September 2019

5Strong passwords Another huge risk for
anyone with a connected device, especially
in today’s online world and the
proliferation of online banks and the move to
paperless interaction with HMRC, is their
password.
It is essential that the same passwords are never
reused. It’s entirely understandable that we reuse
passwords or variants of them in combination
with the same email address or username. But
those that do and who are unfortunate enough to
have been compromised will find that any
account they have is also at risk.
As to how to create a strong password, avoid
names, places, pets or dates of birth. Use a long
mixture of upper case, lower case, numbers, and
symbols. Search for an online password
generator.
Lastly, change passwords frequently and
especially when any member of staff leaves.
6Put sites off limits Human error is the
biggest cause of security vulnerabilities so
it’s important to ingrain caution within
staff, ideally by a policy that covers what they can
and cannot do online. This means detailing which
websites can be visited, that no software is to be
downloaded or installed (it could be pirated and
compromised), and that email with attachments
should be quarantined and scanned. Again,
having decent and current anti-virus software in
place will mean that anything that is downloaded
will be scanned before being opened or run.
7Be private Remembering that human error
is one of the biggest risks, staff should be
made aware of ‘social engineering’ and that
a plausible caller can get someone to give away
whatever is held precious. It’s this that is behind
authorised push payment fraud – where a caller
tells an individual that their accounts are at risk
and that they should move their monies to a new
and ‘safe’ account. The harsh reality is that these
“At the end of the day, computers can and do get compromised so planning for disaster should be part of business housekeeping”
individuals have sent their monies to the fraudster
and so will get little help from the banks.
Never give any private information out without
being 100 percent certain of the person or
organisation asking. Be careful with what the
business (and individuals) post online or via
social media. Apply the same principles to paperbased
information. All someone needs to
compromise your systems is enough of the right
bits of information.
As the evidence shows, using social engineering
is much easier than expending effort on hacking
systems.
8Public WIFI It’s so tempting to want to be
online at all times and it’s just as tempting
to use public, or open, WIFI networks.
Partly because mobile data may be unavailable
but also because it may be free. The reason is
very simple – just as you can connect a laptop to
a free WIFI hotspot, so can anyone else. If they’re
criminally minded, they can access your data and
plant viruses.
9Staff devices Another threat to counter is
one from staff who connect their own
devices such as phones, to company
network or their computer. Thought should be
given to limiting access to the firm’s WIFI or
physical network. The same applies to USB
devices – it’s a well-known trick for a fraudster
to drop a USB stick in a car park for an individual
to pick up and connect to their computer to see
what’s on it.
up At the end of the day,
computers can and do get
10Back
compromised so planning for
disaster should be part of business
housekeeping. Backing up data onto several
separate devices, regularly (at least once a day)
and keeping them off site at different locations is
critical. Consider a combination of methods such
as external hard drives, a computer elsewhere
and cloud storage services such as Dropbox.
Remember to encrypt devices in case they fall
into the wrong hands.
To end
Assuming that you are unlikely to be attacked is a
foolish stance and one that will lead to disaster.
All it takes is a lucky find by a hacker combined
with easy access for the rest to be history.
See https://www.cyberessentials.ncsc.gov.uk for
more information.
SEPTEMBER 2019 TC 23