The last few weeks have seen a number of significant cyber attacks on a wide range of companies across the world – attacks big enough to be mainstream news, rather than being hidden away in arcane specialist publications. They include the php2shell crisis, the theft of several billion dollars in cryptocurrency from Binance, and the ongoing European Freezer attacks (which are less amusing than they sound).
So, it’s a reasonable question to ask how companies that handle your data are protecting it. In particular, what protections they have in place against attacks like these – or the thousands of attacks that don’t make front-page news, but are nevertheless constantly being mounted.
But that’s where you’ll probably hit a brick wall: if you go to almost any online service or digital provider and ask what security measures they use, they probably won’t tell you.
Why can’t we find out how our data is protected?
Oh, there may be pages and pages of information, but it will use vague phrases such as “industry standard protections” or “high-level encryption”, which are intended to reassure rather than (strictly speaking) answer the question.
There are two reasons for this.
Firstly, most customers aren’t cyber security professionals, or even coders or developers. If a company were to list the exact encryption algorithms used, for example, it wouldn’t actually mean anything to most people.
But secondly, and more importantly, if you post this information publicly, there are people out there who will try to use it to break in. As soon as you tell them exactly how you secure data, they know exactly where to look for weaknesses.
Veterinary practices (and their suppliers) aren’t usually specifically targeted by a group of hackers who say “Yes, let’s spend several days attacking ABC vets, that’s really profitable”. Instead, they will use bots and other technologies to screen thousands, tens of thousands, of websites and online services, looking for weaknesses – and then they hone in on them. If you have already told them where to look, you’ve just made their lives many times easier.
So, how do I know who I can trust?
That’s why there are a range of certification schemes out there. A trusted, third-party auditor examines the systems and protections that a company or service has, and certifies them as meeting a particular standard. Common ones you are likely to see include ISO27001, SOC2, and Cyber Essentials.
Cyber Essentials is the UK government certification scheme, run by the National Cyber Security Centre with IASME, and comes in two levels. Cyber Essentials (CE) is a document exercise – the company self-certifies that it enforces 5 basic technical controls. These include:
- Use of correctly-configured firewalls to protect the company systems from the open internet
- Secure configuration of devices, laptops, phones, and servers to minimise vulnerabilities
- Regular update and patching of devices and systems, to ensure that new security threats are fixed as soon as possible
- User access control, to make sure that only authorised people can access your data, and only to do what they need to
- Malware protection, to catch and isolate viruses, ransomware, worms and other cyber threats before they wreak havoc in the system.
The second level, Cyber Essentials Plus, involves an audit, to check that these controls are in fact in place and are working, including vulnerability testing.
What about Digital Practice?
Well, we use industry standard encryption and protection…
But more importantly, we are now Cyber Essentials Plus certified. This means we have introduced all of these controls, and passed an external audit – on top of the additional security work we do, such as external penetration testing and vulnerability management, and internal monitoring and auditing.
That means you can have confidence that we meet all of the above controls, and your data is protected from most hacking attacks.
Does this mean our data can’t be hacked?
I would love to say yes. But in reality, there are no guarantees. If any company or service says they can’t be hacked, but their system is connected to the internet – then they are either massively overconfident, or lying.
But it does mean it’s harder to hack your data, so it is much less likely for an attacker to be able to access it.
A good analogy for a veterinary audience is parvo vaccination. Yes, a vaccinated dog can get parvo – but they’re much, much less likely to; and if they do, it probably won’t be as severe.
It’s the same with Cyber Essentials – yes, we could get hacked. But it’s a lot harder, and if it happens, it is likely to be less severe.
If you’d like to know more, please get in touch and the team would be happy to help!