Staying Secure This Christmas: Cyber Security Tips for SMEs and Non-Profits

12.12.23

Blog, Cyber

The Christmas holiday period is often seen as a time to relax business operations and let employees enjoy some well-deserved time off. However, it’s also prime time for cybercriminals who know that defences may be lowered with skeleton IT crews working over the holidays. Attacks such as SEPA and Arnold Clark are a stark reminder of how even larger organisations can be hit over the festive period. Small and medium enterprises (SMEs) and non-profit organisations can be especially vulnerable to attacks like phishing scams, malware infections, and data breaches during this season.

Implementing some cyber security best practices doesn’t have to be difficult or expensive. Here are some tips to help keep your organisation’s data safe so you can enjoy the holidays:

When cyber attacks occur, quick decisions are crucial to minimise damage. Having a formal cyber incident response plan in place helps you make informed decisions in the face of an attack. It’s also important to establish key employees who should be on call if an incident occurs. The CyberScotland website has a Cyber Incident Response Pack template which provides practical advice to businesses on handling cyber incidents. This pack includes advisory pieces on reputation management, legal considerations, checklists and editable documents that centralise important contacts for incident management.

If you don’t currently have a cyber incident response partner, it’s worth considering. This is a partner that you can call upon in a cyber incident to help you assess the situation, contain the breach, and restore your systems. Please get in touch with us if you would like a list of our Cyber Incident Response Cadre members.

Phishing emails and smishing texts often target the heightened emotional state around the holidays. These messages may entice you with tempting offers, urgent notifications, or requests for personal information. Always exercise caution and verify the authenticity of any suspicious communications.

We recommend that staff report suspicious emails to your internal IT team or your Managed Service Provider to block the malicious domain or IP address, as well as report them to the National Cyber Security Centre’s Suspicious Email Reporting Service. 

Two-Factor Authentication (2FA) is an essential security measure that adds an extra layer of security to your accounts. It requires users to provide an additional step to verify their identity, such as a code sent via email or text or authorisation through a trusted app.

Remind staff of cyber security best practices and policies such as how to identify phishing emails, report suspicious emails, and recognise common scams your organisation may encounter. When communicating reporting procedures, consider your IT department’s reduced staffing and how it may affect the process. Our ‘Introduction to Cyber Security’ Guide is a great resource to share with employees as a reminder of best practices. 

Before the holidays, install the latest OS and software updates. These updates often contain critical security patches that block emerging cyber threats. An unpatched system is easy prey for hackers.

If your organisation plans to close down entirely for the Christmas holidays, ensure a backup of all business-critical data is in place. Numerous types of attacks can corrupt or encrypt data, which backups can help recover from. Regularly backing up data is a recommended practice, follow the 3-2-1 backup method:

By following these guidelines, you can ensure data recovery in case of any failure scenarios.

If you suspect your organisation has been a victim of cybercrime, our Incident Response Helpline (0800 1670 623) is available throughout the festive period. You can also call the helpline for general cyber security advice to ensure your organisation has the right processes in place.