
A recent report by the Institute of Directors (IoD) based on a survey by the IoD and Barclays Bank reported that whilst 95% of respondents considered cyber security to be important to their business 45% still lacked a formal cyber security strategy. Some 40% of respondents would not know who to contact if they were the victim of an attack.
The report says: "Over the last 12 months, the number of cyber security incidents has continued to increase, and more and more it is being demonstrated that it isn’t just ‘the usual suspects’ being attacked. From Lincolnshire County Council to Tesco Bank, it’s clear that cyber security is an issue for just about every organisation. With new legislation in the form of the EU’s GDPR on the way, firms must ensure that they’re equipped for the 21st century."
Only 44% of respondents had provided their staff with cyber awareness training and many left gaps of more than a year between their training programmes. Since staff are invariably the weakest links in cyber security this is a particularly worrying statistic. Firms need to develop and deliver robust staff awareness programmes.
Is it really that urgent?
As cyber crime increases and with GDPR on the horizon the time for action is NOW – no more hoping that it won’t happen to your firm; no more hiding under a blanket of false security. Law and accounting firms as well as organisations in the health sector are particularly vulnerable given the vast amounts of client data that they hold. Phishing and social engineering attacks are growing exponentially.
Marc Dautlich, Data Legislation Partner at Pinsent Masons LLP warns in the IoD report: “Today, many personal data breaches in the UK go unreported by businesses. In jurisdictions that already have mandatory breach reporting requirements, such as the US, unprepared directors have found themselves losing their job after a breach for failing to give adequate attention to the issue, and therefore letting down their stakeholders, damaging their business’s reputation, and exposing it to regulatory and legal sanctions. The mandatory requirement to report security breaches will bring an increased risk of quasi
‘class action’ lawsuits in the UK. Furthermore, negative publicity tends to drive regulators to use their powers in a more robust way: under GeneralData Protection Regulation they will have power to award substantial fines to UK businesses.”
How can YOUR firm be more cyber resilient?
These are some of the steps you should be taking:
What should be covered in staff awareness training?
A good cyber awareness programme should cover – as a minimum – all of the following:
- Updating software
- Scanning computers
- Passwords
- Emails
- Social media platforms
- Working off-site
- BYODs
Does your firm have a cyber security strategy?
Does your firm provide cyber awareness training?
Alchemy Systems have 20 years of IT systems experience and are a Microsoft Partner. Alchemy Systems Designs, Supplies, Installs, Supports and Protects clients’ IT systems. The legal sector has always been a strategic focus. Our staff are experienced in the specific needs and challenges of law firms from service desk to strategy to protection services.
Tel. 0330-043-0801
email.info@alchemysys.co.uk