Business Partner Magazine

Tips and advice for entrepreneurs, start-ups and SMEs

Guard Your Secrets Offline and Online

by Leave a Comment

When it comes to keeping our personal information private, the recent Facebook scandal has shown us that there really is only one course open to us – don’t share any information online.

In case you have been living under a rock and rarely go online, 2018 was the year when we finally understood how Donald Trump became so popular in the presidential election.

Cambridge Analytica, a marketing company, used an app to harvest information about people’s fears and dreams on Facebook. If you downloaded the app, perhaps received compensation for using it. This was in the terms and conditions.

The scary part? The app was downloaded by something like 270,000 people, but the app allowed the company to download data from any Facebook pages related to the user. So, even if you did not download the app, if someone you know did, your data was also collected.

They used this to find information that helped them build campaigns for political candidates. Trump was one of these candidates.

It is a big deal and an example of how damaging it can be to give out personal details online. So, while you might be able to get some reward for disclosing personal information about yourself, it pays to be sure of the company collecting the information first.

Word of caution, many sites and online applications collect data and that’s not illegal. A lot of this data harvesting is happening in your browser, using the right plugins and settings there helps a lot. More malicious data collecting activity might happen through malware though, so always use a strong firewall, decent antivirus and a dedicated malware cleaner.

Better be safe than sorry.

The whole personal data abuse highlights another valid point. It is not only your own personal data that must be considered. You also have to consider the data of everyone that you are linked to online. Just look at it this way – 270,000 people downloaded the app.

It’s not a huge number of users by any standard until you realize that it allowed access to data for 50 million other users.

Now, while you might not be sharing any important information on Facebook or other social media, what about your family and friends?

Would they have legal recourse against you if it was found that you downloaded an app without proper forethought? It sounds far fetched, but think of the society that we live in. It is not out of the realm of possibility.

This makes it essential to take cybercrime seriously. Want to learn how to start protecting yourself? Read through our infographic.

Infographic by BestVPNs

11 Cyber Security Risks Every Business Should Prepare For

by Leave a Comment

Advancement in technology also entails an increase of its security. On a daily basis, hacking happens in different parts of the world.

According to a study by TechCrunch published in ZeroFOX, around 600,000 logins are hacked, and that’s on Facebook alone. These are for personal and individual accounts, so just think about its effect on businesses.

Unfortunately, small businesses are the most vulnerable if they don’t invest in good IT support companies. Since they’re not prioritized accounts, they are vulnerable to attacks.

By 2021, cyberhacking is expected to hit $6 trillion on a yearly basis—which is huge and obviously, not good. In line with that, there’s a significant increase in data breaches since 2013.

If you’re a business owner who wants to avoid this business dilemma, then you should act now. At the very least, establish a cyber incident responses plan. This will lay down the step by step process you should take if ever a cyber incident happens. A cyberattack can spread like wildfire from one compromised device to another until it takes over your system.

After solidifying this for your business, make sure to inform your employees about it. One major reason for cybersecurity risks is the subpar knowledge of employees on how to protect the system such as removable devices and online links.

Infographic by Transcosmos Information Systems Limited

What is an ISO Audit?

by Leave a Comment

Of what use is an ISO Audit to companies? This is probably one of the most confounding questions that you will encounter once you embark on your compliance journey. Needless to say, the ISO/IEC 27001 standard often looks like a far-fetched dream for many organizations.

The size of the task and all the risks involved often make ISO audits to appear overwhelming. For you to successfully navigate your way through the processes involved, you need to have an in-depth understanding of what ISO audits are, and the basic requirements of getting this certification.

ISO Expounded

ISO is the abbreviation for the “International Organization for Standardization.” It is the brainchild of a 1946 conference that brought together delegates from 25 countries. The conference was held at the London Institute of Civil Engineers, and sought to establish a set of globally recognized industrial standards.

ISO currently comprises 162 member countries. It similarly has 778 committees and sub-committees. The body’s quality assurance standards apply to various industries ranging from data storage to manufacturing. It provides organizations with strategic tools to ensure that businesses remain productive and competitive.

Application of ISO Standards to Information Security

ISO/IEC 27001:2013 is a global standard that governs Information Security Management Systems (ISMS). Contrary to traditional standards like the PCI DSS, ISO/IEC 27001 largely bases its main controls on risks instead of prescriptive measures.

The risk-based approach allows a wider variety of organizations and industries to apply for ISO certification. Non-profit, commercial, and government agencies that wish to get ISO-certified can easily apply for this standard. The flexible nature of ISO 27001 means that players in the banking, retail, defense, education, and healthcare markets also qualify for it.

Due to its flexibility, ISO 27001 has become one of the most recognized information security standards. It similarly lists a series of Annex A controls, which act as a guide. These controls allow you to formulate your own unique information security strategy. The extended control sets also offer information security managers the option of avoiding, accepting or transferring risks rather than mitigating them through controls.

ISMS and Data Protection

Your company’s Information Security Management System is the procedures and policies that you put in place to ensure that sensitive data is protected. These procedures should go beyond protecting data to also govern employees’ behavior. For instance, employees’ password protection and security awareness also need to form part of your company’s data protection culture.

Whereas ISO/IEC 27001 is specific about the creation of an ISMS, it only recommends appropriate actions to take. Some of these suggestions may include how to undertake internal audits, preventive and corrective measures, and continual monitoring.

The ISO Auditing Process

To get ISO-certified, there are certain compliance and audit standards that you must meet. Certification can only be granted after an independent body has assessed your company’s ISMS to establish whether or not you have complied with all the requirements. The main steps involved during certification are gap analysis, formal appraisal, implementation, and auditing.

Gap analysis involves the evaluation of controls selected for different standards to ensure that your company has met all the necessary ISO/IEC 27001 requirements. For instance, you may want to follow the NIST framework and still strive to be PCI DSS-compliant. In as much as the requirements for both may overlap, they are also similar in some way. A gap analysis is often done to eliminate any discrepancies.

A formal assessment is often done to ensure that all risks are accepted, mitigated, or controlled. It incorporates risks that were previously mitigated. The implementation process entails the creation of policies and procedures that ensure your new controls are working effectively. On the other hand, the implementation stage involves the control and mitigation of new risks that you do not want to accept or control.

How Long Does ISO Certification Take?

The duration that it will take for your company to get ISO certified varies. Your current controls and compliance standpoint are the main determinants of the time you will take to become certified. Nonetheless, this process can take between five months to two years. This timeframe is also determined by how urgent you need the certification.

The ISO Audit Checklist

To monitor your current compliance position, you need an ISO audit checklist. This is basically a questionnaire, which guides auditors towards pertinent areas that require evaluation. If you are beginning the certification process, this checklist is an important tool that can guide you till the end.

The audit checklist usually incorporates in-depth policy reviews, asset inventories, and the formulation and implementation of policies. This list similarly guides auditors in their review of the management’s responsibilities. Furthermore, it ensures that electronic and physical access meets ISO standards.

Internal ISO Audits

The ISO certification requires your company to undertake internal audits as part of the far-reaching monitoring process. Internal audits are proof that you are adhering to ethical practices. Although the internal auditor needs to be independent of the process, you can still use a corporate employee who has a good understanding of your organization.

Internal audits ought to be conducted throughout the year. This enables you to identify any weaknesses for review before an external audit is conducted. An audit helps to establish whether or not your company has aggregated necessary ISO processes, documentation, and records. The auditor will compare these records with your organization’s daily routines to ensure that you not only meet compliance standards on paper but also in practice.

ISO Surveillance Audits

A review may be undertaken in between certifications. This is typically done on a yearly basis, but can also be conducted twice a year. The aim of surveillance audits is to ensure that your organization is properly monitoring its ISMS.

Concerns raised during such audits are often raised with the management, which must address them accordingly. To ensure that your company quickly gets ISO-certified; it is advisable to partner with certification experts. Automation also guarantees a quick and effective certification.

About the Author

Ken Lynch is an enterprise software startup veteran, who has always been fascinated about what drives workers to work and how to make work more engaging.

Ken founded Reciprocity to pursue just that. He has propelled Reciprocity’s success with this mission-based goal of engaging employees with the governance, risk, and compliance goals of their company in order to create more socially minded corporate citizens. Ken earned his BS in Computer Science and Electrical Engineering from MIT.

 

 

Developing Threats in Mobile Phishing

by Leave a Comment

As much as mobile technology has evolved over the years, so has the mobile malware. In the past recent years, we have seen an increasing volume of attack direct at mobile devices – such mobile phishing. Even though phishing is nearly a household term these days, its execution and how it affects mobile device users, in general, has not been explored that much. And if complexity were not bad enough, the differing mobile phishing techniques used by fraudsters are far more terrifying to learn.

How mobile phishing works is similar to how it is being used to attack PCs or laptops. But aside from malicious email or fake website, there are other phishing techniques that attackers can use to lure their victim to provide their personal information unintentionally.

From SMS phishing, malicious apps, to modified content and URL Padding, check out the developing threats in mobile phishing by checking out the infographic below from TeleMessage.

Infographic by Telemessage

Are Law Firms Ready for Disruption?

by Leave a Comment

A significant cyberattack in 2017 brought company-wide disruption for a leading law-firm and raised the question of; whether law firms are prepared for a business outage and how would they service clients’ requirements?

The Instant Group and Sandpiper Partners, a consulting firm in the legal sector, conducted a survey to delve into the risk of business continuity for law firms in light of disruptive events, such as 2017’s cyberattack.

The majority of firms seemed confident that the necessary business processes were in place, but their responses also hinted at the lack of consistency in approach to BCP and many procedures remain untested.

Our research discovered that a large proportion of those asked were dependent on remote working and cloud IT processes in the instance of an outage. This leaves firms open to risk and hinder the ability of a firm to bring its key client leads together to plan next steps and service client requirements.

The biggest threats

Instant’s research found that 71% see a data breach or cyberattack as the biggest threat with technology disruption replacement being the greatest priority (78%).The effects from any outages are said to be; revenue loss, inaccessible or lost data and reputational impact. With this in mind, we found that 98% of firms claim to have a BCP in place with the top concern being IT functionality.

The issues you can’t control…

Whilst there has been significant focus on cyberattacks, there is also an overriding threat of natural disasters in many locations across the globe.

In the last 12 months we have seen Hurricane Harvey leave nearly 250,000 people without power outages, inclusive of commercial property, leaving many unable to work at all.

In particular many firms’ plans are dependent on remote working and IT processes that have, in several recent cases, been put at risk during natural disasters or acts of terrorism.

The full report

A significant cyberattack in 2017 brought company-wide disruption for a leading law-firm and raised the question of; whether law firms are prepared for a business outage and how would they service clients’ requirements?

The Instant Group and Sandpiper Partners, a consulting firm in the legal sector, conducted a survey to delve into the risk of business continuity for law firms in light of disruptive events, such as 2017’s cyberattack.

The majority of firms seemed confident that the necessary business processes were in place, but their responses also hinted at the lack of consistency in approach to BCP and many procedures remain untested.

Our research discovered that a large proportion of those asked were dependent on remote working and cloud IT processes in the instance of an outage. This leaves firms open to risk and hinder the ability of a firm to bring its key client leads together to plan next steps and service client requirements.

The biggest threats

Instant’s research found that 71% see a data breach or cyberattack as the biggest threat with technology disruption replacement being the greatest priority (78%).The effects from any outages are said to be; revenue loss, inaccessible or lost data and reputational impact. With this in mind, we found that 98% of firms claim to have a BCP in place with the top concern being IT functionality.

The issues you can’t control…

Whilst there has been significant focus on cyberattacks, there is also an overriding threat of natural disasters in many locations across the globe.

In the last 12 months we have seen Hurricane Harvey leave nearly 250,000 people without power outages, inclusive of commercial property, leaving many unable to work at all.

In particular many firms’ plans are dependent on remote working and IT processes that have, in several recent cases, been put at risk during natural disasters or acts of terrorism.

The full report

The report delves deeper into the implications of cyber security, the challenges of working during a natural disaster and how long you should be without your office for as well as what law firms have learnt from regular testing.

There are several key areas for consideration across workspace, IT and HR that all need to be addressed within the context of business continuity planning. Understanding how to co-ordinate the approach across these business areas is fundamental to a firm’s ability to minimize the disruption caused by a business outage of any size. An underlying learning is the need to be adaptive and flexible in response.

Our unique research assesses these different areas of co-ordination and also includes information from experts on issues such as cyber-attacks and other future threats to business continuity.

The full report can be downloaded via this link

About the Author

The Instant Group is the global flexible workspace specialist. Underpinned by unrivalled expertise, Instant tailors unique solutions to help businesses of all sizes to grow, drive savings or gain invaluable insight. Established in 1999, The Instant Group has achieved 23% compound growth over the past four years and continues to expand with private equity funding secured from MML Capital in 2012. With offices in London, Berlin, Dallas, New York, Hong Kong and Sydney, The Instant Group employs more than 100 experts and has clients in 113 countries. For more information, visit www.theinstantgroup.com.