Imagine this, you're sat at your desk one day and up pops an alert or an email to your PC. The message reads something along the lines of as follows. “all your data is encrypted and if you want it unencrypted you will need to pay £xxxx”. Just like that you've been hit with what is known in security circles as ransomware, a very real threat both to you and your company.

Most people would panic and not know what to do - seeing a message such as that pop up, and knowing that your data is at risk is a scary idea. Some forms of ransomware even make the attempt to appear as though they're from a legitimate source such as law enforcement! The best approach is to be prepared – have a procedure in place and know what to do to minimise damage. 

The first and best safeguard you can do for your company is allocate a “Data Protection Officer”, now you have someone to blame! Only joking, even the best DPO’s cannot stop all breaches. However, the Data Protection Officer would be the “go to” person and know exactly what to do in a security breach situation. In small companies the DPO is usually doing another primary job and so DPO is a small part of his working week. 

The data protection officer would know how and where to log a security incident, he/she would know how to minimise damage i.e. isolate PC/Server. They would know the legalities of who to contact to report the breach officially, they would ensure company IT policies are followed, they would know which websites had the latest threat information. Lastly and very key, everyone in the company would need to know who this person is otherwise you may as well not have a DPO. 

Like I said this is only the first step to safeguarding your data and your company, there's plenty more ways to counter the threat of ransomware.

If you'd like some friendly, free advice on what a DPO should be able to do or procedures they have to put in place then give us a call on 01925 83 83 86 

Mark Bowater

Company Director