The PHP cyber-security update: what SMEs can learn
The PHP cyber-security update has highlighted the vulnerability of a common global web language and the need for ongoing cybersecurity. Understand what SMEs can take from this issue and action to reduce risks.
News broke on a global scale that PHP, a programming language used for websites and web applications, needed two patches to fix vulnerabilities that could have allowed hackers to attack and steal sensitive information. The incident also revealed how businesses can be in the dark on the systems they are using, leaving them exposed to risk.
Do you know what systems and software your business is running?
The response from businesses across the world to the PHP cyber-security alert raises the question about how well SMEs understand their own systems and software. And that goes for larger as well as smaller organisations. These details can get lost or the knowledge leaves at the same time the staff member responsible at the time does.
While a deep understanding of PHP, or other programming languages, isn’t needed for your senior management, ensuring records of what is being used, and where, most definitely is.
Our recommendation is to maintain an up-to-date list of the software, applications and systems that your business uses to help manage cybersecurity risks. A good MSP, such as EBS, can ask you the right questions to help build this inventory and establish where responsibilities lie.
The PHP cyber-security incident highlights a potential ‘grey’ area between IT and web development. A website can be built by a third-party but then passed back to the business for management. At EBS, we can guide you through the questions you need to ask to understand the systems in use throughout your business and aid you in establishing responsibilities for them so that you can get the right support at the time you need it.
You can then be assured that your business has an inventory of its software and systems alongside who to contact for management, security updates and how it connects to other systems.
Do you know how quickly you could respond to a critical security update?
The PHP cyber-security incident also revealed that businesses were struggling to move quickly to secure their systems. The BBC reported that:
“Multiple cyber-security agencies have urged organisations unable to apply fixes in time to consider taking their sites down, leading bodies such as the Finnish government, Edinburgh council and the BBC to take pages offline.”
While this can be due to many different reasons, one potential risk factor will be due to running older or legacy versions of PHP that make it more difficult to apply security updates easily. And this principle applies to all software and systems.
A software application can be introduced, then developed, and then connected to other systems. An SME can then find that they can only update part of the system or the connection risks ‘breaking’.
As a technology partner focused on software and hardware, we always plan a maintenance schedule that keeps the systems we manage up-to-date and working. An up-to-date system will, largely, make it easier to implement patches, such as the PHP updates, but also reduce potential risk as well.
Some SMEs might currently find themselves in a tricky position of having a legacy version of PHP and an old website running. Our advice in that instance is to check through your software inventory to see who has responsibility. If you are yet to put that in place, and unsure where your website is hosted, then free online tools such as hostingchecker.com can provide a useful first place to see who to contact.
How important is it to make your business secure against cyber threats?
The short answer is: very. While the PHP cyber-security update is not a cyber attack, the vulnerabilities could have led to multiple attacks for businesses across the world. PHP released crucial information and release notes for the critical updates to help SMEs manage the patches, via web developers and technology providers, to the websites and other systems to help reduce the risk of cyber attacks.
We’ve highlighted earlier in this article how it can be difficult to know every system and threat as an SME. That’s where investing in cyber-security solutions as well as becoming Cyber Essentials certified can give your business the knowledge it needs on cybersecurity. Helping you to understand potential threats when they emerge and, more importantly, how to deal with them.
How can EBS support SMEs in keeping their businesses safe?
At EBS, we offer a range of cyber-security solutions for businesses of all sizes that covers all the elements that are needed to help keep you secure. This includes managed firewalls, email security, 24/7 monitoring, backups as well as Cyber Essentials.
Cyber attacks are not going anywhere, similar to real-life threats, you can choose how much to protect your business. But without any cyber-security protection, updates like the PHP critical one, can seem like leaving the front door open in your office.
Talk to our team, we’re always here to listen and share advice without any obligation to commit to a solution, email us hello@ebs.tech or call 0121 384 2513.