The top 3 cyber security measures companies overlook (and how to fix them!)

Unfortunately, compliance does not necessarily equate to security. With all the regulations and cyber security frameworks in place, many companies mistakenly believe they are well-protected. So, what are some of the most commonly overlooked issues? 

Security is a culture 

Hiring a security team alone isn't sufficient without taking the time to train your employees. This is critical yet often overlooked. A one-off, dull annual training session will not be enough to keep your company well-protected. While you might invest heavily in tools and programmes, it only takes one employee clicking on a malicious email link to compromise everything. 

Actionable steps: 

• Regular training: Implement engaging, continuous security training sessions. 
• Phishing simulations: Conduct regular phishing simulations to keep employees vigilant. 
• Create a security culture: Encourage reporting of suspicious activities without fear of repercussions.
• Book a free consultation: To learn how Wicresoft can help you start with Security Awareness Training, contact us directly.

Many organisations seek a rubber stamp on their security measures. Too often, leaders and consultants are eager to comply superficially and then don’t know how to handle issues or, worse, vanish when issues arise. Moving away from this mentality and fostering accountability can lead to a positive cultural shift. 

Actionable steps: 

• Leadership involvement: Ensure leadership is actively involved in security policies and decisions.
• Clear accountability: Define clear roles and responsibilities for security within the organization.
• Incident response plan: Develop and regularly update an incident response plan.

Cyber security is risk management 

Focusing solely on security controls without considering the cost and impact on the risk profile is misguided. Cyber security is fundamentally about risk management. Significant security improvements can be made by managing assets effectively and establishing sound policies, often without the need for expensive tools. It's crucial to communicate risk in terms that resonate with different audiences. For instance, a finance professional requires a different explanation than a restaurant owner. 

Actionable steps: 

• Asset management: Maintain an up-to-date inventory of all IT assets. 
• Risk assessment: Regularly perform risk assessments to identify and prioritize vulnerabilities. Want us to do a security audit  
• Tailored communication: Customize security communications based on the audience’s role and expertise. 

Third-party vendors 

The security of third-party vendors and supply chains is frequently neglected, despite being a significant entry point for attackers. A staggering 98% of organizations are affiliated with a third party that has experienced a breach. Furthermore, third-party attacks have led to 29% of breaches. As internal systems become more secure, attackers increasingly target the weakest links. Getting management to prioritise vendor vetting can be challenging. While it might seem easy to offload responsibility, the repercussions of a breach through a third party can be severe and complex. 

Actionable steps: 

• Vendor assessment: Implement a rigorous vendor assessment process before onboarding. 
• Continuous monitoring: Regularly monitor the security posture of third-party vendors. 
• Contractual agreements: Include strict security requirements in contracts with third-party vendors.
• Book a free consultation: contact us to discuss Cyber Essentials or ISO certification or any other questions you may have. 

Moving forward: government regulations, support, and basic cyber hygiene 

Adhering to regulations like the General Data Protection Regulation (GDPR) is essential in the UK, but leveraging government support is crucial. The National Cyber Security Centre (NCSC) offers valuable resources and guidelines for improving cyber resilience. Incorporating these into your strategy can provide an additional layer of security. Alongside regulatory compliance, implementing basic cyber hygiene practices can significantly enhance your security posture. 

Actionable steps: 

• Compliance review: Regularly review and ensure compliance with GDPR and other relevant regulations. 
• Utilise NCSC resources: Leverage NCSC guidelines and tools for improving cyber security. 
• Regular patching: Ensure all systems and applications are regularly updated and patched. 
• Endpoint protection: Implement firewalls and anti-malware solutions on all endpoints. 
• Access control: Limit administrative privileges and enforce the principle of least privilege. 
• Network segmentation: Segregate networks to limit the spread of potential breaches.