cancelled appointments, operations and more. Patients were asked to stay home because staff did not have the means to receive or treat them. The NHS was held to ransom by unseen forces.

WannaCry and the threat to computers

The WannaCry software might be dangerous, but its spread is usually checked because it requires people to download a dodgy attachment or click a suspicious link. The virus typically spreads slowly, gradually, in fits and starts. What happened on 12 May was very different. The doctors, nurses, surgeons and administrators who found their machines frozen that day may not have been to blame for the virus overtaking their machine. WannaCry had found its way to their desktop through a backdoor that exists in older Microsoft Windows machines.

Remarkably, this backdoor is alleged to have been developed – and utilised – by America’s National Security Agency (NSA). This vulnerability, known as EternalBlue, was stolen from the NSA by a group of Russian hackers called ShadowBrokers and then shared online. EternalBlue was used to inject WannaCry onto a huge number of machines in a synchronised attack. Infected machines were then used to spread the ransomware onto other networked machines.

In a story with many startling elements, perhaps one of the most shocking parts is the fact that Microsoft had released a patch to close this vulnerability in March. The only computers affected by this attack where those that had not been updated. In the case of the NHS, it seems that the government chose not to renew a multimillion-pound security package which would have protected against this threat. This meant that the NHS attack also became a political issue in the middle of a general election.

The WannaCry attack was only halted by an intrepid IT security consultant who noticed that the malware was trying to connect to a non-existent web domain. Marcus Hutchins immediately registered the address, an act which killed the virus immediately and meant that hundreds of NHS organisations could get back to work.

While the usual advice on digital security is to raise awareness among staff, the WannaCry incident is a good reminder that employee training will only protect your organisation if your technology is up-to-date. Effective digital security must be holistic, protecting against a wide range of evolving threats with a mixture of training, processes, hardware, software and company culture.

How VinciWorks can help

Our vast and expanding cyber security training suite prepares users for all cyber risks. It includes hours of training, hundreds of micro-learning modules and topics from social media to IT security. These courses and micro-learning units can easily be configured into a multi-year training plan.