If you haven’t had time to catch up on the latest cyber security update from the National Cyber Security Centre (NCSC), don’t worry as we’ve summarised the important news and latest cyber threats that you need to be aware of in order to help protect your business from cyber attack.
Energy regulator warns of phishing emails
Energy is a hot topic at the moment, as households struggle to meet rising gas and electricity bills, so it is not surprising that cybercriminals have chosen to exploit this and prey on vulnerable people. The energy regulator Ofgem recently issued advice following the news that cybercriminals had been contacting people claiming they were Ofgem and requesting bank details in order to process a rebate. As attractive as an energy bill rebate sounds right now, it is one of those things that is too good to be true, so Ofgem is warning people to be vigilant and follow this advice:
- Ofgem will never sell you energy or ask for your personal details, so if this happens you can be certain it is a scam.
- Check your emails before opening them or clicking on anything. Does the email look as though it was from Ofgem? Is the logo present and clear and is the email address ending @ofgem.gov.uk? Refuse or ignore anything that looks unusual or suspicious.
- If you think you have been a victim of this Ofgem energy scam you can report it to Action Fraud on 0300 123 2040 or call Ofgem directly on 020 7901 7295.
Though this scam is aimed at homeowners, don’t underestimate the damage it could do to your business. If any of your employees open a phishing email on a work device and click on a link or open an attachment it may install malware such as a virus or ransomware on the device, which if it is connected to a network, may spread to infect the whole network. Making your employees aware of the latest threats will not only protect them as individuals but will help to keep your business secure.
Protect your network with this joint advice on common attack vectors
As a timely reminder to organisations about the importance of being aware of and being able to mitigate many different types of cyber attacks, the NCSC has issued joint advice with the CISA in the US and other international partners in Canada, New Zealand, and the Netherlands. This advice summarises the most common ways in which cyber attackers can gain access to your network.
We’ve summarised the common weak security controls highlighted in this joint advisory, so you can use it is as a checklist to ensure your cyber security measures regarding your networks are up to date:
- MFA not being enforced – it’s one thing to have multi-factor authentication set up but another thing altogether to ensure it is always being used. The advice is, don’t exclude any users from MFA, as it’s critical to mitigating common infections such as ransomware.
- Incorrect permissions or access control – one of the easiest ways for cyber criminals to access your network is via a user account you didn’t know existed or didn’t have the permissions you thought.
- Software not up to date – out-of-date or unpatched software is another easy point of access for cyber attackers and they can use these vulnerabilities to launch denial of service attacks or take control of your system.
- Using default usernames and passwords – most hardware and software come with default usernames and passwords, but these are only ever meant to be used for the initial setup and then changed to something more secure.
- Unprotected cloud services – misconfiguration of your cloud services and accounts can make it easy for cybercriminals to steal your sensitive data.
- Open ports – this is a particularly common vulnerability as cybercriminals can use scanning tools to search for open ports and use them as a way into your network. By compromising a service on a host, it paves the way for them to attack vulnerable entities.
- Weak passwords – leaked, compromised or weak passwords are always going to be an easy way in. We’ve said it time and time again and this joint advisory has reiterated the point that enforcing strong passwords is a must across your organisation.
Help to put cyber security on the agenda in your boardroom
There may have been a positive shift in boardroom attitudes towards cyber security over recent months and years, but as the cyber security agencies agree, there is still a way to go in order to ensure those items that get discussed around the big table actually translate into committing resources and making things happen.
With this in mind, the NCSC has produced a toolkit to help boards converse with their technical experts about cyber security measures. This cyber security toolkit can be found here and features a range of resources and guidance on topics such as:
- Risk management
- Developing a positive cyber security culture
- Planning your response to cyber incidents
- Growing cyber security expertise
- Implementing effective cyber security measures
We hope you have enjoyed our cyber security update and now feel better equipped to deal with the latest threats. To further protect your business why not enquire about our cyber security packages? We use leading technology to detect vulnerabilities in your IT network and provide a suite of cyber security measures including endpoint security, multi-factor authentication, security patching and email incident response to protect and defend your business from the latest threats. Call us on 01329 888444 to find out more.
