How to stop cybercriminals infiltrating your IT systems

Every week, I receive four or five phishing emails that are attempts to inject a virus or some other malware into our IT network. The emails are very plausible: click here to view our invoice; your PayPal account has been debited with £550; or thanks for making the purchase – if you didn’t click here.

We are all vulnerable to attack and businesses need to be careful to guard against this. The scariest stories involve cybercriminals managing to bring your entire IT environment to a halt or infiltrating business IT systems, hijacking customer data and holding this to ransom. A recent study by IBM Security found that the average cost of lost business to US companies was $1.52 million.

The stories told seem to indicate that, for many businesses, once their systems are breached, they have no choice but to pay the ransoms being demanded and hope that the hackers will then release their systems or agree not to put their customer data on the open market.

The more successful hackers are those that build a “business” reputation for releasing locked-up systems or destroying stolen copies of customer data once ransoms have been paid. Victims are more likely to pay ransoms if hackers are known to respond to payment positively.

SO WHAT CAN YOU DO?

An association to which I belong lost 69,000 to confidence tricksters who phoned their office, masquerading as their bank, and persuaded an unwitting employee to transfer money out of the association’s bank account.

In a subsequent independent inquiry commissioned by the association, it found that no anti-fraud training had been given to employees. So my first suggestion to you is that, if you have not done so already, you provide training to your staff and management so that they understand when not to open an email, when not to click on a link, when not to respond to unusual requests on the telephone. This will straight away slam shut quite a few doors that hackers and tricksters are trying to open.