5 IT & Cyber Security myths we’d quite like to retire

There are some things the iTek team hears surprisingly often. Usually they start with “I thought…” and occasionally end with one of our engineers having to deliver some slightly disappointing news.

Technology is full of assumptions that sound perfectly reasonable, so we thought we’d tackle five cyber security myths that regularly crop up when we’re talking to businesses across Cumbria and the North West.

Microsoft does a very good job of keeping Microsoft 365 available and protecting the infrastructure behind services such as Exchange, SharePoint and OneDrive. There are also built-in recovery and retention features, and Microsoft now offers its own additional Microsoft 365 Backup service.

What Microsoft 365 doesn’t automatically give every business, however, is an Office 365 backup and recovery plan designed around what that business actually needs.

If files are deleted, accounts are compromised, ransomware gets into a tenant or somebody makes a change they really wish they hadn’t, the important question is how far back you need to recover, what needs restoring and how quickly you need it back.

Being in the cloud doesn’t make backup somebody else’s problem. It just means the server isn’t sitting in your office anymore.

That’s why we look at separate Microsoft 365 backup and disaster recovery with our clients, rather than assuming that because something is in the cloud it will always be there when we need it.

Antivirus is important, but installing it isn’t the cyber security equivalent of putting a force field around the office.

Modern attacks can involve stolen passwords, phishing, compromised accounts and suspicious behaviour that traditional antivirus might not spot. This is where Endpoint Detection and Response (EDR), adds another layer by monitoring what’s happening across devices and helping identify and respond to unusual activity.

Then there’s patch management. Security software can be doing its job perfectly well while an old piece of software elsewhere on the machine is quietly leaving the window open.

For iTek clients, those things can form part of ongoing managed IT rather than relying on somebody remembering to update everything when they have a spare Friday afternoon.

Think of antivirus as locking the front door. We’d still recommend closing the windows.

Getting Cyber Essentials certification is a really positive step, and we’re big supporters of it at iTek. It checks five technical areas designed to protect organisations against common cyber threats.

It isn’t, however, something to achieve once, frame and admire for 12-months.

Businesses change and people join and leave, laptops are replaced, software changes, new services appear and threats move on. The Cyber Essentials requirements themselves are regularly updated too, which is why keeping those controls in place matters just as much as getting through the assessment.

We help clients achieve certification and also maintain the controls behind Cyber Essentials, rather than simply helping them get the certificate. That can include patching, access controls, MFA, firewalls, device management and regular reviews.

For businesses wanting to go further, Cyber Essentials Plus and penetration testing can provide another level of assurance by testing controls and looking for weaknesses before somebody less friendly finds them.

The certificate is a milestone, not the finish line.

Offering guest Wi-Fi doesn’t automatically create a data protection problem, but what you do with the information collected through it certainly can create obligations.

If your guest Wi-Fi asks people for names or email addresses, tracks identifiable usage or gives them the option to receive marketing, you need to understand what you’re collecting, why you’re collecting it and the lawful basis for using it. Where consent is required, it needs to be a genuine choice rather than “accept our marketing or enjoy staring at the 4G symbol”.

There’s also the network itself to consider. Guest Wi-Fi security should be properly separated from the systems running your business, with appropriate controls over what visitors can access.

Free Wi-Fi should mean free internet access. Not a free tour of the company network.

iTek can design and manage business Wi-Fi with properly separated guest and business networks, along with filtering and security controls appropriate to the site.

This one has been around for years, but unfortunately cyber criminals haven’t agreed to leave Cumbrian SMEs alone. Good SME cyber security doesn’t depend on how big a target you think you are.

Many attacks aren’t somebody sitting in a dark room choosing your business specifically. They’re automated and opportunistic, looking for weak passwords, unpatched systems, exposed services or somebody willing to click the wrong link.

In fact, “Nobody would be interested in us” can become part of the problem if it means security gets pushed down the list.

You don’t need to become Fort Knox, and we’re not interested in frightening businesses into buying technology they don’t need. Good cyber security for small businesses is usually much less dramatic than that: sensible controls, good backups, up-to-date systems, appropriate access and a team who understands what they’re responsible for.

Most IT myths start with a perfectly reasonable assumption. The problem is that technology moves on while the assumption hangs around.

At iTek, part of our job is checking that what you think is protecting the business is actually doing what you think it is. That might mean tightening up patch management, adding EDR, reviewing Microsoft 365 backup solutions, working towards Cyber Essentials or putting your security to the test with a penetration test.

A quick cyber security assessment usually tells us which of those matters most for your business. Sometimes the answer to all that is ‘yes’, you’re already in pretty good shape. If not, we’ll work out where the gaps are and what’s worth doing about them.

Sadly, there’s no Cumbrian force field. Plenty of fields, admittedly, but none that’ll stop a cyber attack.

Interested to know how we can help?  Speak to a human.