What is cybersecurity for business?

Businesses are at risk of a range of different attacks. These can include:

• Social engineering attacks: By impersonating a trusted family member or colleague for example, criminals can trick employees into giving away valuable information. This can be achieved through impersonation via social media, or even via AI-generated voice messages in the likeness of a trusted person.
• Phishing: This is a common type of social engineering attack. It involves tricking a victim into giving away personal information via a fake website that looks similar to a regularly used site. Employees might be at risk of phishing if they click on a link sent by an unknown emailer or an email from someone impersonating a colleague or client.
• Ransomware: Ransomware attacks prevent someone from using their device completely until a ransom is paid.
• Denial-of-service attacks (DDoS): These attacks disrupt any typical traffic to a network or online service, which can stop customers from buying products or using a company’s services.
• Chargeback fraud (for e-commerce sites): While this isn’t a form of attack as such, chargeback fraud happens when a customer buys a product, receives it and then asks for a chargeback from an issuing bank claiming that they did not receive the product.

Cybersecurity attacks are constantly changing, and businesses may need to keep up-to-date with the latest forms of cybercrime to ensure the safety of their supply chains, customers and employees. Supply chain cyber threats in particular are on the rise, including phishing attacks within the supply chain and infrastructural attacks. Additionally, social engineering attacks are becoming more advanced with the help of AI technology. Criminals can now impersonate an employee’s colleagues or clients using more convincing AI-generated text or AI-generated voice messages, which can be based on the voice of their victim scraped from social media websites.

How prepared are UK businesses?

According to the UK government’s cybersecurity data breaches survey, half of businesses and a third of charities have experienced a cybersecurity attack or breach in the last 12 months. This is much higher for medium businesses (70%), large businesses (74%) and charities with £500,000 or more annual income (66%).

Businesses therefore may highly benefit from being prepared in case they become the target of a data breach or cybercrime attack in the next year. A particular growing area of concern is business supply chains. The study above found that while there was increased awareness of supply chain risks, businesses had limited formal procedures in place to prevent them.

Staying compliant with UK law

The precautions that businesses will have to take will depend very much on the nature of their business. E-commerce sites and financial institutions will have to have certain measures in place to remain compliant with UK legislation including anti-money laundering regulations, as well as protect themselves from a range of different cybercriminals.

Keeping up-to-date with changes to the law – as we recently saw with multifactor authentication – is highly important for businesses, as they may have to update their cybersecurity measures again over time.

Top solutions to cybersecurity threats

This next section provides some ideas for businesses looking to prevent cybersecurity threats.

Training professionals in basic cybersecurity hygiene

Talk about how important, therefore, it is to train staff in basic cybersecurity awareness to prevent issues such as phishing or social engineering. Training employees in basic security hygiene is a great first step that may only require one or two training sessions.

Cybersecurity training can work well as part of an upskilling strategy. Learning these additional skills can empower employees and encourage professional growth. They can also help to close skills gaps within an organisation.

Cybersecurity knowledge may eventually be considered as foundational future skills and we believe that organisations can benefit from taking initiative in training employees themselves. We also advise to regularly monitor and evaluate employee learning progress to ensure a culture of learning.

Hiring cybersecurity professionals

Businesses (especially those most at risk) can benefit from cybersecurity professionals on their teams. They can help keep their cybersecurity tools up to date with government regulations as well as help prevent more sophisticated attacks. They can also benefit from hiring cybersecurity in-house or external teams. Businesses can either hire externally for specific jobs such as setting up secure systems, or hiring them so that they are in-house. Considering that medium to large businesses are most at risk, it could be good to have an on-call team ready.

Identifying and solving cybersecurity skills gaps

A big issue for many businesses is a cybersecurity skills gap. As cybercriminals become increasingly advanced in their techniques, this may become more and more of an issue as they learn to outsmart a business’s operations. In our guide to the cybersecurity skills gap in the UK, we discovered that many employees in charge of cybersecurity lack the confidence to carry out basic security tasks. This makes sense, considering only 11% of businesses outside the cyber sector provide security training for their employees.

Fraud prevention tools

Smaller or medium businesses that don’t have the budget for a specialist cybersecurity team might look to invest in fraud prevention tools that cover most of these bases and have an in-house team that can provide advice to businesses. This can include identity-verification tools, email lookup and phone lookup tools.

The UK government also provides key guides to cybersecurity and fraud prevention. They provide general advice for both small businesses and sole traders in particular:

• Cyberaware provides advice on how to stay secure online, including email security, how to set strong passwords, turning on two-step verification, backing up your data and keeping devices up-to-date. This advice is fairly basic, which means that it is most useful as a first step for employees with little cybersecurity literacy.
• The UK government-run National Cyber Security Centre’s Free Cyber Action Plan helps users create a personalised action plan for small organisations, as well as individuals and their families. For example, they can provide information on whether your IP address has any security issues, how to back up data on secure devices and how to scan software for viruses.
• The National Cyber Security Centre’s Small Business Guide is relevant to businesses that are looking to improve their security using a simple step-by-step guide. The Centre also explains how to avoid phishing attacks, how to protect data and how to back up company data securely such as via the cloud. They provide additional Cloud Security Guidance for configuring cloud services securely. 
• The UK government also provides a service that enables UK organisations to identify any common vulnerabilities in their public-facing IT. This includes checking the security of their emails, their IP address and their web browser.

The UK government also backs several different cybersecurity training schemes. Certifications are useful for businesses looking to prove that their websites are secure and protected against attacks. This is reassuring to both customers and other businesses looking to work with you:

• The UK government’s cybersecurity training for business series provides free online training for both employers and their staff. It provides specific training for small and medium-sized organisations known as ‘top tips for staff’. There is also training for procurement and supply chain professionals. Finally, there is training for organisations that want to test their responses to a cybersecurity attack.
• The government’s ‘top tips for staff’ guide provides employers with a short cybersecurity training session for staff including a quiz at the end. This quiz helps employers to gauge any potential weaknesses in staff knowledge of cybersecurity.

In the UK, businesses also have the option of reporting cybercrime and fraud to Action Fraud or the National Cyber Security Centre. The Action Fraud website is also regularly updated with government-backed cybersecurity advice.

Getting prepared to tackle cybercrime is of increasing importance to UK businesses. This can take many different forms such as training staff on how to prevent phishing and social engineering attacks, and keeping data safe. Businesses may also want to provide specific training to procurement and supply chain professionals, as they are becoming increasingly at risk.