Don’ t Leave the Doors Open- Cyber Security Advice from the Met Police
“ A new update is available, would you like to install now?”
If we’ re honest with ourselves, a lot of us will click“ defer” – installing an update and restarting our computer is a disruption to what we’ re working on and it simply doesn’ t feel that important in the moment.
That prompt to update might save your business.
What is the risk?
A modern business relies on technology – we use it constantly without needing to know the intricacies of what is happening under the bonnet and take it for granted that it works. The problem is that software doesn’ t always do exactly what it’ s supposed to – small weaknesses or flaws in a computer program( often called‘ vulnerabilities’) can potentially be exploited by an attacker. These exploits can have disastrous consequences, like allowing an attacker to access all the data on your computer or remotely control your device!
These exploits are not easy to find, they require a great deal of expertise and understanding to produce, but once someone has done the hard work they are often very easy to replicate.
Fixing the problem
Whilst a vulnerability exploit is an incredibly dangerous thing, they are often discovered by software developers themselves or by security researchers who responsibly disclose what they’ ve found. This allows the developers to release an update for the software to fix the issue before criminals can exploit it.
Time can be of the essence though. If you discover that the front door to your business could be unlocked just by applying pressure in an unexpected spot you would get a locksmith out right away. An unpatched vulnerability is just the digital version of this security risk.
More than just computers
When people hear the phrase“ software updates”, they often think only about desktop computers and laptops but anything connected to the internet needs to be kept up to date. This includes your smartphone, Wi-Fi
access points and Internet-Of-Things devices like security cameras. Even your smart fridge or fish tank could be targeted!
Every connected device represents a potential entry point into your organisation. If one remains unpatched, it could provide an attacker with a route into your wider network.
Hidden dangers
Updates for a particular piece of software will not come forever. When software reaches the end of its supported life, manufacturers stop providing security updates. This means newly discovered vulnerabilities will stay unpatched indefinitely, creating permanent weaknesses for as long as that software is in use. Your old software may still function but without security updates it is a growing liability.
Are you a target?
Unfortunately, being“ too small to bother with” is a myth. Many cyber criminals use automated tools to scan the internet for vulnerable systems. The size of the organisation doesn’ t matter, they are just looking for an easy target – if a device is connected to the internet and is missing a security update then it can quickly become a target.
How to stay ahead
On a personal level, you should make sure that your devices and software are always up to date and you’ re not endlessly chaining together deferrals.
Within your business you should consider:
• An update policy mandating a maximum time frame for critical updates to be installed
• Educating staff about the importance of patches in protecting the company
• Encouraging a security culture where updates are not endlessly postponed
• Configuring devices to automatically install updates
Updating is one of the most cost effective things you can do to protect your business. In previous articles we discussed the importance of being vigilant for social engineering attacks and strong password hygiene but your staff can’ t protect the business from an attacker walking in through an open door. That prompt to update might save your business.
For more information on MPS Cyber Protect training go to www. met. police. uk / cyberprotect or email cyberprotect @ met. police. uk