Recently, X formerly Twitter was hit by a massive cyber-attack. They tweeted or X’d: “We get attacked every day, but this was done with a lot of resources. Either a large, coordinated group and/or a country is involved.”  Right or wrong in his apportion of blame, if the world’s richest man with almost limitless resources at his disposal experiences such severe disruption to his digital platform, it’s no surprise to learn that fraud and cyber-crime now accounts for more than 50 per cent of all recorded crime in the UK.
 
But it’s not just the big companies being targeted.  One major issue for this country is that there are around 70,000 vacant cyber roles.  Now hundreds of university undergraduates are being recruited by regional cyber resilience centres to work alongside small and medium-sized businesses.
 
Chris White is a Police Detective Inspector and Head of Cyber and Innovation at the South East Cyber Resilience Centre (SECRC), one of nine police-led, business-focused cyber resilience centres set up by the Home Office.  He said: “We work with 45 UK universities and recruit more than 70 cyber students every year. Overseen by our security team, they help SMEs, charities and other organisations reduce their risk, from providing training to undertaking vulnerability assessments.  “The students are vetted, screened, mentored and sign non-disclosure agreements. They build up their experience and report-writing skills and get paid. They graduate, career-ready – highly prized from a potential employer’s point of view.”
 
As a detective with almost 30 years of crime-solving under his belt and a stint with an IT company before joining the police force, little surprises him, but trying to tackle the huge rise in cyber-crime is like trying to win at whack-a-mole. And he thinks that many cybercrimes go unreported to the police.  Many criminals aren’t based in the UK, so bringing them to justice can be time consuming – which isn’t what small businesses want. They just want their computers back.
 
SECRC works with universities such as Portsmouth, Oxford, Southampton, Surrey, New Bucks, and Royal Holloway.  “We work with the professors and meet the students most likely to become tomorrow's geniuses, then we ask them to demonstrate their competency and ethics.”
 
A successful cyber-attack can finish off a business altogether, for example, “Let’s say a small local bakery secured a valuable contract from a big bank to supply regular staff lunches. It may think it’s not vulnerable to a cyberattack, but that’s wrong.  “At the very least that bakery will have email, computer, website and smart phones. It may also have WiFi in the bakery and use online accounting software, bank online and deploy social media for its marketing and promotions.
 
All these must be properly protected because if they aren’t, they could open a back door into their much bigger customer.”  Hundreds of commercial cyber security businesses exist to support small businesses, but because SECRC is funded by government, it can be a more cost-effective option.  “Our team can check websites for cyber security issues for around £180. We can train all a small company’s staff for around £340. The is a government funded programme as it is all about crime reduction. Because if a small business fails, there’s a knock-in effect for the whole economy.”
 
He highlighted a story about a company with a disgruntled former member of staff, “An ex-employee hacked into a company email account and changed the recovery settings to his personal phone number, preventing the company from accessing the account.“  The breach occurred over the Christmas break. While recovery email security alerts were sent to the company email address, staff were on annual leave. After the company attempted to recover the email address, they noticed that its two-step verification had been set up with a new phone number.”  The company learned some hard lessons, including that limiting access and using separate accounts for different roles could have prevented the hack. When an employee leaves the organisation, their access should be immediately revoked. Regular account monitoring would also have detected unauthorised access.
 
Cirencester-headquartered wealth management company St James’s Place has a partnership network of more than 2,800 independent wealth management businesses.  It became the first organisation of its kind to extend its cyber security oversight of third-party suppliers to include its partnership network, and uses the government-backed Cyber Essentials standard, created by the National Cyber Security Centre. Its adoption of the standard saw a staggering 80 per cent reduction in cyber security incidents.
 
White added: “More than 90 per cent fewer insurance claims are made by organisations with the Cyber Essentials controls in place.”  Most cybercrime is preventable, he added. “Businesses just need to be proactive. Every company will have tested fire drills, and fire extinguishers around the building. They just need to adopt the same approach to cyberattacks.
 
SECRC now works with around 4,500 organisations across the South East, teaching the fundamentals of cyber security and helping them put protections in place.  Chris reflects on the nature of crime.  “Not a lot has changed from when we built castles with big ditches around them, filled them with water and put a drawbridge over. It’s the same principle – it’s just that now we can’t see the enemy on the other side of the moat.”

Businesses and charities that want to join this program can sign up: https://www.secrc.police.uk/join