Cyber resilience tools for the financial and property sector

Cybersecurity is a growing concern across all industries, and the financial and property sectors are no exception. With the increasing reliance on technology, these industries are becoming more vulnerable to cyber-attacks, which can have devastating consequences.

The National Cyber Security Breaches Survey 2023 revealed that 73% of finance and insurance businesses treat cyber security as a “very” high priority compared to 36% of all businesses. This approach from the sector has seen a drop in identified cyber breaches attacks from 54% in 2022 to 36% in 2023.

However, cyber threats are ever evolving, and a success attack poses serious consequences to businesses like reputational and financial losses. That’s why consistently increasing your businesses cyber resilience is essential and fortunately there are lots of free tools available to help you do so.

Free tools to help build your cyber resilience

The NCSC (National Cyber Security Centre) is the UK’s leading authority on cyber security. With its advanced technical capabilities and expertise, the NCSC provides valuable insights and practical guidance to businesses and the general public. It is a trusted resource for the most up-to-date cyber security advice.

To make it easier for businesses to access these resources, the ECRC has compiled some of the best resources created by the NCSC, law enforcement agencies, and ECRC. Simply click on the headings for more information.

Non-technical free tools:

Membership with the Eastern Cyber Resilience Centre

Sign up for our free membership and receive our “Little Steps” emails giving easy to understand guidance about steps you need to implement to achieve Cyber Essentials. You can also access our a monthly newsletter, affordable student services and our Forum where you can meet other professionals with the same questions as yourself.

NCSC cyber action plan

Learn how to protect yourself or your small business online with the Cyber Aware Action Plan. Answer a few questions on topics like passwords and two-factor authentication, and get a free personalised list of actions that will help you improve your cyber security. This is a great place to start your resilience journey and quickly identify areas that need improvement.

Incident response plan

To help you minimise the impact of a cyber-attack we have created a Cyber Incident Response Plan for you to use. Create a plan and then use Exercise in a box to test its effectiveness.

NCSC Board Toolkit

Boards are pivotal in improving the cyber security of their organisations. The Board Toolkit has been designed to help board members get to grips with cyber security and know what questions they should be asking their technical experts.

Exercise in a box

These are online tools which helps organisations test and practice their response to a cyber-attack. There are a range of scenarios to encourage discussion about how your company would react, to allow you to understand if the right policies and procedures are in place.

If you are not comfortable with running this exercise yourself, your local police protect officer can guide you through this for free and our affordable student service can conduct a policy review beforehand to ensure you are in the best place.

Chambers cyber security

Cyber Security questionnaire to be completed by Chambers to share with Legal Firms (as their clients) to provide assurance about the safety of data shared with Chambers.

NCSC cyber security training for staff

Your staff are your first line of defence against a cyber-attack. The NCSC has developed an e-learning training package ‘Stay Safe Online: Top Tips for Staff’ to help educate your staff on a range of key areas including phishing, using strong passwords, securing your devices and reporting incidents.

Technical free tools:

Police CyberAlarm

The Police CyberAlarm is useful to help your business understand and monitor malicious cyber activity. Police CyberAlarm acts like a “CCTV camera” monitoring the traffic seen by a member’s connection to the internet. It detects and provide regular reports of suspected malicious activity, enabling organisations to minimise their vulnerabilities. Vulnerability Scanning can be added and used to scan an organisations website and external IP addresses.

Early warning

This is a NCSC service that sends you high level alerts, in daily and weekly summaries, based on your IP and domain names, containing:

• Incident notifications suggesting an active compromise of your system. This might be a host on your network being infected with malware.
• Network Abuse Events suggesting your assets have been associated with malicious or undesirable activity. This might be a client on your network found scanning the internet.
• Vulnerability and Open Port Alerts suggesting vulnerable services running on your network, or undesired applications are exposed to the internet. This might be an exposed Elasticsearch service.
• Mail Check
• Assesses email security compliance, helping implement anti-spoofing controls (SPF, DKIM and DMARC) and email confidentiality (TLS).

Web check

Web Check provides regular automatic scan of your website and alerts you to common website security issues and advises on how to fix them. This can be used in conjunction with vulnerability testing by our affordable student services. You might ask what the difference between Web Check and a vulnerability test is. Our vulnerability assessment uses the OWASP methodology which is regularly reviewed for the top ten most common threats to web applications. Students use automated as well as manual tests to investigate the different processes such as looking at what file uploads were permitted.

NCSC scanning made easy

This is a collection of NMAP Scripting Engine Scripts, designed to help system owners and administrators find systems with specific vulnerabilities. The script will output simple-to-read results including a description of the vulnerability and a link to the vendor security advisory. Running this script often and following the linked vendor advice will help to keep your network secure.

Affordable services

Ok, these aren’t free, but they are affordable, and we do mean affordable. We want every company operating to be able to access essential cyber resilience services.

We work with local universities to identify students who have the skills and aptitude to work in the cyber industry. They are trained and mentored by senior ethical hackers to be able to deliver these services.

Our students get amazing real-world experience, while your company gets an amazing service from students who are enthusiastic and dedicated to getting it right.

All the services are bespoke to your company, so pricing is based on what you need. You can get a free, no obligation quote so you can see how affordable our services are. Why not contact us to find out more?

Further guidance & support

The Eastern Cyber Resilience Centre is a not-for-profit organisation, run by policing, with the intention of increasing cyber resilience of SMEs within the East of England.

Our members can benefit from a range of services, from helping you improve your cyber resilience through our “little steps” programme to being notified about the threats relevant to you.

Reporting a live cyber-attack 24/7

If you are a business, charity or other organisation which is currently suffering a live cyber-attack (in progress), please call Action Fraud on 0300 123 2040 immediately. This service is available 24 hours a day, 7 days a week.

Reporting a cyber-attack which isn’t ongoing

Please report online to Action Fraud, the UK’s national reporting centre for fraud and cybercrime. You can report cybercrime online at any time using the online reporting tool, which will guide you through simple questions to identify what has happened. Action Fraud advisors can also provide the help, support, and advice you need.

Report a phishing attack

If you suspect a phishing attack, please report it to the Suspicious Email Reporting Services (SERS) set up by the NCSC at: [email protected]

This is a guest blog which contains the views of the author and does not necessarily represent the views of the IoD.