Is your business ready for the next cyber attack?

Spending on cyber security has never been higher but it would surprise many to know that the extra investment has made no difference to the number of firms that get hacked.

Spending by firms in the UK on cyber security is forecast to rise again this year, up 30% to £10 billion according to Gartner, yet it estimates that the number of firms that were breached or attacked last year was the same as the year before.

According to Roy Shelton, Group CEO of Connectus, the money is going in the front door while attackers come in via suppliers.

Mr Shelton said that almost half of all breaches now involve a third party and most firms are defending a perimeter that no longer exists.

Most UK businesses are not ready to combat cyber criminals, and the gap is widest in the two places attackers now favour: the inbox and the supply chain.

Government data shows 43% of UK businesses suffered a breach or attack in the past year, the same as the year before, yet staff training and supplier checks remain low.

Mr Shelton warned: “The threat has changed shape in three ways. Phishing is now written and scaled by AI and moving beyond email to voice and text. Suppliers have become the main door in, with a third party involved in almost half of breaches.

“Unpatched software has overtaken stolen passwords as the top way in. Spending is rising fast, but spending is not the same as readiness. The organisations that recover best are those that have covered the basics, know their suppliers and have rehearsed their response.”

He pointed to figures from Verizon which found that almost half of all breaches (48%) now involve a third party or supplier, up from 15% two years ago.

“It’s very surprising to hear but, as the global security situation worsens, only 25% of businesses have a formal incident response plan, and just 31% overall have a board member responsible for cyber security,” Mr Shelton said.

“Low levels of supply chain scrutiny are a significant gap at a time when under the requirements of the new Cyber Security and Resilience (Network and Information Systems) Bill, currently passing through Parliament, can see critical suppliers designated, and requires providers to keep affected customers informed during significant incidents.”

The Connectus CEO outlined five things that organisations can do to stay protected, and none of them require a large budget:

Close the email and ID door. Turn on multi-factor authentication for every account, starting with email, finance and remote access. Publish SPF, DKIM and DMARC records so your domain cannot be spoofed. Require a second check, by phone on a known number, for any change to payment details.

Train for the attack people will actually see. Run short, regular phishing exercises that include voice calls and text messages, not just email. Make reporting a suspicious message a one-click action.

Know your suppliers and restrict access. List every supplier with access to systems or data. Ask each for Cyber Essentials certification or equivalent, enforce multi-factor authentication on their accounts, and give them only the access they need. Put breach-notification duties in contracts.

Patch what faces the internet first. Keep an inventory of internet-facing systems and fix actively exploited flaws in days. Retire anything the vendor no longer supports.

Plan and rehearse the bad day. Write an incident response plan, name who decides, and run a tabletop exercise at least once a year. Keep offline backups and test restoring from them. Give one board member responsibility for cyber risk.

For more information see connectus.org.uk