The stability and security of IT systems may be something brought to your attention recently on a global scale; July 2024’s IT outage saw transport, healthcare, banks, and media outlets affected by an issue that originated with Crowdstrike, a cybersecurity company based in America.

Whilst this particular problem wasn’t caused by a security breach, it does bring into sharp focus the reliance so many of our critical systems have on digital processes; one wrong move, and thousands of lives are disrupted; the effects of the Crowdstrike outage, for example, will be felt for months to come.

You may not run a global airline or a multi-national bank, but you will still have your own concerns around your business’ cyber security. In this article, we’re going to be looking at how cyber security is changing, and how you can futureproof your business against catastrophic tech failures.

A brief history of cyber security

The birth of internet threats

Let’s start at the beginning – which, terrifyingly, is becoming something of a distant memory. References to the threat of ‘viruses’ dates as far back as 1987, when the first commercial antivirus software was made available. John McAfee founded McAfee around this time, which is still a popular cyber security programme today.

In the 1990s, internet use ramped up, with more and more people using their personal details online. For criminals, both organised and otherwise, this opened up windows of opportunity to steal personal data and make money from it.

The ILOVEYOU virus is an example of how cyber crime was executed back in the day; in 2000, an email message with the subject line “ILOVEYOU” arrived with an attachment in the inboxes of thousands across the world. The attachment contained what was then known as an ‘email worm’, which infected the computers that had been used to open the attachment, and their mailboxes, which allowed the malware to spread more easily, as more and more people assumed that the email had been sent by someone they knew.

Cybersecurity as standard

With over 1 billion people online by 2005, anti virus software, firewalls, and passwords of at least some complexity were required if both individuals and organisations wanted to keep their data, and their computers, safe from hackers. In 2007, we began to see the emergence of cloud-based antivirus software, which encouraged users to protect their data without the worry of space constraints on their computer.

Digital transformation, which refers to a business digitising their operations, naturally makes data more vulnerable, and with firms left with little choice by to do so (or risk getting left behind), cyber security became the standard in the mid to late 2000s. For example, shops that headed online to sell their goods started to collect the payment data of thousands of customers. In the wrong hands, this could prove catastrophic, as high profile data breach cases, such as that of TJX, owner of TKMaxx, found out in 2007.

Data breaches were to become a cyber security sticking point in the 2010s; unauthorised leaks of information put customers personal data at risk, regardless of whether it was accidental (such as employee error) or a targeted criminal attack. Stolen data can end up on the ‘dark web’, available for sale to other criminals who could then use it to launch phishing attacks, or commit identity fraud.

This prompted the creation of GDPR (General Data Protection Regulation), an EU regulation that stipulated how data was to be stored, handled, and protected by anyone that dealt with it. Whilst this doesn’t stipulate exactly what needs to happen from a cyber security point of view, it gives businesses no other choice but to take cyber security seriously, and provides a framework that software creators can use to help businesses make protecting data easier.

The current landscape

We now live in a post-COVID world; many of us are working from home for at least a portion of the week, and we’ve become so used to living our lives online, from socialising to ordering our groceries. During COVID, a time when internet use was sky high, phishing attacks boomed (such as scam courier delivery messages), and Sophos Group, a British security software company, reported that more than half of all businesses were hit by ransomware attacks just in 2020 alone.

To keep up with the cyber security that this new level of data transit requires, software has had to adapt to include things like end-to-end encryption, multi-factor authentication, and security keys.

Figures released by the UK Government in April 2024 paint a stark picture of the cyber security landscape, and the threats still posed by online criminals. Headlines include:

  • 50% of businesses and 32% charities experienced some form of cyber security breach or attack in the last 12 months
  • 84% of businesses and 83% charities reported phishing attacks, making these by far the most common type of security breach
  • Impersonation of organisations in emails or online affected 35% of businesses and 37% of charities
  • Viruses or other malware affected 17% of businesses and 14% of charities

It appears the awareness around the various controls in place to protect businesses against cybercrime has increased too, according to these figures. For example:

  • 83% are using up-to-date malware protection compared to 76% in 2023
  • 73% are restricting admin rights compared to 67% in 2023
  • 75% have implemented network firewalls compared to 66% in 2023
  • 54% have agreed processes for phishing emails, up from 48% in 2023

Future proofing your business: strategies and best practices

In terms of what you can do to protect your business, we’d recommend ticking the following off:

Conducting a comprehensive cyber security risk assessment

This involves things like checking the systems you use (such as Office365) for common security and configuration issues, searching for known breaches of your staff’s online business passwords, determining whether the systems protecting your emails and networks are securely configured, and assessing your IT systems against the main Cyber Essentials requirements. Experts like us are able to carry this cyber security audit out comprehensively for you.

Implementing multi-factor authentication (MFA)

Access should never just be one password deep – it needs to be layered, so implementing a multi-factor authentication system, whereby identity needs to be confirmed via text message or an app, for example, will help stop hackers in their tracks.

Embracing zero trust architecture

Zero trust is a principle that sees an organisation throw ‘implicit trust’ out the window, and instead verify a user at every stage, regardless of who they are within the organisation. Granular security controls are implemented as part of zero trust architecture, as is ‘least privilege access’, which grants users and their devices only the minimum level of access necessary to perform their role; basically, they can only access the resources they actually need.

Regular security audits and penetration testing

As we’ve shown, cyber security threats are ever-changing, so a schedule of regular security audits should be performed, as should ‘penetration testing’, which involves seeing how robustly security measures can stand up to someone trying to get into the organisation’s data.

Employee training and awareness

Your employees, who are likely handling this data every day, need to be aware of the risks and threats associated with cyber attacks. They should be able to follow all the necessary steps to protect data, be able to flag up when something doesn’t look right, and know the procedures if a cyber attack happens.

Leveraging cloud security solutions

Cloud security ensures that data is protected whilst stored, and whilst moving in and out of the cloud, from security threats such as unauthorised access, theft, and corruption. Any business should now have cloud security solutions as standard; particularly in a world where most of us are working from cloud-based applications.

Developing a robust incident response plan

The worst could happen, and you should be prepared with an incident response plan if it does. The plan should involve understanding the threats, assigning roles and responsibilities to members of your team, and deciding on communication while the incident is ongoing.

Emerging trends and technologies to watch

There’s no doubt about it: the world of cyber security is always, always changing. These are the kinds of elements we expect to see become part of the cyber security landscape over the coming years:

Quantum computing

This is a huge risk to encrypted data – the speed at which quantum computing can unscramble encryption is alarming to see the least. Its impact on cyber security means that ‘quantum safe encryption’ is being developed as a matter of urgency.

Blockchain

In terms of enhancing security, blockchain has stepped forward to help out, and we’ll likely see it become more widely used in years to come. Blockchain is a risk management system for a blockchain network (a database that houses a constantly growing list of ordered records, which are called blocks), and reduces the risk of cyber attacks through cybersecurity frameworks, assurance services, and general best practices.

Biometric authentication

Passwords and even MFA will no longer be enough; you’ll have to prove in an ultimate way that you are who you say you are – how better to do that than through your own unique identifier, your fingerprint? This is what we mean by biometric authentication, though as well as your fingerprint, you could also be identified by your voice, retinas, or your facial features – just like Face ID on your iPhone.

To conclude

Being ready for the attacks of tomorrow is as important as being ready for the attacks of today when it comes to cyber security; failure to put robust measures and plans in place puts yours customers at risk, alongside the integrity and reputation of your business.