At Forms Plus, we recently had some training on Cybersecurity that opened our eyes to the risks we face and how to protect ourselves and our business against fraud and online crime.
Almost half of businesses and around a third of charities report having experienced some form of cyber security breach or attack in the last 12 months. This is much higher for medium businesses (70%), large businesses (74%) and high-income charities with £500,000 or more in annual income (66%), so we thought it might be helpful to share some of our findings (Government Cyber Security Breaches Survey 2024).
The Human Weakness – Social Engineering Attacks
For anyone seeking to disrupt a business, steal money or access information, the easiest way is simply to trick a human to let them in. One common way is a social engineering attack, known as phishing, by posing as a trusted source.
The aim may be to gain login credentials or install malicious software on your device. Sometimes the criminal will pretend to be someone in authority, your bank, your IT team or even your boss, using an email address that looks very close to authentic. This is known as spear phishing. These tricks can be quite sophisticated, perhaps by watching your Social Media, seeing that your manager is away at a conference and then sending a message claiming they suddenly need some money to get home!
If you suspect any such scam, immediately close the call or message. Wait a few minutes then contact the organisation or person they are claiming to be directly, using verified details. If it is your manager, call them on their normal number, or for an organisation, use contact details from their website.
Payment Fraud is another common way to target both businesses and individuals. You may receive an email asking you to change the account number for something you need to pay, such as a supplier’s invoice or a holiday booking. Any such requests should always be confirmed directly with the original provider, through contact details you know are genuine.
Red Flags to watch out for:
- Slightly off email addresses – if you hover over the email address, you should see the real sender’s details.
- Slightly off links – the URL on any links included may not match the legitimate company’s web address exactly.
- Poor grammar, odd phrasing or language that does not sound like the real person.
- A sense of urgency and threatening language, especially on the phone.
Remember, a legitimate business would never ask you for sensitive data such as your PIN, password or a confirmation number your bank has texted to you.
Malware – Malicious Software That Can Cripple Your Business
Cyber criminals use a wide range of malicious software that when added to your computer might deny you access to your system (a Denial of Service or DOS attack), copy passwords, access financial information, steal personal data or take control of the device. This may be done to disrupt a business, spy on it or steal from it. Countless small businesses have been forced to pay hefty ransoms just to regain access to their own data.
Keep your company’s systems safe from malware with:
- Regular software updates
- Robust antivirus software
- A network firewall
- Regular data backups, stored off-site
- Clear rules about plugging in external devices like USB sticks or phones
- Training staff not to click on links or open attachments from questionable sources
Free Wi-Fi? Not Always a Good Plan!
When out and about, perhaps working from a coffee shop, be aware that not all Wi-Fi connections are secure. Using a technique known as sniffing, criminals can connect to the same Wi-Fi network as you and see any data you send. Even just opening an App while on a public network can share that sign-in data. Some criminals even create fake hotspots, with names like “Free-Starbucks-Wi-fi” to lure you in.
If in any doubt, use a trusted VPN, or just stick to your own mobile network rather than the public Wi-Fi. It will be worth the extra data charges!
Keep Your Online Doors Locked with Strong Passwords
We all know we shouldn’t use easy passwords, yet if you know your colleagues’ pets or children’s names, you can probably guess theirs!
Make sure your passwords do not use words personal to you. One tip is to join 3 random words together and add some symbols or numbers. It is OK to save your passwords in your browser or use a password management tool such as 1Password.
Never share your passwords with anyone. If it is available, always add 2FA (two factor authentication) or MFA (multi factor authentication), to make your sign-in even more secure.
Physical Security Also Matters
Cybersecurity isn’t just digital. Encourage your team to:
- Lock screens when stepping away
- Shut computers down fully at the weekend
- Be aware of sensitive data visible on screens
- Keep laptops, tablet and phones secure at home, at work and when travelling
- Keep work and personal devices separate
- Use the same level of security on personal devices as for a business device.
Create a Security-First Culture
Finally, it can be very easy to fall foul of a cyber-criminal, even with all these measures in place. Make sure everyone is taken through your cyber security processes when they join you and share regular updates and advice with your whole team.
Encourage a culture of openness, so your team are comfortable letting you know if they have suspicions about any communications they receive or suspect their online safety may have been compromised. No-one who you really deal with will ever mind if you take steps to check their legitimacy.
If you would like more guidance on protecting your business, visit the Met Police’s Little Guide to Protecting Fraud and Cyber Crime. We’d love to hear your views or any other tips you may have on our Social Media channels.