By SenseRisk, your award winning, 5* rated, highly trusted, Bristol based insurance broker
Critical PHP Website security flaw: what businesses should know
A major website security issue has provided a timely reminder of just how dependent businesses have become on their online systems.
PHP is the language behind around 70% of websites worldwide
A critical flaw was recently discovered in PHP, technology used behind the scenes by a large proportion of websites. The problem was serious enough for some organisations to temporarily take websites offline while security updates were made.
A PHP patch is available
The UK’s National Cyber Security Centre (NCSC) has advised organisations using PHP to update to the latest fixed version. Where this cannot be done quickly enough, it says organisations should consider temporarily taking affected systems offline until they can be made secure.
Why does this matter to businesses?
Many business owners won’t know whether their website uses PHP and shouldn’t be expected to understand the technical detail behind it. However they will know who is responsible for maintaining your website and keeping it secure.
The recent incident affected organisations in the UK and overseas. Oxford City Council and the City of Edinburgh Council were among those to temporarily take websites offline, while the Office for Budget Responsibility also took its website down as a precaution.
Importantly, taking a website offline doesn’t mean it has been hacked. In some cases, organisations did so as a precaution while the security problem was addressed.
Downing Street said no large public-facing critical UK Government services were affected, although some limited services could temporarily be unavailable while security work was carried out.
What should businesses do?
The NCSC recommends that organisations identify whether they have systems using PHP and update them to the latest fixed version. Businesses should also keep an eye on security updates from companies supplying their software and online services. And staff should be advised to run any required updates on their devices as a security priority.
For a small business, a sensible starting point is to contact whoever manages your website or IT and ask whether your systems are affected and whether the necessary security updates have been applied.
But this incident also raises a wider question:
What would happen to your business if your website suddenly went offline?
For some businesses, this might simply be inconvenient. For an online retailer or a company relying on online bookings or customer enquiries, the disruption could be much more serious.
Cyber security is a business issue
Cyber security isn’t something that should sit solely with your IT provider.
Businesses should consider:
- Who is responsible for keeping the website and other online systems up to date?
- Do you have recent, tested backups?
- Could customers still contact you if your website was unavailable?
- Does your business continuity plan cover website and system outages?
- Have you reviewed your cyber insurance recently?
Cyber insurance doesn’t replace good security, but it can form part of a wider plan for protecting your business against the financial and operational impact of certain cyber incidents.
The latest website security issue demonstrates how quickly a technical problem can potentially become a business problem.
You don’t need to understand all the technology behind your website. But you should know who looks after it, what you would do if it stopped working and whether your business is adequately protected.
If you’re unsure whether your existing insurance reflects the cyber risks your business faces, speak to SenseRisk about reviewing your cover and identifying potential gaps.
SenseRisk Heath check