The Welsh social care sector continues to face an increasing number of cyber threats, any of which can compromise patient and client data, disrupt critical services, and cause financial harm to providers.
No organisation can fully protect itself from attack and as a result should assume that they are likely to experience cybercrime and that dealing with this ongoing threat must be tackled through a number of steps, which we have out lined here.
Cyber security training
All too often, employee errors provide cybercriminals access to online systems, that’s why knowledge is key.
Employees are much less likely to fall for a malicious activity if they know what to look for. Those who receive cyber security training are more likely to recognise the security risk of clicking a suspicious link or attachment, using a weak password, reusing a password, leaving a computer unlocked, or using public Wi-Fi.
And now, the Welsh Government is providing funding to offer Welsh social care sector staff the opportunity to take part in cyber security training – Cyber Ninjas through the platform Matobo Learning for FREE.
For more information on how to get involved click here.
What is incident response?
Once an attack has occurred this is a robust plan that is a step-by-step process in handling the incident.
the first consideration is ‘Do we have a process to proactively look for cyber-attacks even when everything is operating normally?’ (Members of the WCRC receive free and regular updates about vulnerabilities that have been flagged by other organisations specifically to help the wider community.)
The plan itself is simply a document containing the details of key personnel who you can contact if you are worried that you have been victim of a cyber-attack. It also contains information to help you move through the various stages of containment and then recovery. Having a good response plan means that you are more likely to come through the experience quicker and efficiently and with less of your systems exposed to the hack. And the responsibility for establishing and maintaining a plan is down to the business owner and not the managed service provider you use for your IT.
For guidance on how to create your response plan contact a member of the WCRC team.
What can I do now?
Practice practice practice. Once you’ve got an incident response plan prepared the next stage to establish your readiness is to try it out in a safe environment. The National Cyber Security Centre’s Exercise in a Box is an excellent starting point. This exercise will help you to check out how well you and your business can respond to a cyber-attack.
What other measures can you implement?
1. Join our free community membership and you will be supported through implementing the changes you need to make to protect your business and your customers.
2. Cyber Essentials – this helps make your organisation more resilient against cyber-attacks. It is a simple and effective government-backed scheme, supported by industry experts and the Cyber Resilience Centre Network, which will help you put measures in place to protect your organisation, regardless of size or sector, against a range of the most common cyber-attacks. A company operating under Cyber Essentials processes is 99% protected either fully or partially from today’s common cyber-attacks. And if you want to pay for the assessment, we can refer you one of our Cyber Essentials Partners – all regionally-based cyber security companies that can help you become accredited.
3. We would also recommend that you speak to your managed service provider and / or website company to discuss how they can implement cyber resilience measures on your behalf.
Reporting Cybercrime
Report all fraud and cybercrime to Action Fraud by calling 0300 123 2040 or online. Forward suspicious emails to report@phishing.gov.uk. Report SMS scams by forwarding the original message to 7726 (spells SPAM on the keypad).