Context
With cyber-attacks regularly in the news, the ICO is reminding businesses to check they have appropriate security measures in place to protect personal information. Businesses have experienced an estimated 7.7 million cybercrimes over the past year, according to government figures. Most small businesses hold personal information and conduct business digitally, so cyber security must be a priority.
Key points to note and next actions
Some practical steps businesses and their staff can take to improve their data security and resilience:
- Back up your data
- Use strong passwords and multi-factor authentication
- Use strong and unique passwords, which are difficult to guess, on all account and devices where personal information is stored. The National Cyber Security Centre (NCSC) recommends using three random words. Where possible, consider using multi-factor authentication.
- Be aware of your surroundings
- Be wary of suspicious emails
- Firms and their employees need to know how to spot suspicious emails. Look out for signs such as bad grammar, demands for ‘act urgently’ and requests for payment. New technologies mean that email attacks are becoming more sophisticated. A phishing email could appear to come from a source that is recognised.
- Install anti-virus and malware protection and keep it up to date.
- Firms must make sure the devices you and your employees use at home, or when you’re working away, are secure. Anti-virus software can help protect devices against malware sent through a phishing attack.
- Protect devices when unattended
- Make sure Wi-Fi connection is secure
- Limit access to those who need it
- Different workers may need to use different types of information. Put access controls in place to make sure people can only see the information they need.
- Take care when sharing
- Sharing screens in a virtual meeting may show the device to others exactly as you see it, including any open tabs or documents. Before sharing screens, close anything down that doesn’t need to be shared and make sure notifications and pop-up alerts are switched off. Be careful when sending emails to multiple people.
- Don’t keep data for longer than needed
- Dispose of old IT equipment and records securely
- Make sure no personal data is left on laptops, smartphones or any other devices, before disposal. Consider using deletion software or hire a specialist to wipe the data.
If an organisation experiences a data breach as a result of a cyber-attack, firms should report it to ICO within 72 hours of becoming aware of it. For more advice on protecting personal information, visit the ICO’s security guidance for organisations.
For further support on cyber security, visit the National Cyber Security Centre’s website and the Cyber Essentials programme, a Government-backed certification scheme that helps keep organisation’s – and their customers’ – data safe from cyber-attacks.