Businesses across Shropshire can take a free online cyber security assessment this month, released by Albrighton based cyber security company Solusec to mark Cyber Security Awareness Month, which runs throughout October.

The assessment takes about six minutes, requires no sign-up, and gives each person who passes a named certificate they can keep as a record of training. Organisations are being encouraged to send it round their whole team.

Solusec says it deliberately avoids the format most awareness training uses.

“Ask somebody what phishing is and they will tell you,” said Daly Whyte, director of Solusec. “Ask them what to do when their phone buzzes three times with a sign-in approval they did not request, while they are making coffee and late for a meeting, and the answer is less certain. The first is a definition. The second is a decision, and that is where businesses actually lose money.”

Each of the ten questions is a situation rather than a definition, several have an obvious answer that turns out to be wrong, and the reasoning is explained the moment a person answers rather than at the end.

One scenario is likely to be of particular interest to Chamber members. A supplier emails to say their bank details have changed, asking for this week’s invoice to be paid to a new account. The message comes from the supplier’s real address and quotes the correct invoice number, because the supplier’s mailbox is the thing that has been compromised.

“Replying to confirm goes straight to the attacker, who is reading that mailbox,” said Daly. “A small test payment proves the account exists, not who owns it. The only reliable answer is to phone the supplier on a number you already hold, not one from the email. It costs nothing to agree that rule in writing, and it is the single most useful thing a small business could do this month.”

Solusec suggests four practical steps for October:

  • Agree in writing how a change of supplier bank details is verified, by phone, on a number already held, and by somebody other than the person who received the email.
  • Check that multi-factor authentication covers every account, not most of them.
  • Find out how long a laptop can sit waiting to restart before updates are actually applied.
  • Keep a dated record of who has had security training, which insurers and client questionnaires increasingly ask for.

Nine of the ten scenarios in the assessment are survivable because of a technical control rather than an alert employee, Solusec notes, and those controls are the five that Cyber Essentials certification covers.

Solusec is based at Albrighton and is an IASME appointed Certification Body for Cyber Essentials and IASME Cyber Assurance, a Defence Cyber Certification Body for the MOD supply chain, and a CREST accredited penetration testing provider.

The assessment is free and available throughout October and beyond at: https://solusec.co.uk/cyber-security-awareness-month/