Why cyber security is non-negotiable in today’s digital world
In an era defined by digital transformation, the threat of cybercrime looms larger than ever. For businesses of all sizes, understanding and mitigating these risks isn’t just good practice – it’s essential for survival and growth.
The Evolving Threat
The landscape of cyber threats is shifting at an alarming pace. Cybercriminals are becoming increasingly sophisticated, leveraging advanced technologies to their advantage.
Artificial intelligence is empowering malicious actors to generate highly convincing phishing emails, develop new malware variants at an unprecedented rate, and rapidly identify vulnerabilities in systems. AI can also facilitate the swift and cost-effective creation of spoof websites and automate the connection of exploit kits to discovered weaknesses.
The impact of a data breach extends far beyond operational disruption. Regulatory bodies, such as the Information Commissioner’s Office (ICO) in the UK under GDPR, can levy substantial fines. Beyond financial penalties, breaches can severely damage reputation, erode customer trust, and lead to significant business losses.
Demystifying the Solution
Many small and medium-sized enterprises (SMEs) perceive cybersecurity as a complex challenge due to confusing standards, high costs and a lack of internal expertise. However, robust cybersecurity doesn’t have to be out of reach.
A pragmatic approach begins with foundational principles. The NCSC’s 10 Steps to Cyber Security provides an excellent framework for organisations to build their defences.
At its core, a cybersecurity program involves implementing “controls” – safeguards designed to reduce risk. Consider these accessible starting points:
Asset Management: Knowing what you need to protect is paramount. Maintain a comprehensive inventory of all devices, systems, and data, assigning clear ownership. Ensure these assets are regularly updated, equipped with anti-virus software, encrypted, and password-protected.
Access Management: Control who can access what, and at what level. Regularly review user permissions to ensure they align with current roles and responsibilities. Implement Multi-Factor Authentication (MFA) for all users and, crucially, extend this security measure to your third-party suppliers where possible.
Risk Management: Proactively identify the internal and external risk to your business. Assess each risk by scoring the Likelihood and Impact of the risk out of 5. Multiply the Likelihood score by the Impact score to get the overall Risk Score. Develop strategies to reduce these risks, focusing on the highest risks first.
Staff Training: Your people are your strongest defence. Regular security awareness training, even as simple as familiarising staff with the NCSC’s 10 Steps, is vital. Tailor content to address your organisation’s highest identified risks, such as spotting phishing emails or securing remote working environments.
Being hacked often just means that someone else has logged in as you. Logging in with your password may not be as hard as you think. Passwords often contain data which is easily collected from social media, e.g. family or pet names, sports teams, birthdays etc. Enabling MFA for all of your user accounts significantly reduces this risk.
Vuelio’s Proactive Approach to Security
At Vuelio, part of the Pulsar Group, we take a holistic and proactive stance on cybersecurity, integrating these principles into our comprehensive Information Security Management System (ISMS). Our ISMS safeguards information offline and online, consistently achieving and maintaining ISO 27001 certification. This international standard demonstrates our unwavering commitment to applying the most rigorous risk management models to protect data for both Pulsar Group and our valued clients.
Our ISMS encompasses:
Asset Management: Maintains a comprehensive inventory of all assets, with dedicated owners ensuring their confidentiality, integrity, and availability. All company laptops are secured with hard drive encryption, user lockout policies, strong password rules, Endpoint Detection & Response (EDR) software, anti-virus, VPN, and disabled removable media, restricting standard users from installing software. URL and email scanning, along with regular patching, further strengthen our device security.
Supplier Management: We meticulously review new suppliers to ensure their security and privacy postures align with Pulsar Group’s Information Security Policy, conducting annual reviews post-onboarding.
Access Control: We adhere to the principle of least privilege, providing users with only the minimum access required for their roles. Our Vuelio product includes standard password complexity rules, and clients can enhance their security further by enabling:
MFA – this will apply to all users and will involve them being sent a SMS/TOTP code to their mobile phone when they login
SSO – enables clients to apply their own authentication policies and user control to the products (supporting OAuth via Microsoft Entra ID/AAD)
Workforce Commitment: Every member of the Pulsar Group team is dedicated to the security and privacy of information. All colleagues understand their responsibilities, are bound by confidentiality agreements, and participate in ongoing training programmes covering topics like phishing detection, secure remote working, GDPR compliance, and incident reporting.
Physical Security: Our London-based offices benefit from robust physical security measures, including CCTV, 24-hour security guards, secure lifts, an occupied reception desk for visitor sign-in and lanyards, and staff access card systems.
Network Security: All data transferred to Vuelio is encrypted with TLS 1.2 or higher, and client data stored within Vuelio is encrypted with AES 256.
Product Development: Our engineers are trained in common vulnerabilities (e.g., XSS, SQL injection) and regularly consult the OWASP Top 10 and guidance from NCSC and other security experts. All source code changes undergo multi-stage peer review by developers and product managers before deployment.
Vulnerability Management: Our online products undergo regular vulnerability scans and annual penetration tests. Findings are categorised by severity and swiftly mitigated within agreed timeframes (e.g., critical vulnerabilities within 14 days).
Patch Management: We maintain a rigorous patch management process, ensuring all devices are updated with the latest security patches from vendors and the wider tech community. Obsolete devices no longer receiving security updates are promptly replaced.
Backups: We implement robust backup strategies for products and critical business data, with regular restoration testing. Backups are stored on separate, immutable, encrypted systems with privileged, MFA-protected access, safeguarding them from ransomware. Vuelio maintains point-in-time backups for 7 days, weekly backups for a month, replicated to an alternative Azure UK-West region and retained for 30 days.
Logs and Monitoring: We utilise third-party tools for enhanced monitoring, and cloud hosting provides built-in monitoring for access and changes.
Business Resilience: In the event of a suspected or actual security incident, our Incident Response Team is immediately alerted. We maintain comprehensive documentation for incident management, disaster recovery, and business continuity, with plans tested annually. Clients receive incident notifications via email within 24 hours, followed by a full report within 5 days.
Key Takeaways for Your Organisation:
Cybersecurity is achievable and vital: It doesn’t have to be complex or expensive.
Start with the basics: If you’re an SME, begin by reviewing the UK government’s NCSC 10 Steps to Cyber Security.
Build incrementally: Document your security controls for each step and review them regularly. This consistent effort forms the foundation of a strong cybersecurity program.
Vuelio clients, enhance your security: If you haven’t yet configured MFA or SSO for your Vuelio users, contact our support team. We’re here to help you strengthen your security posture immediately.
For more on the rising risk of cyberthreats, and what PR, comms, and public affairs need to know to prepare for the event of a crisis, watch Vuelio webinar ‘Cyberattack Crisis Comms‘.