Could your business afford to deal with a data security crisis.

According to the Cyber Security Breaches Survey 2022, 39% of UK businesses identified a cyber-attack last year. Cases affecting high-profile businesses often hit the news but numerous small and medium sized companies suffer the same fate. Attacks and breaches such as these not only incur a financial burden – in terms of rectifying issues, loss of business, impact on sales and more – but they also come at a heavy cost to reputation and brand. And this can be hard to recover from.

As a company providing Software as a Service (SaaS) to clients, it’s of the utmost important that your web-based offering is secure. After all, SaaS projects involve a large amount of sensitive data and private information. Securing this data is a crucially important part of a business’s responsibility – however due to lack of knowledge and expertise, one which is often overlooked. Many host in the cloud and rely solely on the default protection provided by services such as AWS, Azure GCP etc. This is a dangerous assumption for many, as the protection afforded is not guaranteed and is focused on protecting the perimeter. Your systems will require more specific protections from potential targeted vulnerabilities.

So ask yourself, do you know how watertight your data security is? Could there be vulnerabilities in your website, api or system, which could leave you open to breaches? Have you got a process in place to evaluate your data security? What’s your business continuity plan in case of an attack? Knowing where to start can feel confusing – so here are some of the questions you should be asking yourself, to make sure your business has security that adheres (as a minimum) to recommended practices.

Do you have an information security policy?

Making sure your business has a documented information security management policy is a great place to start. It may be that you have a system in place, but it’s outdated and needs reviewing.

Is your information security organised?

When it comes to the organisation of your information security, ideally you will have a clear structure and clear roles and responsibilities. You management team need to be committed to your process and those involved should be accountable.

What’s your asset management process?

Tracking and managing your assets, like hardware, devices and information, is a key part of keeping data safe. That’s why it’s important to have a clear inventory, an ownership record, acceptable use terms and more in place.

Is your HR process robust?

Review your on boarding and off boarding process to check that you have sufficient security policies in place when employees start with and leave your business. This can include security awareness training when they join and a disciplinary process, if employees breach the rules.

How good is your communications and operational security?

Making sure you have policies to secure and protect systems and applications is vital. From documenting operating procedures to monitoring third party services, it can be more detailed than you think.

How do you monitor access control?

Checking that your security access policies and guidelines are robust is key to preventing data breaches. This can include tightening your user registration process, clear screen rules, session time out and password management, amongst other things.

Too often, information security is isolated and assumed to be the remit of the existing technology department or person. Securing your systems is just a fraction of the protection required. Most breaches are via social engineering or related to the end user.

Think about how you can improve your security posture. Consider systems such as Jumpcloud to manage user accounts; Perimeter 81 to secure your network (assuming a remote and geographically diverse workforce); and end point security vendors such as Crowdstrike and others.

Tech specialists, Scryla, have a wealth of expertise in information and data security, which can help companies safeguard the sensitive data they handle. They have an easy-to-use checklist, that can help you gain insight into your business’s security – download your copy free here. If this article has highlighted issues within your business that you have questions about, you can also contact them now.