Going Viral
It’s unusual for a marketing group as big as WPP not to have its finger on the pulse. But the fact it was hit by a particularly virulent cyber-attack last month indicates how hard it can be for even switched-on, tech-savvy businesses to keep on top of their cyber risk.
The attack was a fairly typical ransomware job affecting several of WPP’s agencies, including GroupM, MediaCom, JWT and Y&R. Following various system crashes and ransom demands, WPP sent an email to its staff confirming all Windows servers, PCs and laptops were affected and “must be turned off and disconnected immediately until further notice”. It turned out they’d been targeted by a new strain of the ‘Petya’ ransomware used in the WannaCry attack which hit the NHS some weeks previously.
WPP’s misfortune shows us that no matter the size of the business, it pays to be prepared for a potential cyber-attack. Smaller businesses could be forgiven for thinking there’s little reason for cyber criminals to target their comparatively small amounts of data, but hackers may assume that the relatively small amount of data is likely to be less secure. Basically, everyone’s fair game to cyber criminals, and businesses should make sure that they are prepared for the risks associated with such an attack.
While hacking attempts are difficult to predict and even harder to prevent, there is no reason why businesses need not be prepared to deal with the eventuality, which can save hundreds of thousands of pounds. Defending completely against fraud might not be feasible, but the ability to get over a hack or data breach definitely isn’t.
Unknown Quantity
Given that cyber-attacks are almost impossible to predict, savvy marketing agencies all over the country are putting their efforts into coping with the aftermath rather than dealing with the cause.
Cyber recovery, rather than cyber prevention, is the real story here. Once a business has totted up the cost of investigating the problem, restoring systems and data, telling customers and regulators, paying ICO fines, managing the PR fallout, and losing business from being out of action, it could have a bill far higher than the average £25,736 a cyber-attack costs an SME.
Prevention
This doesn’t mean that your business is unable to keep abreast of developments in business cyber-safety, and work to make sure that a responsible and well-informed attitude is embedded within the company culture. Carefully managed encryption practices are one way of making sure that your data is less appealing, as well as physical diligence to protect company hardware.
Keeping your team up-to-date through regular meetings with IT specialists and reviewing where improvements can be made is another important step that can help to fortify your defences against data thieves.
Cure
If you are unlucky enough to be hit by a cyber-attack, it’s vital to remain calm and take a methodical approach to the various steps that will be required to get your business back on its feet. The first stage is restoring the systems themselves, networks, websites and data that might have been rendered unusable by a hack. Finding external experts and specialists to approach the task, particularly in the case of ransomware, can be a huge stress-reliever.
Legal help will also be necessary to help break the news to your clients, and manage the expensive consequences or any data theft. Reputations are hard-won and easily lost – if you’re worried about being on the news for all the wrong reasons, a PR agency to manage the fallout and protect your good name is a must.
Fortunately, there are a number of insurers out there who specialise in cyber insurance, and will cover all of the above processes and services. Most importantly, a cyber insurance policy will cover the absolute business essential – revenue. Being offline, even for a short time, can cost a small fortune, but thankfully your policy picks up the tab and limits the damage. Above all, your policy takes care of the stress and time needed to deal with such an awkward spanner in the works.
While the fallout from a cyber-attack can be demotivating, destructive and expensive, being properly aware of the potential risks, preventative measures and reparatory processes, businesses can continue running, safe in the knowledge that they will be able to emerge from the other side embattled, but wiser.