Malware is a type of malicious software that can seriously harm your business. Different types of malware include viruses, spyware and ransomware, all of which can cause damage to your business's devices, computers and network. A serious attack can stop your business from being able to access any of your data and stop you from operating.
Two high-profile cyber attacks have recently made headline news demonstrating the kind of disruption a malware attack can cause. The first at Hackney Council impacting vital services and the second at French IT firm Sopra Steria.
But these attacks don’t just happen to large businesses and organisations, according to a recent report by security firm Carbon Black, there are 65,000 attacks on small to medium businesses each day and around 4,500 of these hit their target.
As part of the Small Business Guide, the National Cyber Security Centre (NCSC) has produced a 5-step guide of easy-to-implement tips to help make your business more cyber resilient against malware attacks.
Tip 1: Install (and turn on) antivirus software Antivirus software - which is often included for free within popular operating systems - should be used on all computers and laptops. For your office equipment, you can pretty much click 'enable', and you're instantly safer. Smartphones and tablets might require a different approach and if configured in accordance with the NCSC's EUD guidance, separate antivirus software might not be necessary.
Tip 2: Prevent staff from downloading dodgy apps You should only download apps for mobile phones and tablets from manufacturer-approved stores (like Google Play or Apple App Store). These apps are checked to provide a certain level of protection from malware that might cause harm. You should prevent staff from downloading third party apps from unknown vendors/sources, as these will not have been checked.
Staff accounts should only have enough access required to perform their role, with extra permissions (i.e. for administrators) only given to those who need it. When administrative accounts are created, they should only be used for that specific task, with standard user accounts used for general work. Tip 3: Keep all your IT equipment up to date (patching) For all your IT equipment (so tablets, smartphones, laptops and PCs), make sure that the software and firmware is always kept up to date with the latest versions from software developers, hardware suppliers and vendors. Applying these updates (a process known as patching) is one of the most important things you can do to improve security - the IT version of eating your fruit and veg. Operating systems, programmes, phones and apps should all be set to 'automatically update' wherever this is an option. At some point, these updates will no longer be available (as the product reaches the end of its supported life), at which point you should consider replacing it with a modern alternative. For more information on applying updates, refer to the NCSC's guidance on Vulnerability Management. Tip 4: Control how USB drives (and memory cards) can be used We all know how tempting it is to use USB drives or memory cards to transfer files between organisations and people. However, it only takes a single cavalier user to inadvertently plug in an infected stick (such as a USB drive containing malware) to devastate the whole organisation.
When drives and cards are openly shared, it becomes hard to track what they contain, where they've been, and who has used them. You can reduce the likelihood of infection by:
blocking access to physical ports for most users
using antivirus tools
only allowing approved drives and cards to be used within your organisation - and nowhere else
Make these directives part of your company policy to prevent your organisation being exposed to unnecessary risks. You can also ask staff to transfer files using alternative means (such as by email or cloud storage), rather than via USB.
Tip 5: Switch on your firewall
Firewalls create a 'buffer zone' between your own network and external networks (such as the Internet). Most popular operating systems now include a firewall, so it may simply be a case of switching this on. For more detailed information on using firewalls, refer to the Network Security section of the NCSC's 10 Steps to Cyber Security.
The full Small Business Guide can be found on the NCSC website.