How volunteers can leave you vulnerable to cyber attacks

In 2014, a cyber attack against Sony Pictures demonstrated to the world the dangers of a “flat network”. Attackers entered Sony’s network in one part of the business but, due to the flat network structure across the whole of Sony, they were able steal music, films and confidential documents from their servers all over the business and across the world. 

  

A “flat network” is when all devices in an organisation communicate across a single network which has not been segmented to improve security. This scenario has risks because if there is a vulnerability anywhere in the network, it threatens the security of everything. 

 

Network segmentation, however, would make it very difficult for an attacker to move from one part of the business to another. One simple way to move some laptops or mobile devices – such as those that are old and do not support important software updates – onto a network that is separate from your main charity network is to create a guest network.   

 

You may already have come across guest networks when using the internet at a library or in a hotel. Although you are connected to the internet, you will not be on the main orgnisation’s network and therefore not able to access (or provide an access point) to their organisational data. 

 

 

How to set up a guest network on your router 

  

Most modern internet routers allow you to create a guest network, but as different routers use different software, this varies from router to router.  

 

First, type your router’s IP address into the search bar of any browser, this is a long number such as 192.168.1.1. You can find your router’s web address by searching online, “What is Plusnet/ BT/ Virgin Media router’s address?”.  

 

Once you have entered the address and are on your router’s web page, you will need to log in as an administrator to your router account by entering the admin password. 

 

You will have the details of the password from the Internet Service Provider you use or the manual which comes with the router. 

• Log into your router account 
• Look for the guest network settings under the WiFi or Wireless settings 
• Enable the guest WiFi access by switching a toggle or checking a box 
• You will need to set the guest WiFi network name and guest WiFi password - be sure that you don’t use the same password for your guest network as your main network
• Now save your settings
• You can share the WiFi name and password of your guest network with your volunteers or workers and their devices that you want to keep separate from your main network 

 Please note, your particular router may not have the option to create a guest network.

 

 

Why is network segmentation important for Cyber Essentials? 

 

Getting certified for your cyber security is an excellent way to ensure that cyber security is embedded into your organisation’s operations and decision-making. The certification communicates to your stakeholders how important cyber security is to your charity and the steps you’re taking to protect it online.  

 

The Cyber Essentials certification acts like a cyber security checklist, ensuring you correctly put the five core controls in place that can guard against the majority of internet threats.  

 

In order to be cyber certified via Cyber Essentials, charities must be able to clearly describe what the scope is (e.g. "our office in London only") and how it is separated from any other part of your organisation, especially if that poses a risk to your cyber security.  

 

In actuality, many charities are already ready to become cyber certified, accessing all the benefits we’ve discussed above, but lacking the clarity to take the plunge.  

 

There are nearly 300 specially trained cyber security companies around the UK who are licensed to certify against the Government’s Cyber Essentials Scheme. They can offer help and support in preparation for the assessment.   

 

You can find one near you or start by using the Cyber Essentials Readiness Tool below to check if you fit the criteria to be certified.