If you’ve seen the recent headlines about the ASOS cyber attack, you might be wondering how something like this can happen to such a well-known business. But there’s an important lesson in the story for businesses of all sizes, and it goes beyond the technology involved.
ASOS has now confirmed that an unauthorised person gained access to an employee account by impersonating a trusted contact and obtaining their login credentials. Those credentials were then used to access information on third-party platforms. The good news is that ASOS say payment card details and account passwords weren’t accessed. But there’s a bigger lesson here for businesses of all sizes.
Your people are part of your cyber security
When we talk about cyber security, it’s easy to think about technical things. Firewalls. Antivirus. MFA. Backups. Email security. All important. But there’s another security control sitting in almost every business: Your people.
And increasingly, cyber criminals aren’t trying to smash through the front door. They’re trying to convince someone inside the business to open it for them. It might be an email pretending to be your managing director. A phone call from someone claiming to be from Microsoft.
A message from a “supplier” asking you to update bank details. Or, as appears to have happened in the ASOS incident, someone impersonating a trusted contact to obtain login credentials. The technology might be doing exactly what it’s supposed to do. It’s the human interaction around it that creates the opportunity.
That’s where people risk management comes in
We don’t think the answer is to tell your staff: “Don’t click anything suspicious.”
That’s a bit like telling someone to “drive carefully” and calling that road safety training.
People need to understand what they’re looking for, why it’s important and what to do when something doesn’t feel right.
Good cyber awareness should help your team recognise things like:
- Phishing and social engineering
- Suspicious links and attachments
- Unusual requests for passwords or security codes
- Fake invoices and changes to bank details
- Impersonation of colleagues, suppliers or customers
- The risks of sharing information online
- What to do when they think they’ve made a mistake
And importantly, it should be regular. Because cyber criminals aren’t sitting still waiting for your annual training course.
Technology + people = a much stronger defence
The ASOS incident is also a useful reminder that cyber security isn’t one single product.
You can have strong technical controls in place and still have risk sitting elsewhere in your business. That’s why we think about cyber security in layers:
Protect your systems.
Make sure your devices, email, accounts and network are properly secured.
Protect your people.
Give staff regular, practical training and test their ability to spot real-world attacks.
Protect your data.
Understand what information you hold, where it is stored, who can access it and whether they actually need that access.
And have a plan.
Because if something does go wrong, knowing who to call and what to do next can make a huge difference.
Cyber security isn’t about making your business impossible to attack. Unfortunately, that’s not realistic. It’s about making it harder to attack, easier to detect and quicker to recover. And sometimes the most important part of that defence isn’t another piece of software.
It’s the person sitting at the other end of the keyboard.
