UK Under Increasing Cyber Attack Threat: How SMEs Can Prepare

The National Cyber Security Centre (NCSC) has recently put out information and warnings regarding the increasing threat of cyber attacks for UK organisations, as there are growing concerns around hacktivist attacks, mostly on SMEs. The warning comes as the UK Government continues to strengthen its wider resilience strategy through the Resilience Action Plan, recognising cyber attacks as one of the country’s most significant and growing risks.

This follows the recent exposure of a sophisticated Russian state-backed zero-click phishing campaign, while the Government is also encouraging businesses across Britain to strengthen their cyber defences through its Cyber Resilience Pledge, reinforcing the importance of taking a proactive approach to cyber security.

Ongoing geopolitical tensions, including the current fuel supply disruption, has led to UK organisations with a presence in the Middle East facing high risk of cyber attacks and threats, potentially causing irreversible disruption and damage.

SMEs are not immune and need to understand the right solutions to tackle the rise in hacktivist attacks and the wide range of cyber threats out there. Performing a cyber security audit to review your current position is a good start, but SMEs and UK organisations must do more to remain protected.

Why the UK’s Cyber Threat Is Changing

Cyber attacks come in various forms, with some of the most common including ransomware attacks, where criminals request payment from a company to restore access to websites and data. However, due to current geopolitical tensions, an evolving threat has hit the UK, with attacks no longer being financially motivated.

These are known as hacktivist attacks, where criminals target governments and private and public organisations due to political, social or ideological motives. Hacktivist attacks can cause significant disruption to an organisation, whether it’s leaking information, performing DDoS attacks that render a website or service inaccessible, or stealing sensitive data to expose or embarrass the targeted company.

Why SMEs Should Be Paying Attention

Attackers are using hacktivist threats to target many UK SMEs. This is because many smaller organisations don’t have the proper cyber security procedures in place, and proper training on how to prepare and mitigate risk is often not provided. This makes criminals see SMEs as prime targets for both traditional ransomware attacks and the evolving threat of hacktivist attacks.

SMEs with supply chains across the world can now get caught up in hacktivist attacks which cause major business disruption, operational downtime and reputational damage. This has meant businesses have had to become more cyber resilient, and not just treat these threats as an IT issue.

The Fuel Supply Situation Shows Why Resilience Matters

An example of why SMEs and other UK organisations have had to become more resilient is the recent fuel disruption in the Middle East. The NSCS has warned any UK businesses with a presence or supply chain in the Middle East face an increased risk of indirect hacktivist attacks.

Already, different cyber incidents have affected critical infrastructure, causing a disastrous knock-on effect for businesses. Hacktivist groups run their cyber attacks against SMEs and businesses that are exposed due to projects that are connected to UK critical infrastructure, suppliers with regional offices or subcontractors with international operations.

This is why it is crucial for SMEs with these types of operations to prepare before disruption occurs rather than reacting after the cyber attack has taken place.

Practical Steps SMEs Can Take Today

Achieve Cyber Essentials Certification

The first practical step SMEs can take to prepare for potential hacktivist threats is to achieve Cyber Essentials certification.

Cyber Essentials is a UK Government-backed cybersecurity certification scheme developed by the NCSC. It is designed to help organisations protect themselves against the most common cyber threats by implementing a baseline level of cyber security controls. This can be taken a step further with Cyber Essentials Plus, which covers technical security in more detail.

The five key technical controls UK organisations include to achieve Cyber Essentials and Cyber Essentials Plus certification include:

• Firewalls – to prevent unauthorised access to your network.
• Secure configurations – ensuring devices and software are securely configured to minimise potential vulnerabilities.
• User access control – restricts access to systems and data so users only have the permissions they need to perform their roles.
• Malware protection – use of appropriate anti-malware solutions and security measures to detect, block and remove malicious software.
• Security update management – keep operating systems, applications and devices up to date with the latest security patches to address known vulnerabilities.

Achieving Cyber Essentials certification helps reduce the risk of common cyber attacks and hacktivist threats, including phishing, malware, ransomware and politically motivated attacks.

Follow NCSC Guidance

If you are ever unsure of how to provide your business with the right protection, the NCSC provides leading advice and resources for support. It’s important not to think of this as a one-and-done update, but more so an ongoing commitment to continuously improve resilience and protection for your business.

If you’re looking for a simple place to start, we’ve also put together an NCSC Cyber Security Checklist that breaks down the key recommendations into practical, actionable steps for businesses.

Train Your Employees

Keeping employees trained and up-to-date on the range of cyber attacks and threats helps to create a far more resilient and secure working environment. Security awareness training is a fantastic opportunity to get employees up to date and confident on the different processes to remain cyber secure. Generally, security awareness training will cover:

• The types of cyber security threats
• Strong password practices
• Cyber attack prevention and preparation
• The results of poor cyber security
• Responsible data sharing
• Real-world examples of cyber attacks

Review Your Cyber Security Regularly

SMEs should regularly review their cyber security measures and processes to ensure everything is up to date and to identify and prevent potential cyber threats. Regular audits, software updates and reviewing vulnerability management should be performed either by internal IT teams, or by a third-party IT partner.

By choosing the latter, an IT partner can keep systems up to date and allow an SME to focus on other core areas of work. They will also create contingency plans and outline the right ways to respond to any potential incidents, like hacktivist attacks.

Cyber Security Is Becoming a Competitive Advantage

By gaining cyber security from a third-party provider, it also demonstrates your SME is focused on growth as well as protection. When your SME shows that it’s got the fundamental security measures in place, it can lead to receiving Cyber Essentials certification, showcasing to clients and your supply chain that your business can be trusted.

Preparing Today Reduces Tomorrow’s Risk

Cyber attack threats are on the rise, with hacktivist threats especially becoming more common for SMEs. It may be time to review your business’s cyber resilience and act before your SME becomes a target. Becoming Cyber Essentials certified is a strong first step to take. Here at Optimising IT, we can help put the correct cyber security measures in place to see you become certified and better prepared against the evolving threats. Contact us today to book a cyber security consultation, and we’ll identify what needs to be done to ensure your business’s cyber security.