Social engineering is the use of deception to get people to divulge confidential information. On an individual scale, it can be something as simple as disclosing the personal identification number for your bank card, enabling someone to illegally access your funds. On a corporate scale, it can entail the leaking of thousands of people’s confidential information including user names, passwords, identity numbers, etc.

BUI MD Ryan Roseveare says: “Although this type of social engineering can affect the general public and put them at risk of inadvertently exposing confidential information, the biggest threat is to corporates who hold massive amounts of personal data about their customers and their staff. All too often data loss in the corporate environment is simply the result of negligent behaviour by uneducated users who do something as basic as clicking on a malware-infected e-mail.”

According to Roseveare, a big threat to business is where private negligence can cause corporate issues, meaning when people use private devices on their own Internet and for private use. “They don’t even access company resources remotely but then they access applications, or they want to register for the likes of Facebook, and they use their company details (such as their e-mail address) and all too often they also use their work password to register. Hackers then get into the databases for sites such as Facebook, LinkedIn or even Ashley Madison, obtain those credentials and use them for external attacks.”

There have been several well publicised incidents of cyber crime recently, underscoring the need for businesses of all sizes to be vigilant about online security.

How did it happen?

Well, there are several ways in which people can be persuaded into sharing information that they wouldn’t ordinarily disclose. We all know not to click on links in e-mails or to open attachments from unknown sources, but what about that phone call from the bank or your cellular provider asking you to confirm your personal details?

However, not all identity thefts are that simple. In September this year, a US credit reference agency reported a hack that affected the data including credit card details of up to 143 million people. The implications of such a large-scale attack are widespread, including the damage caused to that company’s brand and reputation. It’s believed that the hack took place through a third party company that did business with the credit reference agency.

The right thing to do

What do you do if your customers’ personal data is exposed? Well, the most important thing is to establish exactly what confidential information was stolen. Then you need to let the affected people know immediately, says Roseveare, so that they can notify their financial institutions if their banking information has been breached.

Prevention is better than cure

Naturally, prevention is the preferred route, and there are several measures that businesses can take to identify potential breaches before they can happen. However, says Roseveare, much as in other remedial programmes, the first step is admitting that you may have a problem or, in this case that your system is indeed vulnerable to attack.

It’s important to note that the increasingly mobile workforce and the associated trend towards BYOD (bring your own device) make the job of safeguarding your company’s data that much more difficult. Roseveare breaks it down into three areas: “You need to protect the device, you need to protect the data, and you need to protect the access.

Measures that you could and should implement include multi-factor authentication instead of just a single password when accessing certain types of data, says Roseveare. So a combination of fingerprint, PIN, strong password, even iris scanning or facial recognition can be used to ensure that only authorised users can access certain applications and information.

While firewalls and anti-virus software certainly play integral roles in data security, these are powerless against the hapless individual who opens an e-mail that appears to come from a trusted source.

It may seem obvious, but educating your workforce and other users around the risks inherent in clicking on a link or attachment in an e-mail from someone that they don’t know, is one of the most basic things that you can do to protect your personal data.

Roseveare concludes by saying: “If the information above has sparked a fear that your business could well be vulnerable to attack, then we’ve achieved what we set out to do. A little healthy fear can save your business and your identity from malicious attacks of this nature.”

Did I Just Socially Engineer My Own Identity Theft?

Our commitment to ensuring business continuity – even in the face of disruption – has been recognised by the British Standards Institution.

We’re proud to announce that we have earned ISO 22301 certification after a rigorous independent evaluation by the British Standards Institution last month. The ISO 22301 badge is recognised internationally and sets the standard for Business Continuity Management Systems.

“This certification highlights the strength of our company’s business continuity strategy,” says Gayle Roseveare, our Chief Operating Officer (COO) here at BUI. “It proves to our staff, partners and customers that we’re prepared for any eventuality – and that we’re able to serve and support the people who rely on us, no matter what. Our ISO 22301 badge represents our commitment to effective risk management, organisational resilience, and reliability – even in the face of disruption,” notes Roseveare.

What is ISO 22301?

Developed by the International Organisation for Standardisation, ISO 22301 lays out a framework to help companies like ours create, implement, and maintain a comprehensive business continuity management system (BCMS). The main aim is to ensure that companies are protected against unforeseen business challenges and equipped to respond and recover when such events do occur.

“BUI is a global company with offices in East Africa, South Africa, the United Kingdom and the United States,” says Roseveare. “On any given day, our teams are provisioning cloud infrastructure, monitoring and securing digital environments, and delivering a wide range of IT services to customers. We operate around the world and around the clock – and we have to be able to do so continuously. Whether there are power outages in South Africa or internet connectivity issues in Europe, we need to ensure we can deliver uninterrupted services to our customers. Our ISO 22301 certificate validates our planning for disruptive incidents and disasters.”

Why is ISO 22301 certification important?

“In an unpredictable business climate, it pays to be prepared,” explains Dhiren Boodhia, our Group Governance and Compliance Manager. “And that goes double for service providers like us. To earn our ISO 22301 certificate, we had to demonstrate that we have a thorough BCMS in place; that the staff in our various offices understand the BCMS and the processes required to sustain it; and that we are focused on maintaining business continuity and sustainability regardless of market uncertainties and challenges. I think the ISO 22301 badge is an important differentiator – especially when customers are looking for a steadfast technology ally that is as dedicated to legal and regulatory compliance as it is to protecting the business resources of the organisations it works with,” he says.

For customers who choose to partner with BUI, there are five key benefits, adds Boodhia.

  1. Consistency. ISO 22301 emphasises the importance of consistency when it comes to best practices and business processes. “We’ve been assessed on our capabilities around risk assessment and impact analysis as well as our strategies for mitigating disruptions. Our teams excelled in every area – and that means our customers can expect the highest standards of service and care from everyone at BUI,” says Boodhia.
  2. Data protection. With the cyber threat landscape evolving so quickly, data privacy and data security are critical considerations for customers. “ISO 22301 includes extensive conditions for data protection and data recovery,” notes Boodhia. “Our ISO 22301 badge, together with the ISO 27001 certification we achieved for our commitment to information security management, should give our customers even greater confidence: we handle all data respectfully and safely.
  3. Faster recovery. “ISO 22301 requires us to have a holistic strategy in place to deal with disruptions and disasters. It also mandates a detailed recovery plan to ensure that downtime is minimised – for our company and for the business organisations we serve,” says Boodhia. “BUI customers can be assured that, in the event of an issue, our teams will follow a step-by-step framework to resolve the problem as quickly as possible.”
  4. Greater compliance. By achieving ISO 22301 certification, BUI has met the global benchmark for business continuity management, adds Boodhia. “Many of our customers operate in highly regulated industries, like financial services and healthcare, and they must adhere to their own standards in terms of the services they provide to their clients. BUI is committed to maintaining essential functions during adverse circumstances – and that’s a big plus for customers who have strict compliance obligations.”
  5. Peace of mind. ISO 22301 calls for certified organisations to update and improve their business continuity processes to ensure that their strategies remain current, relevant, and effective. “We’re obligated to adapt and enhance our BCMS plan as our company grows,” explains Boodhia. “It’s good news for our customers because it means we’re always prepared. Whatever happens, the BUI services and solutions that so many businesses utilise every day will be available.”

Our commitment to your success

ISO 22301 may be our newest certification, but it’s also a testament to our unwavering focus on our customers, notes our COO. “To be a dependable, reliable technology partner, you need to anticipate the challenges you’re going to face and then take the necessary steps to ensure that you can address those challenges as soon as they arise. We’re being proactive today so that we’re ready for tomorrow – and always on hand to help our customers be productive, secure, and resilient,” Roseveare concludes.

Do you have a disaster recovery plan in place?

Our experts can help you craft a comprehensive backup strategy aligned with your business structure, your IT resources, your budget, and your goals.

Contact our team to arrange a discussion today.

share this article