'It could happen to you!' This is the message to take from the recent NHS computer crash following the "wannacry" virus attack. It is important to realise that the NHS was not specifically targeted. This virus was sent out in millions of phishing emails worldwide, taking advantage of a known gap in Microsoft coding, which many companies and individuals had not addressed by means of a simple software update.
While there is no guaranteed way of avoiding the risk of an information security breach or systems crash as a result of a malicious computer virus, there are a number of things you can do to reduce the risks -of this, and other, cyber attacks.
Advice on the current 'Wannacry virus' threat
The advice for firms seeking to combat the immediate threat posed by the Wannacry virus is:
- Patch MS17-10 asap
- Ensure that your anti-virus software is up-to-date
- Make sure you have an 'out of band' backup
For more specific details on addressing the current Wannacry virus threat, download our attached guidance note from Lockton's specialist Cyber Team, or contact us for more in-depth advice.
General Steps to reducing the threat of a successful cyber attack
Robust and up-to-date anti-virus software remains far and away one of the two most important protections in your armoury.
The other is an independent or off-network back-up, that is tested as part of a tested business recovery plan. This should enable your business to get back up and running, without having to pay any ransom (in case of a ransomware attack).
This is not simply an IT issue - and there are some additional simple steps you can take to help protect yourself.
1. Make sure you are using up-to-date supported software
While the recent 'Wannacry' virus potentially impacted all Microsoft Windows platforms, Microsoft, as with all software suppliers, recommends the most recent versions as providing greater security. We are aware that a number of solicitors firms still use Windows XP, and it is important to be aware that this is no longer supported, and does not get updated as standard to take account of new security threats. Using unsupported software exposes your business to a significantly greater risk of a successful cyber attack.
Nor should you forget your internet browser. Viruses can equally be transmitted through infected or scam websites. Up -to-date browsers help reduce the risks. Many firms are still using Internet Explorer 8, which is no longer secure.
Ensure you are using a current (ideally the latest) version of your browser. Visit www.whatsmybrowser.org to check. This will instantly show you what browser you are currently using.
2. Apply software updates at the earliest opportunity
The NHS systems crash is not simply an alert about one particular update. The wider risk management lesson is to ensure that you always ensure that your software is up-to-date.
Activate automatic updates in the software, or, alternatively, when an update is flagged, install it straight away. Microsoft, on becoming aware of the vulnerability rapidly issued a 'software patch' (MS 17-10) which provided essential protection against this particular type of attack. If you have installed all relevant updates, you are unlikely to be affected by this particular virus.
3. Make ALL staff aware of the risk of 'phishing' emails immediately
The aptly-named 'wannacry' virus that sent the NHS into meltdown is spread by fake emails. Typically the emails have appeared as job offers, invoices and security alerts.
If any single person in your firm clicks on one of these messages, the whole firm is at risk of being affected.
While it is not possible to identify all phishing emails, each member of staff is still a vital line in your defence. Please ensure that all staff are particularly aware of the risk of fake job offers, invoices, security alerts and the like.
Circulate our guidance on identifying phishing emails.
The key message is, if in doubt - do not open. To reduce risk, set emails into preview mode in your settings.
For further advice and guidance
Download our guidance note advising on specific measures to combat the threat of the Wannacry virus, or speak to our Cyber Team for more in-depth advice.
Look out for further guidance on phishing awareness from Lockton coming out this summer.
This article is for general advice only. Acting on this advice will not protect you or your firm from all computer malware, and Lockton can accept no liability for any losses of any kind arising from a breach of your computer system security.