In today's digital age, every industry needs to be aware of the vulnerabilities that exist within their IT infrastructure with the HR sector being no exception. This is due to the vast amounts of sensitive personal data and financial information that the HR department of any organisation hold.

A vulnerability is a weakness found in an IT system that can be exploited by an attacker to deliver a successful cyber-attack. They can occur through flaws, features or user error, and attackers will look to exploit any of them, often combining one or more, to achieve their end goal of gaining access to your systems.

System vulnerabilities are the same as weaknesses found in the construction of a physical building: they become tempting targets for outsiders to pry open the door and sneak inside. That’s why regularly conducting a vulnerability assessment, to search your IT systems for known vulnerabilities, is crucial.

What is a Vulnerability Assessment?

A vulnerability assessment is a systematic review of security weaknesses in an information system. It evaluates if the system is susceptible to any known vulnerabilities, assigns severity levels to those vulnerabilities, and recommends remediation or mitigation, if and whenever needed.

Here at the ECRC, we offer affordable Cyber Security and Resilience Services through our free core membership, including three types of vulnerability assessments:

• Web Application Vulnerability Assessment – This service assesses your website and web services for weaknesses. The service reporting will describe in plain language, what each weakness means to your business and the risks associated with each. Service reporting will include plans and guidance on how to fix those weaknesses.
• Remote Vulnerability Assessment - Remote vulnerability assessments are focussed on identifying weaknesses in the way your organisation connects to the internet. Service reporting will provide a plain language interpretation of the results and how any vulnerabilities might be used by an attacker, as well as simple instructions on how any vulnerabilities might be fixed.
• Internal Vulnerability Assessment - The service will scan and review your internal networks and systems looking for weaknesses such as poorly maintained or designed systems, insecure Wi-Fi networks, insecure access controls, or opportunities to access and steal sensitive data.

By regularly carrying out vulnerability assessments, you are ensuring no virtual back door is left open for a hacker to sneak through.

What’s next?

The impact of a successful attack against your network can be catastrophic and lead to a full blow system breach, loss of data and a permanent loss of reputation. But all is not lost.

Here at the centre, there are three things that we would recommend for you to consider:

• Join our community as one of our growing number of free core members. You will be supported through implementing the changes you need to make to protect your organisation. Core members receive regular updates which include the latest guidance, news, and security updates. Plus, you will get access to our brilliant Cyber Security and Resilience services.
• Contact us to arrange a meeting to discuss providing a Vulnerability Assessment for your company.
• For all businesses across the Eastern region, we would recommend that you look at improving your overall cyber resilience and work towards achieving Cyber Essentials accreditation – the basic government backed kite mark standard for cyber security. Remember, a company operating under Cyber Essentials processes is 99% protected either fully or partially from today’s common cyber-attacks. Our free Little Steps course can help you understand what you need to do.

We are already working closely with hundreds of organisations across the seven counties to help them tackle the continually changing cyber threats that they face. So come and join our community as free members and let us help you protect your organisations from the ever presents threats out there in the cyber-verse.

Reporting a live cyber-attack 24/7

If you are a business, charity or other organisation which is currently suffering a live cyber-attack (in progress), please call Action Fraud on 0300 123 2040 immediately. This service is available 24 hours a day, 7 days a week.

Reporting a cyber-attack which isn't ongoing.

Please report online to Action Fraud, the UK's national reporting centre for fraud and cybercrime. You can report cybercrime online at any time using the online reporting tool, which will guide you through simple questions to identify what has happened. Action Fraud advisors can also provide the help, support, and advice you need.