Contrary to popular opinion, cyber criminals don’t just target large corporations or vulnerable groups such as the elderly.  Many photographers – as I’m sure you know – are lone wolves, fighting to make a living in a competitive market. Sadly, even lone wolves are still very much at risk of a cyber-attack. 

In this article, we make some very broad assumptions about what IT is required for a typical photographer, we then discuss each assumption further, in terms of potential mitigations we can all implement. 

These assumptions may not apply to you, but hopefully you may get a few tips nonetheless.

IT Equipment 

Assumption? 

Most photographers will not have formal IT equipment such as servers, but are more likely to operate from singular devices, such as Macbooks and laptops. 

Mitigation

Whilst you may not have servers, you can still take steps to protect singular devices. As a minimum we would recommend the following:

• Always update software as recommended by the manufacturer. The software updated will contain patches. Patches block any discovered weaknesses which can be exploited by IT criminals 
• Install a high-quality antivirus software, ideally business quality if you can afford it, if not many personal antivirus packages are cost effective and will certainly help

IT Infrastructure

Assumption? 

Most photographers won’t have a formal IT network which is shared, like a larger organisation might. Instead, photographers are using the cloud like any other business, with most using infrastructure such as WeTransfer, Google Cloud, Microsoft Azure, Dropbox etc. 

Mitigation

All the large providers such as Google and Microsoft will allow you to enable multi factor authentication. This is crucial and will increase the security significantly.

If you have assistants or clients that access your cloud, make sure they enable multi factor authentication.

Emails

Assumption? 

You’ll have an email account, perhaps your own domain. That may be linked to Office 365, or you may utilise a provider such as Gmail. 

Mitigation

All large email providers will have multi factor authentication capabilities, but it’s unlikely to be the default. Proactively enable this, and ensure any of your assistants and employees do the same. 

Encryption

Assumption?

Photographers may not know what encryption is or whether it applies to your devices, but you will have sensitive data, and images on your devices. 

Mitigation

Most Windows or Apple devices can be encrypted and password protected. As a minimum all laptops should be password protected, this should be easy to implement.
For Windows devices, it’s possible to enable what is called BitLocker, which is a form of encryption. Apple devices have what is known as Firevault.

Research these and enable these forms of encryption, it will prevent lawsuits from clients if you devices are stolen, as hopefully criminals will not be able to access the data (which may be sensitive to your clients and brands).  

Cyber training

Assumption?

You will not have a formal IT security training programme. You as the photographer are responsible for your own knowledge. 

Mitigation

There are many free courses available online, and most banks now offer basic cyber awareness training. Giving up an hour of your time to do this could save you a lot of stress and worry.

Most cyber claims are linked to what insurers call “employee error”. Clicking a bad link, opening a corrupted file or email which allows cyber criminals access to your systems. These courses will raise your awareness and certainly reduce the likelihood of you making such errors.

Websites 

Assumption?

You may have your own website, which you advertise your work. 

Mitigation

Ensure that your website is kept updated with the latest software and plug in updates. If you have access to the back end of your website, again be sure the enable multi factor authentication. 

Social Media

Assumption?

You use social media to communicate and advertise to your clients

Mitigation

It’s now possible to enable multi factor authentication on all major social media accounts

Banking

Assumption?

Like larger businesses, photographers will have a bank be it a personal one or a small business bank account. This is used to pay invoices and receive money from clients. 

Mitigation

There are simple procedures for organisations of all sizes to prevent what is called ‘fund transfer fraud’. Do not assume an invoice you receive is from the intended party. Your suppliers’ email may have been hacked and the bank details on that invoice changed to those of a criminal.  

If you have NOT paid a new supplier before, manually check the bank details by calling your point of contact to verify the bank details. Don’t call the phone number on the invoice, call a number that you normally use to communicate with that supplier. Even the largest organisations in the world follow this process to prevent funds being directed to criminals.

Insurance

Assumption?

You won’t have a large IT or cyber insurance budget.

Mitigation

That doesn’t mean you should negate insurance, there are new insurance providers that offer high quality cyber insurance for sole traders starting at £100.

Plus many insurers will provide guidance and help to prevent you being hacked.