Keeping your data, money & reputation safe Cyber Resilience: Keeping your data, money & reputation safe

Information governance, assurance and cyber resilience Give people clearer, more consistent choice around how their information is shared Streamline governance Publish clear guidelines Improve security of how health & care organisations handle information (cyber resilience)

Third sector cyber resilience Common approach (pathway) to cyber resilience Strengthening awareness Partnership working, knowledge sharing & leadership Supply chain cyber security Strengthening incentives Benchmarking, monitoring & evaluation

Being cyber resilient is: Taking steps to reduce the risk of cyber breaches Making sure that if a breach occurs you know how to respond to ensure: Adequate legal response Responsible public response Business continuity

A cyber breach is: An incident in which data is lost or stolen. Such as: Financial data (££s from your bank) Security data (usernames/passwords) Personal data (emails, address, phone numbers, medical data…) In some cases, security data or personal data could be more ‘costly’ than financial data Requirements to report cyber breaches in relation to the loss or theft of data are included in GDPR

Myth vs. Reality

What are the main causes of cyber breaches? Myth: Hackers, Ransomware, Viruses Reality: “48% of business who have experienced a breach said the root cause was a “negligent employee or contractor”. A cyber breach is not always a cyber-attack.

Who are the targets? Myth: Hackers focus on big business and high-profile companies with lots of money or data Reality: Everyone… Whoever takes the bait Vulnerable: individuals and businesses

What are the types of threats? Accidental loss of data Insider treats Disgruntled employee? Opportunity? Making a statement – whistleblowing? Moving to a competitor? Incentivised? Social Engineering Phishing Spear-phishing Whaling Viruses Malware Spyware Ransomware DDoS BYOD Policies Security software

Vulnerable Organisations Who are the targets? Vulnerable Organisations Vulnerable People

Taking it seriously Assume that you will have an attack or a breach You may already have… People are testing “doors” looking for ones which are weak, vulnerable, or left unlocked Have you checked if your doors are locked?

Don’t be an easy target… The most common breaches are simple and avoidable They are aimed at those who have not taken any steps to prepare. Do your staff have basic knowledge? Be aware that CEOs are often the biggest target and the weakest link (And the most difficult to educate?)

Consider what someone could do if they get hold of some of your data… Scenario – what if…? Consider what someone could do if they get hold of some of your data…

What if… Some of your user data gets into the wrong hands… An email is sent to wrong address A USB pen dropped in the street A disgruntled team member exports your data base Or a hacker uses a well know weakness in unpatched software

Scenario – what if? They could then buy a domain similar to yours. For as little as £0.01

Scenario – what if? They could then easily clone your website and put in on their newly purchased domain They could email the list of contacts they got from the data breach, asking for a donation to your charity 100s of people give donations inc. bank details and home addresses.

What should we do now?

Lock your doors! Four areas to consider and act on: IT Security: investigate your IT security Protecting your technology from threats (e.g. Cyber Essentials) Data management: conduct a data audit Ensuring your Data is managed properly (e.g. GDPR) Staff education: Increase staff knowledge and awareness to protecting from Scams (e.g. online/offline training) Response: incident response plan Ensuring business continuity and adequate response - Legal response - Public response - Individual response

Discuss

Discuss Where do you think your strengths are in being cyber resilient? What do you think your weaknesses are in being cyber resilient? What help / actions are needed to take to improve your cyber resilience (and third sector health & social care providers in general)?