Cybersecurity has been an issue since before the advent of the internet – yet even today, there is still a lot of misinformation and misunderstanding around what it is and how to protect yourself and your business.

In this blog we want to explain what kind of threats are out there, the simple steps you can take to fend them off, and the more advanced tactics you can utilise to protect your business, staff, and customers.

According to Security Magazine, there are five main cyber threats to be aware of in 2021, these are: Social Engineering (such as phishing attacks and scareware), Ransomware, DDoS (Distributed Denial of Service) attacks, weaknesses in Third Party Software, and weaknesses in Cloud Security.

Phishing is probably the most common and well-publicised of all cybersecurity threats, and the chances are you have received a dodgy text or email purportedly from your bank, mobile phone provider or other trusted business. While many people are becoming wise to the threat, these types of scams are still big business for criminals who prey on the vulnerable, as well as those of us too busy to give them a second thought.

There are some easy ways to avoid falling victim to phishing though; if you get a text, check with the company it is supposedly from to see if it is genuine, many big businesses have an anti-scam section on their website. If you get an email, click the ‘from’ name and check the email address it is coming from – if it is from Hotmail, Gmail, or iCloud, bin it and report it to your IT manager.

Ransomware is often the unfortunate consequence for businesses of staff being successfully phished, where one errant click can lead to your whole IT infrastructure being held at ransom by hackers demanding huge amounts of money in exchange for releasing your data. Worryingly, there is also a risk that even if you pay up, you won’t get your data back – criminals are not known for their ethics after all. Again, the best way to protect yourself is to be alert to potential phishing attempts, and also to regularly backup your data on a separate server, ready to take over in the event of an attack.

A distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service or network by overwhelming the target or its surrounding infrastructure with a flood of internet traffic. Attackers utilise multiple compromised computer systems as sources of malicious traffic. Exploited machines can include computers and other networked resources such as smart devices.

A DDoS attack acts a bit like a traffic jam clogging up the network and preventing legitimate traffic from accessing your website or using your network.

The most obvious symptom of a DDoS attack is a site or service suddenly becoming slow or unavailable. But since a number of causes — such a legitimate spike in traffic — can create similar performance issues, further investigation is usually required. Traffic analytics tools can help you spot some of these telltale signs of a DDoS attack:

• Suspicious amounts of traffic originating from a single IP address or IP range
• A flood of traffic from users who share a single behavioural profile, such as device type, geolocation, or web browser version
• An unexplained surge in requests to a single page or endpoint
• Odd traffic patterns such as spikes at odd hours of the day or patterns that appear to be unnatural (e.g. a spike every 10 minutes)

Most businesses, increasingly so thanks to Covid, are working in the Cloud. This brings with it benefits but also increased risk as your data may not be held solely on your own servers, limiting the control you can have over its security – again this is where having a local backup is important.

Finally, there are risks from installing any software on your system, but particularly from smaller developers or from sites such as Github where software might be in Release Candidate (RC) or Beta stages and security risks may not have been fully ironed out. We would always recommend sticking to software from trusted sources unless there is absolutely no other option.

Thankfully, there are some simple steps you can take to protect your business – starting with a Cyber Security Audit which will highlight your strengths and weaknesses and suggest areas for improvement, another step up from this is known as Penetration Testing or ‘ethical hacking’ where a simulated attack is carried out on your infrastructure to see how at risk it is.

Another key tool to reduce the risk of falling victim to cyber crime is to ensure you and your staff are kept aware and up to date with the most common threats, how to spot them and how to deal with them – after all, security is a joint responsibility and User Awareness Training is key to driving home that message.

Tekserv is a Sophos Silver Partner and we can provide a range of cyber security services to make sure your equipment and data is protected.

To find out more visit our Cyber Security webpage, email info@tekserv.co.uk or call 01779 478064.