What happens if you don’t have cyber security?

Usually, nothing dramatic happens straight away.

Emails continue to arrive. Files still open. Invoices are sent and staff get on with their work. That is one reason weak cyber security can remain unnoticed for years.

Then an account sends an email that nobody wrote. A login alert appears at 2am. A file cannot be found. A customer asks for evidence of the controls protecting its data.

The first problem is often uncertainty.

Was the login genuine? Has anybody accessed the account? Which other systems use the same password? Is the missing file backed up? When was the last successful restore test? Who is responsible for finding out?

Any answer that begins with “I think” is a sensible place to start checking.

Most businesses have some cyber security

Very few businesses have no protection at all.

Windows includes security features. Microsoft 365 and Google Workspace have protective controls. Routers usually include a firewall. An IT provider may have installed antivirus or configured automatic updates.

The problem is more often that security is incomplete, unmanaged or untested.

• MFA protects most users, but an old administrator account has been missed.
• A backup runs each night, but nobody has checked whether the right information can be restored.
• Staff use individual Microsoft 365 accounts, but share a password for another important system.
• Security software is installed, but nobody receives or investigates its alerts.
• A former employee’s access has not been fully removed.

That is the difference between owning security products and knowing whether they are doing the job expected of them.

Work can stop while you work out what happened

A compromised email account is not merely an IT inconvenience.

Someone may need to review sent messages and mailbox rules, remove active sessions, reset passwords and check whether customers or suppliers received fraudulent instructions.

Staff may lose access while that work takes place. Payments may need checking. Customers may need an explanation before the full facts are known.

Even a contained incident can take over the working day when nobody knows who should respond or where the necessary information is kept.

Cyber incidents are rarely polite enough to wait for a quiet week.

Recovery becomes slower and less certain

A backup is not useful merely because a dashboard says that last night’s job completed.

The important questions are whether the business-critical information is included, whether the backup is protected from the same incident and whether somebody has tested a restore.

The National Cyber Security Centre recommends backing up the data an organisation needs to operate. Its incident guidance also advises businesses to know how to restore that information before an emergency.

Without that preparation, recovery becomes an experiment carried out while the business is already under pressure.

Fraud can be harder to spot and contain

Not every cyber incident locks files or brings down a server.

Sometimes a criminal gains access to an email account, watches conversations and waits for the right moment to send altered bank details or a convincing payment request.

MFA can make account takeover harder, but it is not the whole answer. Important accounts still need to be configured properly, suspicious activity needs somewhere to be reported and unusual payment instructions should be checked through a separate route.

Staff should not be expected to remember every possible trick. They need useful training, clear procedures and permission to pause when something does not look right.

Client and contract questions become harder to answer

A cyber incident is not the only time a business may be asked about security.

The question might appear in an insurance application, a customer questionnaire, a tender or a supplier review.

Cyber Essentials is required for some government contracts, and organisations also use the scheme when assessing security in their supply chains. That does not mean every business needs certification for every piece of work.

It does mean that customers may expect more than “our IT company deals with that”.

A business that knows which controls are in place, who manages them and what evidence exists can answer without guessing.

Poor security can also create data protection problems

Businesses that handle personal information are expected to protect it using appropriate technical and organisational measures.

What is appropriate depends on the organisation, the information it holds and the risks involved. A five-person business is not expected to operate like a bank, but doing nothing is not a proportionate plan either.

The Information Commissioner’s Office provides guidance on the security outcomes organisations should consider, including access controls, backups and protection against cyber attack.

Good cyber security is not a guarantee

No credible provider can promise that an organisation will never suffer an incident.

Good cyber security reduces avoidable risk. It can help suspicious behaviour get noticed earlier, limit what an attacker can reach and give the business a clearer route to recovery.

For most small businesses, the foundations are not especially exotic:

• Individual accounts: give each person their own sign-in, even where several people use the same shared mailbox.
• MFA: protect important cloud services, remote access and administrator accounts.
• Updates: keep devices, operating systems and applications supported and patched.
• Device and email protection: use appropriate security tools and make sure somebody reviews important alerts.
• Tested backups: protect the data the business needs and check that it can be restored.
• Supported staff: provide useful training and a clear way to report suspicious emails, login prompts and payment requests.
• A short response plan: write down who should be contacted and who can make decisions during an incident.

You do not need every available product. You need controls that match the business, are managed properly and can be checked.

Start with what you can prove

Before buying anything, ask five questions:

• Who can access our systems and data?
• Which important accounts are protected by MFA?
• Who would notice and investigate suspicious activity?
• What information is backed up?
• Could we restore it today?

The uncertain answers tell you where to begin.

Cyber security is not about expecting disaster. It is about removing avoidable uncertainty before an ordinary problem becomes an expensive interruption.

Useful places to start

• Protect devices and keep software updated
  
• Strengthen Microsoft 365 email protection
  
• Monitor and protect Microsoft 365 accounts
  
• Review Microsoft 365 backup options
  
• Prepare for Cyber Essentials
  

Not sure where your gaps are?

Black Swan Cyber Security Solutions helps small businesses understand what is already in place, what is missing and what deserves attention first.

Book a free 30-minute consultation

We support businesses, schools and other organisations across Chesterfield, Sheffield, Derbyshire, South Yorkshire and further afield.