ICAS ICAS logo

Quicklinks

  1. About Us

    Find out about who we are and what we do here at ICAS.

  2. Find a CA

    Search our directory of individual CAs and Member organisations by name, location and professional criteria.

  3. CA Magazine

    View the latest issues of the dedicated magazine for ICAS Chartered Accountants.

  4. Contact Us

    Get in touch with ICAS by phone, email or post, with dedicated contacts for Members, Students and firms.

Login
  • Annual renewal
  • About us
  • Contact us
  • Find a CA
  1. About us
    1. Governance
  2. Members
    1. Become a member
    2. Newly qualified
    3. Manage my membership
    4. Benefits of membership
    5. Careers support
    6. Mentoring
    7. CA Wellbeing
    8. More for Members
    9. Area networks
    10. International communities
    11. Get involved
    12. Top Young CAs
    13. Career breaks
    14. ICAS podcast
    15. Newly admitted members 2022
    16. Newly admitted members 2023
  3. CA Students
    1. Student information
    2. Student resources
    3. Learning requirements
    4. Learning updates
    5. Learning blog
    6. Totum Pro | Student discount card
    7. CA Student wellbeing
  4. Become a CA
    1. How to become a CA
    2. Routes to becoming a CA
    3. CA Stories
    4. Find a training agreement
    5. Why become a CA
    6. Qualification information
    7. University exemptions
  5. Employers
    1. Become an Authorised Training Office
    2. Resources for Authorised Training Offices
    3. Professional entry
    4. Apprenticeships
  6. Find a CA
  7. ICAS events
    1. CA Summit
  8. CA magazine
  9. Insight
    1. Finance + Trust
    2. Finance + Technology
    3. Finance + EDI
    4. Finance + Mental Fitness
    5. Finance + Leadership
    6. Finance + Sustainability
  10. Professional resources
    1. Anti-money laundering
    2. Audit and assurance
    3. Brexit
    4. Business and governance
    5. Charities
    6. Coronavirus
    7. Corporate and financial reporting
    8. Cyber security
    9. Ethics
    10. Insolvency
    11. ICAS Research
    12. Pensions
    13. Practice
    14. Public sector
    15. Sustainability
    16. Tax
  11. CPD - professional development
    1. CPD courses and qualifications
    2. CPD news and updates
    3. CPD support and advice
  12. Regulation
    1. Complaints and sanctions
    2. Regulatory authorisations
    3. Guidance and help sheets
    4. Regulatory monitoring
  13. CA jobs
    1. CA jobs partner: Rutherford Cross
    2. Resources for your job search
    3. Advertise with CA jobs
    4. Hays | A Trusted ICAS CA Jobs Partner
    5. Azets | What's your ambition?
  14. Work at ICAS
    1. Business centres
    2. Meet our team
    3. Benefits
    4. Vacancies
    5. Imagine your career at ICAS
  15. Contact us
    1. Technical and regulation queries
    2. ICAS logo request

Would you like to know if you are resilient to a ransomware attack?

  • LinkedIn (opens new window)
  • Twitter (opens new window)
By David Fleming, Chief Technology Officer, Mitigo Cybersecurity

16 June 2022

We’ve seen too many business owners having to endure it. The awful realisation that digital criminals are inside your business, stealing and encrypting confidential personal and business information and using it to blackmail you.

You know for sure that your business is going to be severely damaged, and you’re going to have to explain yourself to the regulator, ICO and your clients.

To help you avoid this, here are our top 10 areas that accountancy firms need to address to stop ransomware.

  1. Anti-Virus (AV) software.

    AV is the software application that is designed to stop malicious software getting a foot hold on your devices and to prevent bad actors (hackers) taking control of your systems.

    In the end-to-end journey of a successful ransomware attack, AV will have several opportunities to halt progress. Cyber criminals will attempt to switch it off as early in the journey as they can. Make sure it is centrally controlled, configured by a security specialist, kept up to date and on every device as a minimum.

  2. Email security filters.

    Email platforms have filters that check incoming emails for malicious software, dodgy links and if they came from an untrusted origin.

    One of the attackers’ favourite ways into a business is via an email. Setting your platform up correctly can make sure that employees are protected from this route in.

  3. Web browsing controls.

    These controls are designed to stop or warn users they are about to visit a dangerous or fraudulent website.

    To get around the AV software, fraudsters will often take unwitting staff to fraudulent websites. This risk can be minimised by correctly setting the controls in the browser, the AV and the operating system.

  4. Security patching.

    Software providers like Microsoft or Google (Chrome) issue regular software updates that patch (fix) known vulnerabilities.

    Cyber criminals will use bugs in software to compromise your defences and this is often used in ransomware attacks to get control. The simple discipline of updating these patches is probably the most neglected.

  5. Least privilege.

    Every user on your system is assigned privileges that define what they can control, run, and amend.

    Ransom attackers take-over users’ accounts and the more privileges that a user has, the more damage the attacker can do. So an approach of least privilege should be followed.

  6. Remote authentication.

    When working at a non-work location (e.g. at home) how do you tell business systems who you are and how do they authenticate that?

    Username and password are no longer good enough protection for remote connection. Adding another method of authentication would stop a significant proportion of ransomware attacks.

  7. Test and scan externally facing assets.

    Tests and scans of firewalls, domain addresses, login pages and IP addresses will check for vulnerabilities and gaps in your security defences.

    You may not be scanning these, but the criminals are! So you need to find the open ports and poor configuration before they do.

  8. Review access management.

    This relates to the documents, files, and folders that your system allows individuals to access.

    There is a generic setting of “Everyone” in many systems. This means that everyone connected to the system can get to the documents, you do not even have to be authenticated. Access to documents should be defined by role.

  9. Alerting and incident response.

    The controls and administration of your IT systems have alerts that warn you something is not right.

    An incident response plan is a rehearsed set of steps that ensure businesses respond effectively to a cyber incident.

    If you prepare these two things correctly you will have a chance of stopping a ransom attack in its tracks.

  10. Back-up.This is the process by which your business takes a copy of the systems, applications, and documents for use in an emergency.

    This is rarely configured correctly, which means that scarily few back-ups survive a ransom attack, with everything ending up encrypted. Get yourself confident that yours would survive.

About Mitigo:

We have partnered with Mitigo to offer cybersecurity risk management services with exclusive discounts for our Evolve members.

Find out more about Mitigo’s cybersecurity services.

For more information contact them on 0131 564 3131 or email icas@mitigogroup.com

2023-03-MarksElectrical 2023-03-MarksElectrical
ICAS logo

Footer links

  • Contact us
  • Terms and conditions
  • Modern slavery statement
  • Privacy notice
  • CA magazine

Connect with ICAS

  • Facebook (opens new window) Facebook Icon
  • Twitter (opens new window) Twitter Icon
  • LinkedIn (opens new window) LinkedIn Icon
  • Instagram (opens new window) Instagram Icon

ICAS is a member of the following bodies

  • Consultative Committee of Accountancy Bodies (opens new window) Consultative Committee of Accountancy Bodies logo
  • Chartered Accountants Worldwide (opens new window) Chartered Accountants Worldwide logo
  • Global Accounting Alliance (opens new window) Global Accounting Alliance
  • International Federation of Accountants (opens new window) IFAC
  • Access Accountancy (opens new window) Access Acountancy

Charities

  • ICAS Foundation (opens new window) ICAS Foundation
  • SCABA (opens new window) scaba

Accreditations

  • ISO 9001 - RGB (opens new window)
© ICAS 2022

The mark and designation “CA” is a registered trade mark of The Institute of Chartered Accountants of Scotland (ICAS), and is available for use in the UK and EU only to members of ICAS. If you are not a member of ICAS, you should not use the “CA” mark and designation in the UK or EU in relation to accountancy, tax or insolvency services. The mark and designation “Chartered Accountant” is a registered trade mark of ICAS, the Institute of Chartered Accountants of England and Wales and Chartered Accountants Ireland. If you are not a member of one of these organisations, you should not use the “Chartered Accountant” mark and designation in the UK or EU in relation to these services. Further restrictions on the use of these marks also apply where you are a member.

ICAS logo

Our cookie policy

ICAS.com uses cookies which are essential for our website to work. We would also like to use analytical cookies to help us improve our website and your user experience. Any data collected is anonymised. Please have a look at the further information in our cookie policy and confirm if you are happy for us to use analytical cookies: