C Y B E R L AW
BRACED FOR GIANTS LIKE YAHOO HOG THE HEADLINES WHEN THEIR DATA IS COMPROMISED BUT HOW PREPARED ARE THE UK’S SMES WHEN IT COMES TO CYBERCRIME? BY MARIA BARR
I
N WERNER HERZOG’S documentary Lo and Behold, Reveries of the Connected World, legendary hacker Kevin Mitnick recounts how he got his hands on confidential security information from a company’s overly helpful receptionist, simply by asking nicely and sounding like a trustworthy sort of guy. The threat from cyber criminals to small businesses from methods like these, along with sophisticated software designed to latch onto data, is very real. And the resulting cost might not just be reputational damage but could land you in some pretty steamy legal waters too. CRIMINAL MINDS According to the The National Crime Agency, the number of data breaches reported to the Information Commissioner’s Office (ICO) has nearly doubled in 2016. That may mean businesses are getting better at reporting breaches but there’s little doubt that the criminals are also getting smarter and finding new ways to get their hands on data. But if you think your firewalls will protect you, it’s not as simple as that. The easiest point of entry is through people, says Rose Bernard, analyst in 70
ELITEBUSINESSMAGAZINE.CO.UK OCTOBER 2016
A BREACH the cyber threat intelligence team at Control Risks, the risk consultancy. “SMEs often underestimate the threat posed by social engineering, where an individual is targeted by a cyber criminal and persuaded to disclose information that helps the perpetrator get to the data they’re really after,” Bernard says. One of the other ways hackers can get the data they crave, like a username or password, is through a phishing email or instant message, where they’ll pose as somebody from the company so people let their guard down. COMPLACENCY BREEDS CRIME If you’re reading this and thinking “meh”, you’re not alone. According to a report by Juniper Research, 74% of British SMEs think they’re safe from cyber attack, despite half of them having suffered a data breach. Andrew Starr, managing director at OpenIPStarr, an IT consultancy, agrees
that SMEs can be blase when it comes to data security. “Our biggest challenge when working with clients is to get them to take cybersecurity seriously,” he says. Some small business also tend to see cybercrime as a problem for the big guys with the big data, not least because they’re the ones who make the headlines when sensitive information is leaked. But if anything SMEs are even more at risk, says Bernard. “Small businesses often represent attractive targets for criminals who perceive them to be more vulnerable than larger companies with dedicated cybersecurity departments,” she warns. Jason Hart, chief technology officer of data protection at Gemalto, the digital security company, points out that most cyber criminals don’t discriminate against small businesses. “From a bad guy’s point of view, all they want to do is consume data,” he says. “Any data.” And given how reliant businesses are