member

The phrase ‘your money your life’ (YMYL) has become increasingly important in the world of Google and search engine optimisation (SEO). The phrase relates to topics and subject areas online which as you might imagine, have the potential to affect people’s money and their lives more broadly.

There are a wide range of topics which are encompassed within the YMYL sphere which include (but are certainly not limited to):

• Loans and personal finance
• Health and healthcare
• Insurance
• Online gambling, bingo and casinos
• Some areas relating to mental health

There are also various areas which fall into the remit of YMYL as they may even indirectly affect those specific areas of a person’s life.

For example, when it comes to things like brain injury solicitors and compensation claims, although not necessarily within the above remit of YMYL, it can still affect a person in the same way as those mentioned, should something untoward, or ‘less than kosher’ occur, in a way that various other areas cannot do.

What Are the Implications of YMYL?

Although in the case of any industry online, the likes of Google and other search engines and social media platforms take strict stances, such are the potential ramifications, YMYL is a specific area of focus for Google.

In past years, unscrupulous people have exploited loopholes in Google and other platforms’ algorithms and have been able to market shady products to unsuspecting customers.

In the case of loans and personal finance, in the early days of payday loans in the UK, there were providers who were in essence, no more than loan sharks, that managed to rank online and offer potentially desperate customers appealing offers, only to later on exploit and overcharge them.

Thus, in the case of Google, they have openly admitted to developing specific features within their rankings and algorithm, to judge and assess topics and areas within YMYL in their own right. This means that as far as possible, only honest and true experts in potentially very impactful areas can rank, while those who may try and ‘chance’ ranking in areas of high repercussions, will find it much more difficult.

YMYL and Advice

More than a few people each day use ‘Doctor Google’ to try and understand and diagnose conditions. Although there are reputable providers of such information online, like the NHS in the UK and the FDA in the USA, there have in the past been unscrupulous people who have tried to exploit the need for knowledge and health information for unsavoury means.

Thus, when it comes to information, much like it does for products and services, the YMYL algorithm and terms and conditions will also apply, with users and honest people browsing in mind.

We now have information on how to do a right to work check.

The Home Office has published their guidance on right to work checks for employers that apply from 1 July 2021.

Retrospective checks are not required for EU, EEA and Swiss citizens who commenced work before 1 July 2021.  You should ensure that your right to work procedures are updated in line with the revised guidance.

We can help you to navigate these changes.  Get in touch at sarah@ignitepeoplesolutions.co.uk

Business owners and leaders are constantly learning new things and as a relatively recent business owner I am no exception.  I am always seeking advice, and trying to find the best people to help me make the business a success.

A great example is marketing.  Coming from a technical and consulting background, this is not really my area of strength.  Don’t get me wrong, I’ve picked up a lot over the years, and I’ve managed, through luck or judgement or some combination of both to do enough to get the business into a pretty good place in our first three years.  But when it came to the point where we decided to put some real focus on our marketing, I wasn’t really too sure where to start.

Clearly there are many aspects to marketing a business, whether you’re new or established.  I knew I needed some help, but to whom should I turn?  Should I employ someone, or use an agency?  Should I look for a generalist, or a specialist (or a number of different specialists)?  I know that I prefer working with specialists, but if I pick a specialist in one area, am I neglecting other important areas?

The problem, for me, was that not having sufficient experience or knowledge of the area that I needed help with, I wasn’t sure how to articulate exactly what help I was looking for.

I didn’t know what I didn’t know.

Fortunately, I managed to find my way through this with some advice from friends in the field, and some trial and error, and I’m confident that we’re now on the right track.  However, if there had been a course or workshop that I had come across that would have helped me figure out the key areas that I needed to consider, key questions to ask myself and guide me towards some priorities, I would definitely have jumped at that.  I’m sure they exist; I just didn’t find them.

When it comes to Cyber Security and managing the risks to a business, I frequently see exactly the same scenario.  Business owners, and senior management teams know that their business is at significant risk from Cyber Attacks, ransomware, email-based fraud and similar, and many know they need help.  Their IT department, or external IT provider looks after some of the technical aspects of security but they’re often not specialists in security – they’re typically more focused on keeping the lights on and implementing new technology to help the business stay ahead.   Rightly so.  The owner, or leadership team, however, has this nagging feeling that they should definitely be doing more.  They know they need some help.

But they don’t know what they don’t know.

Our Cyber Security for Business Owners and Leaders training is, for security, exactly what I was looking for when I needed help with marketing.

The point of the one-day training workshop is not to make you a security expert.  It’s not designed to scare you into buying services from us (although it might scare you a bit).  It’s purpose is to help you understand what you don’t know – what’s important, what to look at and prioritise when it comes to security, and where to go for help that you can trust.  But  it’s more than just telling you.

Yes, we provide you with lots of information, all geared towards owners and senior management teams, but it’s a bit of a whirlwind “voyage of discovery”.  Through carefully designed exercises and discussions, we’ll help YOU discover how to determine what is important to your business, how to assess risks and impacts in a security context, and how to build a strategy and plan to improve security and reduce business risk.

Want to find out more? You can contact us to talk through your needs or alternatively go online and book yourself on to the next available course.

Welcome to our new team member – Kate – a Diversity, Inclusion and belonging Specialist

Diversity refers to the characteristics that make people unique.  Inclusion refers to the behaviours and cultural norms that make people feel welcome.  Belonging refers to an individual sense of acceptance.

Regardless of whether you’re new to business or leadership, or you have been in business for a while, when you first start to take your cyber security approach seriously, you may well discover that your first challenge is where to start.

There are many different elements to cyber security, and lots of different ways to approach it once you start looking at the detail of all of the things you need to do, but in terms of your starting point there are really two fundamental approaches that you can choose to take.

The first approach is to pick a framework or a set of standards and work towards that.

A bit of research will show you that there are a number of frameworks that you could pick from.  Standards like Cyber Essentials, CIS controls, or ISO standards (27001 for example).  All vary somewhat, and have a slightly different focus, but there are certainly some common themes running through most of these standards or frameworks.

The nature of frameworks however is that they are trying to be all things to all people; it is extremely difficult to create a framework which is equally applicable to all types of businesses or organisation.  So how do you know which one is most applicable to you, and which one to pick if that’s the cyber security approach you are going to take?  That’s not an easy question to answer.

Following a framework is one valid approach to cyber security.  It gives you something to work towards.  But how applicable is it to your organisation?  Answering this question is not something that you need to be considering alone and from within the walls of your organisation.

Not only can we support you in gaining ISO 27001 accreditation or Cyber Essentials Certification, training and awareness are something we strongly believe in and to this end we have built a number of training courses and workshops.  These will not only inform and educate but will also empower the right people in the right roles to be able to ask and answer the most relevant questions for your business.

Rather than focusing on frameworks, you may decide to instead take a risk-based cyber security approach.  This is an approach that is more tailored towards your specific business or organisation.  It considers the specific data that you have, the systems you use, the people you have in your organisation and their level of understanding of all things security, the processes that you have in place, and how all of these combine to create risk specific to you.

How this happens depends on who you partner with.  Our approach is to come in to your business and run discovery workshops on site with your teams.  This enables a depth of understanding which allows for the development of the most relevant and workable cyber security roadmap to you – a roadmap that will get you to a position where your risks are being proactively managed.

Different organisations, different security requirements – What sort of differences are we talking about though?  Let’s look at three key differences.

Firstly there is data.  Some organisations are heavily reliant on data, some not so much.  Some organisations collect and process particularly confidential or sensitive data, such as health data for instance.  Whatever data or sensitive information your business handles, it is of paramount importance to ensure you fully understand the implications of a data breach for you, your customers and those whose data you hold.

Some organisations have only employed staff, where elements of security policy can be made part of their employment contract and ongoing training, whereas other organisations have a heavy reliance on freelancers or subcontract staff where this is not so easy.  Management of systems used by these groups also differs in its level of practicality; managing and controlling devices which are company supplied is one thing, but devices owned by a freelancer or subcontractor present a particular challenge.

And third we have technology and technical infrastructure.  Every single business is unique in this aspect, so to this end there is no “out of the box” solution to understanding what risks your specific solutions and set-up pose.  Whilst it is a key part of understanding your business, we would also advocate that increasing awareness amongst your staff should be front of mind when choosing how you approach cyber security.

Security is all about risk – appreciating it, understanding it, and reducing, mitigating or sometimes accepting it.  Building confidence in your organisation and across all teams and departments is not something that should be left as a nice to have part of your cyber security approach.  Investing in your people as well as technology and advice, will go a long way to ensuring you are as best protected as you can be from cyber threats.

It would be very easy, and not at all surprising to witness, to get oneself in to a panic and high state of fear relating to the risks of cyber crime to your own business, or your employer, especially if you are in a position of responsibility relating to data, information or security.  With the UK governments latest Cyber Security Breaches Survey reporting that “Four in ten businesses and a quarter of charities report having cyber security breaches or attacks in the last 12 months”, we should not be overlooking that to be forewarned is to be forearmed when it comes to your cyber security strategy.

Any cyber security strategy, to be as strong as it can be, should involve a combination of technical, people and process elements.

Cyber criminals are always looking at ways to overcome technical solutions, which will never be 100% infallible, and they have the time to dedicate towards finding ways to bypass them.    Phishing campaigns are becoming more sophisticated and harder to spot and even target companies at times they consider peoples guard will be down the most.  Add to this that we see more and more that the technology side of an organisation is people dependent, as alerts need to be responded to, updates need to be made and the right questions need to be asked if people are unsure of something.

Although not glamorous at first thought, security processes and policies are arguably the bedrock of your cyber security strategy.  They outline the organisational standards for the controls you put around the confidentiality, integrity and availability of data, and can also help employees know what to do under certain situations to further minimise risk.  This element of your strategy is also ultimately about people and how they understand, implement, follow and respond to any security related process or policy requirements.

Now above I said “arguably” as we often hear that people are seen as a key problem when it comes to cyber security.  At CyberScale,  we prefer to see people as a potential strength and central to any robust cyber security strategy.  So, what is the bedrock?…Educating staff about what to look out for, why they should/shouldn’t do something, and what to do if something does happen is paramount to a company’s defence against cybercrime.

Whatever your organisation is handling in terms of data or sensitive information, the importance of awareness across the organisation cannot be underestimated as this can and will ensure a more vigilant workforce.   One simple error can lead to catastrophic effects for the smallest or largest of organisation.  The sooner a mistake can be identified the better the chance of the company recovering quickly and minimizing the damage. Without awareness and emotional investment from employees, security will be forever seen as that mundane or intimidating topic that people will generally avoid.

Having your cyber security strategy clearly defined and accessible will also ensure that you are able to increase customer confidence and compliance with their (and your) supply chain requirements.

So what are we really talking about here?  We are talking about building a culture of security within your organisation, a key element of which is investing in cyber security training for your staff.  Depending on where you are on your cyber maturity journey cyber security training will often begin as non-technical, tailored to the teams and their needs, and will always be developed to be made understandable and accessible.

Mistakes made by people can lead to cyber security breaches so placing staff training at the centre will go some way to mitigating this.  Greater awareness can lead to overall improvements in defences especially against the most commonly used tactics such as phishing.  Building a culture where security is easy to talk about will reap rewards in terms of not only what is prevented but also how your organisation reacts as and when any cyber-attack happens.

By personalising your cyber security training, making it mandatory and part of staff onboarding, keeping it updated and on repeat to ensure everyone is kept abreast of the ever-changing landscape, all goes towards keeping the topic alive within the business.  As change involves asking people to do something, they need to feel supported in this.

We believe that with face-to-face training, we can provide context and that human perspective on why security not only matters at a business level, but at a personal level in this changing landscape.   People should be at the front and centre of security, they can spot a suspicious email, they can report if something doesn’t seem normal about their computer, they are the first line of defence and that should never be overlooked.  We can also deliver remote sessions providing the same quality and value which are more accessible for people who can’t travel or are not comfortable with in person training.

So what now? Don’t sit on what you now know, make sure you talk to the relevant people in your organisation or reach out to us if that’s you and start building your cyber security strategy.