Improving the cyber security of companies that allow distributed devices access to corporate networks to facilitate remote working resulting from the longer term COVID-19 response.

根据Gallagher的说法，在2019年：“140万英国中小企业遭受了网络攻击/重大安全事件。这使经济损失了88亿英镑，平均攻击成本为6，500英镑。17%的人花了1万英镑来应对一个事件，10%的人花了2万英镑。23%的中小企业无法生存\>一个月，如果无法交易后的事件. 57，000家中小企业可能面临倒闭的风险。“_COVID-19大大增加了这些风险。网络犯罪分子正在调整他们的策略，并瞄准在家工作激增所暴露的端点漏洞。在第二季度，英国企业报告称网络攻击（VMWare）增加了92%。ZNET发现，在过去三个月里，文件加密的恶意软件增加了72%，并指出勒索软件攻击现在集中在窃取数据以及加密数据上。最近的一个例子是，7月17日，NCSC揭露了俄罗斯对Covid-19疫苗开发商的攻击。这些风险在后COVID环境中不太可能减少。Gartner最近的一项调查显示，48%的员工可能会在COVID-19后至少有一部分时间远程工作，而在疫情爆发前，这一比例为30%。中小企业尤其容易受到远程工作攻击，因为它们通常缺乏防范网络犯罪所需的资源。鉴于攻击数量的增加，超过100，000家英国中小企业现在可能面临倒闭的风险。Per Aon“_在过去的几年里，随着组织旨在提高员工的流动性，自带设备（“BYOD”）计划越来越受欢迎。_ 2018年，45%的英国企业允许员工使用自己的设备。”_CyberArk 2020年7月的一项调查显示，77%的远程员工现在使用非托管、不安全的BYOD来访问企业系统。理想情况下，企业和个人数据应该存在完全独立的设备。然而，_ _在冠状病毒爆发之前没有遵循向员工发放单独企业设备的政策的大多数组织现在极不可能承担这样做的成本。_...**因此，数据泄漏的风险增加，特别是如果家庭成员之间共享个人设备或使用不安全的网络连接 **。“中小企业虽然是最脆弱的组织之一，但缺乏专家来帮助他们抵御威胁。网络风险管理需要民主化，让非专业人士能够管理网络防御的基础。创新重点是扩展和重新利用InsurTechnix现有的软件，以满足怡安和其他许多人所描述的需求：**1\。提供一种方法，使中小企业能够确保用于访问其网络的笔记本电脑和电话（包括BYOD）满足最低安全阈值，以抵御/避免绝大多数威胁;** 和 **2\。描述、量化和报告分布式设备（包括自带设备）上保存的数据，以便通过减少高风险环境中保存的数据的性质和数量来最大限度地降低数据泄露的风险。**

According to Gallagher, in 2019_: "1.4m UK SMES suffered a cyber-attack/significant security incident. This cost the economy £8.8bn with the average attack costing £6,500\. 17% spent \>£10k to combat an incident with 10% paying out \>£20k. 23% of SMEs couldn't survive for \> a month if unable to trade following an incident ... 57,000 SMEs could be at risk of collapse."_COVID-19 has dramatically increased these risks. Cyber-criminals are adapting their tactics and targeting endpoint vulnerabilities exposed by the surge in home working. In Q2, UK businesses reported a 92% increase in cyber-attacks (VMWare). ZNET identifies a 72% increase in file-encrypted malware in the last three months and notes that ransomware attacks are now focused on stealing data as well as encrypting it. As a recent example, on 17 July, the NCSC exposed Russian attacks on Covid-19 vaccine developers.These risks are unlikely to reduce in a post-COVID environment. A recent Gartner poll shows that 48% of employees will likely work remotely at least part of the time after COVID-19 versus 30% before the pandemic.SMEs are particularly vulnerable to remote working attacks as they typically lack the resources required to protect against cybercrime. Given the increased number of attacks, over 100,000 UK SMEs could now be at risk of collapse.Per Aon "_Over the past few years, bring your own device ("BYOD") programs have increased in popularity as organizations aim to increase employee mobility._ _In 2018, 45% of UK businesses allowed employees to use their own devices."_ A July 2020 survey by CyberArk shows that 77% of remote employees are now using unmanaged, insecure BYOD to access corporate systems. Per Aon _"Ideally, entirely separate devices should exist for corporate and personal data. However,_ _most organizations that did not follow a policy of issuing employees separate corporate devices prior to the coronavirus outbreak are highly unlikely to incur the costs of doing so now._ _...**As a result, there is an increased risk of data leakage particularly if personal devices are shared between family members or insecure network connections are being used**._"SMEs, while among the most vulnerable organisations, lack the specialists to assist them defend against the threat. Cyber risk management needs to be democratised to allow non-specialists to manage the basics of cyber defence.The Innovation Focus is to extend and repurpose InsurTechnix's existing software to meet the needs that Aon and many others describe by:**1\. Providing a means by which SMEs can ensure that laptops and phones, including BYOD, being used to access their networks meet the minimum security thresholds to defend against/avoid the substantial majority of threats;** and,**2\. Characterising, quantifying and reporting the data held on distributed devices, including BYOD, so that the risk of a data breach can be minimised by reducing the nature and volume of data held in higher-risk environments.**