Cyber Awareness Training

Cyber Awareness Training Data Breaches and their consequences General Security Issues Risk Analysis and Security Strategy

Cyber Security Benchmarking

As long as I’ve been in this industry, clients have always had a thing about benchmarking, particularly those in the higher echelons, who are naturally driven by maturity, budgets, and the frequency of cyber breaches in their industry.  It’s often how they decide their spend.  Fair enough.  In the SME world it’s perhaps not that formalised but is still a thing.  An SME owner wants to know what other people are doing to try and gauge what they should be doing.

I talked, in a post last week, about conformational bias, which is a posh way of talking about the herd mentality and benchmarking falls loosely into that bracket.  What we’re actually talking about is the need for reassurance, deflecting plain discomfort, around the proposal to spend money on something that often seems a little esoteric to many.

Of course, not every situation, or every company is the same.  Their cyber maturity and risk appetite will often drive different approaches to a similar problem.  One company might have a heavy focus on data protection.  For example, an accountancy firm, a solicitors, even an estate agency, might assess that a serious data breach involving the Information Commissioner, could, potentially, put them out of business and they would therefore make this a number one risk.  On the other hand, a manufacturing company may consider this a risk, but of less importance than say, their designs for their next improvement to their product line.

So how good is a benchmark?  Well, it’s a guide, but that’s all it is, and you might think that if you’re close-ish to that guide, and you have an understanding about why you’re not closer, then that is probably OK.  What I’m saying is, don’t take an industry benchmark to be gospel, it isn’t, and basing decisions on what is essentially anecdotal evidence, isn’t, in my opinion, a very good basis for making that decision.

This is where building relationships with suppliers is essential for an SME.  Trust must be established, especially when dipping your toe in to the murky depths of cyber security.  Let’s face it, most people don’t understand it and people don’t trust what they don’t understand.  Finding a cyber security company that is happy to work with SMEs is not easy, especially one that isn’t wedded to technology as being the only answer to a problem.  Process and procedure can be just as effective as technology in certain circumstances and of course, is much much cheaper.  And let’s not forget cyber awareness training, still the cheapest quick win any SME can take to offset the risk of a data breach or scam.

All this is easy to say, but just how do you find a cyber security company you can trust?  I vaguely remember hearing the saying that you have to kiss a lot of frogs before you find your prince.  But in this case, you can’t afford to do that.  Time is not on your side but in doing your due diligence, you still need to be cautious.

What are you looking for?  I would suggest:

  • Proven track record.  Look into the past of the ownership of the company, not just the employees. 
  • Their approach.  Do they lead with technology?  If they do, walk away.  Do they take a risk managed approach?  That’s what you’re looking for.
  • Do they talk in jargon, trying to baffle you with science?  If they do, walk away.  This subject can be explained without getting into technicalities.  You want something that addresses threats to your business, and they should demonstrate they understand that.
  • Do they talk about the FUD factor. Fear, uncertainty and doubt. What they’re trying to do is to scare you into buying. Giving you the facts is one thing, FUD is completely different.
  • Have they taken the time to fully understand what your business is about, what it is that drives your revenue, what is important to you and what is not so important?
  • Do they see you as a long term partner or a quick revenue win?  Can be difficult to assess but it is crucial to building the trust I talked about earlier.

Of course, this is not an exhaustive list of criteria, and you’ll almost certainly have things you want to add, and maybe things you will discard.  But whatever route you take to build that trust, it is essential to your protection and peace of mind in what is becoming a very dangerous online world.

Cyber Awareness Training General Security Issues Identity and Access Management Ransomware, Phishing and other Malware Security Tools

Is Cyber Security making the grade for Small to Medium Enterprises?

I’ve touched on this subject several times in the past but was encouraged to revisit it after reading a book by Jean-Christophe Gaillard entitled The Cyber Security Spiral of Failure.  A provocative title and of course, the subject matter was aimed at the corporate sector.  But my view is the difference between the 2 sectors, in terms of solutions is often one of scale, with corporations being more complex and faced with many problems that the SME sector doesn’t.  They do however have the same threats and consequences of failure, as each other.

The author argues that for a couple of decades now, many organisations have been trapped in this spiral of failure, driven by endemic business short termism and the box-ticking culture of many executives in regard to compliance.  This really does resonate in the SME world with short termism often driven by financial necessity and especially during and since COVID, where survival was paramount, often requiring day to day management.  Of course, no SME owner or manager likes that and would love to have a solid and well-funded plan going forward, if only! 

Successful transformation takes time and often requires changing the culture of the organisation, and this at a time when many owners are struggling with the emerging business practices of a more distributed work force, following the pandemic.  Coming up with any transformative planning around IT naturally comes below that required for the business in general.  Bottom line is often that if it isn’t our core business, it can wait.  Even though of course, there are very few businesses that can continue to operate efficiently without their IT systems.

Which brings us to compliance.  For most SMEs compliance often means data protection, although there are the financial services regulations, and many do have industry standards governing IT and data, that they must comply with.  This often means that owners and managers undertake quick wins using box-ticking measures which often come a cropper sooner or later.

The book quotes from the BT Security survey released in January 2022.  One aspect which I fully agree with is the emphasis on getting security basics right and the importance of awareness development amongst employees.  Getting this right and training our employees are essential pillars of any cyber security practice, so as the book says, the question remains, why are we still banging on about it? – and everyone who reads my stuff knows I do that a lot.

There are a lot of traditional good security practices which have been pushed and re-emphasised time and time again.  Patch management, access management, anti-virus/malware, firewalls etc, and from my time working in the corporate space, I know that large enterprises have spent millions on traditional areas of cyber security over the last 2 decades.

But are we really still stuck there, entrenched in traditional thinking when our working practices are changing, technology is changing, compliance requirements are changing?

SME management is often completely left behind by these changes.  They have enough problems just keeping their businesses afloat and trying to grow, they don’t have enough time or resource to keep abreast of these many and varied issues.  Let’s face it, if corporate management is struggling with this changing landscape given their resources, what hope for the SME.

More than half (54%) of SMEs in the UK had experienced some form of cyber-attack in 2022 (stats for 2023 are starting to trickle through), up from 39% in 2020 (Vodafone Study, 2022).  As we travel around and visits clients or potential clients, it is common to find that they have the view that adequate security is provided by technology.  They rely on their IT provider to provide the guidance they need which tends to involve firewalls, anti-malware software and perhaps a backup regime.  All well and dandy.  A quote from Bruce Schneier, Fellow at the Berkman Center for Internet & Society at Harvard Law School, goes like this:

‘If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology’. 

So, what does he mean?  As he’s not here to ask I suggest that he’s saying is that essentially the technology available can be an essential part of your protection but it has to be targeted in the right way, which not only means you have the right piece of kit doing the right thing, but that you are targeting your IT spend to support your business goals and give a maximum return on investment (ROI).  It should also be married to good policies and processes that are enforceable and auditable and fully understood by your work force.  To do this you have to understand exactly what your risks, vulnerabilities and threats are to ensure that your solution to those risks, vulnerabilities, and threats, is targeted for maximum effect and ROI and that the technology is supporting the policies and processes, all of which is underpinned with good security awareness training.

But now we have the ‘new normal’ with many businesses enjoying the financial bonus of having a smaller office footprint whilst many people work remotely, bringing with it an increase in security problems.  Earlier we mentioned traditional security solutions that have been around for a long time, most of which pre-date the pandemic and were based on the old bastion security methodology ie a network perimeter, protected with traditional solutions.  But that bastion model no longer exists in many places, or if it does, it only protects half the workforce in the office, whilst the other half work remotely.  What is needed is new solutions that protect your staff wherever they might be working from.

Luckily for you, we have such a solution.

Cyber Awareness Training General Security Issues Identity and Access Management Risk Analysis and Security Strategy

A Company’s Tale – From COVID to Hybrid – Part 2

In last weeks blog we talked about a company that was forced, by COVID restrictions, to move to working from home, and how that affected the organisations’ structure and ability to continue in business, and some of the difficulties they faced. 

We reached a point where they had started to get back into the office but had decided to adopt the hybrid method of working, saving money on floor space, fuel and light etc.  But this has come with problems of its own which we’ll look at now.

Hybrid working is something that many SMEs like because of the cost savings, providing of course that the business doesn’t require people on site, such as manufacturing, transport etc.  Company’s such as lawyers, financial advisors/accountants, HR facilitators, recruiters and the like, can support hybrid working quite easily, from an operational standpoint.

Last week we saw that the 2 partners are aware that they hold a growing amount of personal and corporate data, not just about their own staff and systems but also about their clients.  They were also aware of the Data Protection Act 2018 and GDPR but at a very surface level and were not sure about how much this will affect them.  For example, in terms of policies, they have very little that references the DPA 2018 and/or GDPR.  Their website does not contain the necessary privacy statement or statements regarding the use of Cookies.  They don’t have an overarching security policy or a cyber security strategy in place.

So, what’s are the issues arising from last paragraph?  Well, the DPA 2018, or UK GDPR as it’s becoming colloquially known, requires that data is processed and stored securely and that managers and staff are aware of the regulations regarding the safe processing and storage of information, which are quite extensive and can be daunting, but needn’t be an issue for SMEs, if not ignored.  The ICO is, in my experience, very helpful in this regard and are not there to hand out heavy fines, threatening to put you out of business. If you can demonstrate that you have done your very best to obey the law, then they will be helpful and conciliatory.  On the other hand, if you’ve been neglectful and even a little cavalier about it, then not so much.

But getting back to the case in point, these guys were now at the juncture where they had their staff working from home for about 3 days a week, and coming into the office on 2 days, unless of course they were consultants who were visiting client sites and were working on the move.  Everyone now had a company laptop, including admin staff, and data was held on the cloud.

But what didn’t they have, and how would that affect the?  Well, firstly they didn’t have a cyber security strategy in place.  So, what is a cyber security strategy?    It’s a plan that outlines an organisation’s approach to protecting its digitally held assets and information from cyber threats. This strategy typically includes policies, procedures, technologies, and practices that are designed to prevent, detect, respond to, and recover from cyber-attacks.  People, Process and Technology combined and integrated to provide protection.

This needn’t be scary, and you can pick and choose what is important to your organisation, what needs to be comprehensive, and what can be less so.  The level of risk you are prepared to take, is entirely your call.  Key components might include:

  • Risk assessment: Identifying and prioritizing potential threats and vulnerabilities to the organization’s systems and data.
  • Security controls: Implementing technical and procedural measures to protect against cyber threats, such as firewalls, encryption, access controls, and employee training.
  • Incident response plan: Establishing protocols for responding to and recovering from security incidents, including communication plans, containment strategies, and forensic analysis.
  • Continuous monitoring: Monitoring systems and networks for suspicious activity or anomalies that could indicate a security breach.
  • Compliance management: Ensuring that the organization complies with relevant laws, regulations, and industry standards related to data protection and privacy.

What the management is doing here, is laying down a framework for how things need to be developed.  It doesn’t need to happen all at once,

Not having formulated a strategy, the company didn’t have much of this in place, and what it did have wasn’t well structured and integrated.  The security products in use were stand alone, working independently of each other.  Another major flaw was that they had no cyber awareness training in place, neither did they have effective policies.  Those that they had were downloaded from the internet as a box ticking exercise.  They were in fact a cyber disaster looking for somewhere to happen.

The 2 partners were aware of these issues and yes, they took some time to get around to addressing them simply because recovering the business from the issues arising from COVID, took precedence.  But they realised that this couldn’t be put off for any longer and took action.

They engaged with us to first carry out a Cyber Maturity Assessment.  This covered:

  • Cyber Security Strategy.
  • Cyber Security and Data Protection policies.
  • Protective monitoring and vulnerability assessment.
  • Incident response and business continuity planning.
  • Access control.
  • Employee awareness training.
  • Compliance.
  • Technical Security

The strategy they needed could be very much simplified to meet their requirements, but it did cover the salient points and gave a clear indication of what was needed immediately, what could follow and what was more of a nice to have rather than a necessity.  To that end we were able to structure remediation that was phased over a number of months, covering 2 budgetary periods.

End result, they had a solution that was affordable as well as appropriate to them.  It covered staff in the office, working from home and on the move.  It kept them compliant with the relevant legislation and set them up to achieve a standard such as Cyber Essentials, which is next on their list.  If necessary, they could even go as far as ISO2700x series, although that might not be appropriate for them at their current size.

Cyber Awareness Training General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy

Cyber Security Policies – A Must Have or a Nice to Have

How important are policies and processes in comparison with technology, when it comes to Cyber Security and its sister discipline, data protection.  The clue is that in Cyber Security we refer to People, Process and Technology, in that order.

Top of this list is People, and I’ve written extensively about how important cyber awareness training is for all, managers and employees alike.  This piece is all about policies and processes.  First and foremost, policies have to be relevant to the organisation and not just downloaded from the internet, maybe with a few modifications, before applying a tick in the box and moving on.  Policies have to mean something and have a purpose.  Many organisations I go to either have some very scant policies or actually, none at all.

I often talk about risk in terms of cyber security and how managing that risk is extremely important.  And that means understanding what those risks actually are, and then taking steps to mitigate them.  When I talk about this, I can often see the wheels turning and the audience thinking technology and how much is that going to cost them.  Well, it’s very often the case that technology is not the answer.  There are many risks where a good policy, promulgated to, and understood by all, can save the company money.

A good example of that is a fairly common scam that tends to costs SMEs between 5 and 50K depending upon the size of business.  How this is achieved is that the scammer or let’s call him/her what he/she is, the criminal, spends some time profiling the company, using various social engineering techniques to work out how the company is organised and who is who.  You may be surprised as to how much of that information is freely available on the company website, companies house and other sources. Having discovered who the boss is, and who looks after invoice payments, the criminal then ‘spoofs’ the bosses email.  Email spoofing, in simple terms, is sending an email purporting to come from someone else.  So, it arrives purporting to come from the boss, but actually it’s from the scammer.  Such an email is sent to the person who pays invoices, with an invoice attached, saying please pay this as a matter of urgency.  This happened recently to someone I know, and when it arrived in the accounts department it didn’t look cosher to the payments clerk, who replied to the email asking if the boss was sure.  Of course, she got an email back saying yes, I’m sure.  She paid it and the company lost over 30K.  The accounts clerk was clearly switched on but she made a basic error, because she didn’t know any different.  If she had sent a fresh email to the boss querying the invoice, it would have gone to the boss who could have stopped the transaction.  Instead, she replied to the email and her reply went back to the scammer.  A policy which dictates fresh emails rather than using the reply function, and known to all, would have saved the company a lot of money.

Policies and attendant processes are essential for the protection of company data and the bottom line, company money.  What needs to be covered and in what depth, depends on the risks that the company is facing, and will differ company to company depending on its type.  In broad terms, and as an absolute minimum, the following are required:

  • Overarching IT security policy – often this only needs to say very clearly what responsibilities employees have in regard to security and data protection, lay down a requirement and responsibility for cyber awareness training, and state that all employees are to be cognisant of all the policies and are to sign that they have read and understood them.  And most importantly, it must be signed off at board level making it clear that this is a crucial requirement.
  • IT Acceptable Use Policy – what is, and what is not, an acceptable use for company IT.
  • IT Email Policy
  • IT password policy
  • IT Mobile working policy – essential for mobile workers who may be tempted to work from a coffee shop, and of course, working from home.  This latter might be a separate policy or can be part of the mobile working policy.
  • Data Protection Policies – a whole other subject.
  • Social media policy – this can be really important.  Probably 100% of your employees will have a social media presence and will use it daily. How important is it that they don’t associate themselves with the company on their private social media?  Depends on the person but it could be damaging in reputational terms.  The company might also do some digital marketing on social media.  Who is, and who is not, allowed to get involved with that function.

This is not an exhaustive list.  It depends very much on risks that needs mitigating.  They will also be accompanied by processes to support the policy.

Does this resonate with you.  If you’d like to know more, we’d like to help.

Cyber Awareness Training Data Breaches and their consequences General Security Issues Ransomware, Phishing and other Malware Supply Chain Security

Another Tilt at AI

At the risk of boring you about the risks inherent in AI, I’m going to have another go, simply because it’s a fascinating subject.  AI can really become the gift that keeps on giving.  We’ve always played catch up to the cyber criminals, trying and often failing to anticipate what the next attack will be, what the next series of attacks will be.  Will it be ransomware, denial of service or perhaps a new and more sophisticated scam?  Who knows?  But there is no doubt that AI is raising the bar.

I have talked a lot about the re-emergence of the script kiddie and how AI in enabling this particular breed of wannabe criminals.  But it’s also true that the more skilled and sophisticated criminal is making use of AI and finding new and innovative ways of relieving you of your hard earned cash.

There is a lot going around within the IT and cyber industry about the ethical usage of AI, its ethical development, and that IT system integrators have a cast of thousands working on such ethical development and usage.  Fine, I applaud them.  But what does that mean for cyber security, and indeed data protection?  Well, I have to say, in my humble opinion, not a great deal.  I say that simple because no matter how ethical we are, the criminal doesn’t give a damn, he or she will continue on their own sweet way and do what criminals have always done, which is to completely disregard ethics.  So, whilst we can applaud and support those companies who are producing software and systems which use AI ethically, for the good, but just like old times, the criminals will do their own thing.

So, let’s take a look at some of what is at risk in terms of our data and systems:

  1. Data Protection.  AI systems tend to be extremely good at analysing, organising, and harvesting vast amounts of data, raising concerns about privacy breaches and unauthorized access to sensitive information.  A good AI powered attack could capture huge amounts of personally identifiable information (PII), in a ridiculously short amount of time.
  • Data Integrity.  In the good old days (please indulge me – I’ve been around a long time), we used to talk about CIA, no, not the infamous US intelligence agency, but Confidentiality, Integrity, and Availability.  We now have something we call the Adversarial Attack.  This is where attackers can manipulate AI algorithms by feeding them misleading data, causing them to make incorrect predictions or classifications, in turn destroying the integrity of your data, not just rendering it useless, but dangerous.
  • Model Vulnerabilities.  This next one is relatively new, at least to me, and as I never tire of saying, I’ve been this game as long as there’s been a game.  It’s something call Model Vulnerabilities.  AI models can be vulnerable to exploitation, such as through model inversion attacks or model extraction, where attackers can reverse-engineer proprietary models.  So, if you’re in the dev game, this is a very real nightmare.
  • Bias and Fairness.  AI systems may inherit biases from training data, leading to unfair or discriminatory outcomes, which can have legal, ethical, and reputational implications.  This could be used as another form of extortion, playing with the integrity of your data, to the point where you can no longer trust it.
  • Malicious Actors.  These can compromise AI systems at various stages of development, deployment, or maintenance, posing risks to organisations relying on these systems.  This has a play in supply chain security.
  • Attackers can leverage AI techniques to enhance the effectiveness of cyberattacks, such as automated spear-phishing, credential stuffing, or malware detection evasion.

Addressing these risks requires a multi-faceted approach, including robust security measures, thorough testing, ongoing monitoring, and regular updates to mitigate emerging threats.

The real danger is complacency.  AI isn’t a future hypothetical threat but is very real and here now, already making itself felt, for both good and bad.

Cyber Awareness Training Data Breaches and their consequences General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy

Scams v Hacks – how does this effect SMEs?

When I speak to SMEs, I make the point that the chances of being ‘hacked’ is relatively low when compared with being scammed.  Why?  In my view, I look at a hack as being a technical attack on a target by someone who is technically savvy and skilled in identifying and exploiting weaknesses in a company’s defence.  A scam on the other hand can be perpetrated by people with relatively low levels of technical ability and scams are in fact, a con, just like any other old fashioned con, in that they get the target to agree to, or to do something, that will benefit the con artist.

We always recommend that our clients try as best as they can to have defence in depth.  That’s an old military term which is often used in cyber security now to describe multiple layers of defence.  This can be expensive though and it must be tempered by budget, targeting controls where they are most needed.  What this does is to deter many attackers who are looking for a quick win, so if they have to work long and hard to break in, they’ll often go elsewhere, where the pickings might be easier.  And of course, whilst an SMEs defence might be somewhat less than those of an enterprise organisation, the pickings are likewise smaller, making it not cost effective for the attacker to take too much time with a technical hack.

Does this make scams much more attractive to the criminal?  Yes, I believe it does, simply because the amount of effort required is low and they are skilled in manipulating people, especially those that have had minimal cyber awareness training.  Scamming, just like hacking is generally preceded by some form of social engineering.  Social engineering refers to techniques aimed at talking a target into revealing specific information or performing a specific action for illegitimate reasons.  So, whilst a hacker modifies a computer’s software and hardware structure to carry out certain tasks, social engineering uses people as weapons to attack selected targets. In this way the manipulation is accomplished by employing trust through different forms of communication.

Typically, social engineering is achieved via Phishing, Vishing (video), Smishing (via SMS), malware and Spear phishing where the targets are selected for their importance to a specific attack.  Whatever method is used the aim remains the same, it is to persuade the unwary to give up sensitive information, install malicious software or do things that compromise your business security.  The best protection against social engineering remains a work force that are aware of the techniques and dangers posed by this.

What is the cost of scams to the across the globe?  One statistic suggests that public sector fraud losses amount to about £50.2 billion whilst frauds committed directly against individuals, including marketing fraud and identity fraud, is around £8.3 billion. The total cost of fraud has risen from about £190 billion in 2017 to almost £219 billion.  (Source Peters, Peters and Crowe). Of course, not all of this is via online fraud, but it is becoming the most common type of scam we see today.

Some of the most common types of scams that we see include, but are not limited to:

  • Copycat government websites. Some scams involve websites designed to look like official government websites such as HMRC. …
  • Dating and romance scams. …
  • Holiday frauds. …
  • Mandate fraud. …
  • Pharming. …
  • Phishing emails.

I received an email only yesterday purporting to come from someone called, and I kid you not, Lisa Monaa, inviting me to partake in an extremely profitable project, and I just couldn’t bring myself to read anymore.  It was a badly written phishing email with little chance of success.

AI is having an effect as well.  I’ve written earlier about the CEO scam whereby a CEOs email is spoofed and sent to an accounts department with an invoice attach, stating that the CEO has received a complaint from a supplier that their invoice is late and to get it paid without delay.  That scam has now been updated to a voice simulated by AI, over the phone, demanding the same.

Whilst that scam is quite old, it shows how social engineering has a play.  Firstly, they have to find out what the CEOs email is.  Not difficult.  The company’s email form will almost certainly be shown on their website with a contact like sales@abc.com.  So, the attacker knows that the suffix is abc.com.  They may well also be able to get the CEOs name from the website or even Company’s House.  Next send an email to JSmith@abc.com.  If that bounces send it to John.Smith@abc.com and so on until it goes through.  Next phone the accounts department, ask for Mary in accounts payable.  No Mary here I’m afraid.  Oh sorry, I was sure it was Mary, who handles accounts payable then, Oh that’s Julie.  So, he now has CEOs email and someone to send the email to.  That would probably take about 30 minutes of the scammers time.

The impacts of scams can be very far reaching.  Firstly, there is financial loss, which to many SMEs operating on tight margins, can be quite devastating.  Then there is the possibility of data breach.  If you are a business with lots of client personal data, say a financial advisor, a lawyer, an estate agent, pharmacist, you get the drift, and the aim was to steal data, then you could be hit with a substantial fine from the Information Commissioner not to mention lawsuits from those whose data has been stolen.  Reputational damage can be disastrous and then there is the effect on staff who can suffer greatly thinking they have damaged the company and put everyones job at risk.

Bottom line – scamming is endemic, it’s going nowhere, and AI is going to make it more prevalent, not less.  SMEs spend far less on their defences and on cyber awareness training making them more likely to be targeted.  Combating this threat should be high on your to do list.

Cyber Awareness Training Data Breaches and their consequences General Security Issues Identity and Access Management Ransomware, Phishing and other Malware

A Tale of Two Company’s

These stories are fictitious but are based on real events with the company names, locations, and industry vertical either changed or obscured.

Company One

ABC Ltd is a chain of financial advisors which has seen strong growth even allowing for the hiccup of the COVID lockdowns.  It has grown from one site nearly 20 years ago, to six sites situated in rural market towns in the East of England.  As with nearly everyone else, COVID has significantly changed the way they operate as they were forced into home working and never went back to being fully office based and are now operating a more distributed hybrid working pattern, with staff working between offices and home.  This hasn’t proven to be an issue and has some financial benefits, reducing the office footprint, fuel and light and travel costs.  Their clients, consisting of local businesses mainly but with a significant department looking after individuals, have not been impacted by these changes.

John is the finance director, and he was given the additional responsibility for IT, something not unusual in SMEs, as they can rarely afford their own in house IT experts.  This has led to John outsourcing the IT to a local IT management company and so far, they have had no complaints.  Although John doesn’t profess to have any in depth IT knowledge, he discussed their requirements in detail and accepted that a move away from onsite servers and storage to a cloud based system made perfect sense and lent itself to the distributed network they now operated.

However, he had some concerns around cyber security.  He read a lot and what he read worried him, particularly about things such as ransomware, phishing, social engineering and scamming.  He knew that they held considerable amounts of personally identifiable information (PII) as defined by the Data Protection Act or UK GDPR as it is becoming known, and he had heard horror stories of company’s being fined a lot of cash for losing that data.  So, John decided to bring to bring this up at a board meeting and was met with some resistance from the CEO and other board members.  They asked what advice he was getting from their IT providers, and he said not a lot.  They seemed to be happy with the defences in place, which relied on firewalls in the office, and personal firewalls on remote laptops and desktops, anti-virus software and secure channels for sending data to and from the cloud storage.  The cloud provider operated under Ts&Cs which seemed to ensure that they took responsibility for the secure storage of their data.  He was concerned that not all their data was stored on the cloud, even though it was supposed to be.  He knew that staff working from home downloaded data onto their laptops, worked on it, and then uploaded it.  He was sure they ever deleted the copy they had on their laptops and had no way of checking.  He was also sure that data was attached to emails and sent around, so there would be copies on the email server, and on email clients.  But he was told to forget about it as it wasn’t a priority for funding. 

Jumping forward a couple of months and staff were panicking, and his phone was ringing off the hook as IT user after user was seeing a red text box sporting a skull and crossbones and the message that their data was encrypted, and if they wanted to unencrypt it, it would cost £50,000.  The CEO convened an emergency board meeting, and the IT provider was dragged in.  It didn’t take long to ascertain that this was a sophisticated attack and when they attempted to access their cloud storage, they found that the data held there, was also affected.

The CEO asked the IT provider how long this would take to fix, if indeed it was fixable.  He replied that they did have two sources of backups of the data, online and offline.  The problem was that the online data could also be affected and so the safest recourse was the offline backup, but that was only done weekly and therefore they would lose at least 3 days’ worth of data.  The CEO was not pleased.  Added to this, John wasn’t happy with just fixing the immediate issue, he wanted to get to the bottom of how this happened and how can they stop it in the future.  He contacted a specialist cyber security company that was fairly local to them.  Modesty forbids me to mention their name.

Once onsite they identified that there needs to be two strands to this.  First and foremost, the company needs to be gotten up and running, which means restoring from backup.  But there is no point doing that if the ransomware is still sitting on their systems because it would merely encrypt the backup.  It’s never that easy.  How did the ransomware get on the systems, how deeply is it embedded, how did it get on the cloud storage etc.  How it got there was quite easily detected.  It was simple email scam sent to around half of their workforce, at least two of whom clicked on it.  Once that was done it spread itself around the system, infecting all connected machines, and easily jumped to the cloud storage and even the online backup, which was connected to the cloud storage itself.

From then it was a simple but painful exercise which took best part of a week to sort out.  In order to be safe and thorough, all machines were wiped, including the operating systems, and then the OS reinstalled, along with all the applications.  Meanwhile they worked with the cloud storage provider, who was cooperative, to clean up their servers.  The data was then installed from the offline backup.

It was estimated that they lost money well into 6 figures, including fixing the problem, and lost business whilst it was all sorted out.  Trying to get back the 3 days’ worth of data lost, was embarrassing.  But at least they didn’t cave in to extortion as some might have, as we’ll see below.  Luckily there was no indication of a data breach which sometimes accompanies ransomware attacks, so no involvement of the Information Commissioner and the embarrassment of having to contact clients about their personal information.  It could have been worse.

Recommendations asked for by the board included:

  • Cyber Security Awareness training for all staff, including induction and 6 monthly refreshers.
  • Revisit the anti-virus/malware in use to see if there is a better solution for ransomware.
  • Revisit protections for the data itself.  Do they know where it all is?  Can it be audited?  What about encrypting it themselves before anyone else can?  It might not protect against ransomware, but if a data breach happens, it will avoid ICO fines.
  • Revisit the backup routines.
  • Have a solid disaster recovery and business continuity plan to avoid ad hoc and inevitable knee jerk responses.
  • The ransomware code required privileged access to do the real damage.  It got it easily.  Revisit the privileged access management system in place.  Is it up to scratch?
  • Consider annual cyber security health checks.
  • Consider adhering to a standard such as Cyber Essentials or perhaps even ISO27000 series.

Company Two

Company Two was a transportation and storage company which operated from one site and its core business was transporting and storing produce before it was moved on to the consumer chain ie supermarkets and the like.  As such they had 3 large cold stores which were of course temperature controlled and any prolonged period without temperature control could cost the business thousands in a relatively short space of time.

The problem was that their security architecture was still based on the old bastion model of having a secure perimeter, protected by firewalls, but once inside, there was no segmentation, ie once in, the world was your oyster and the temperature control systems were on the same network as the other IT systems, with nothing separating them.

At this point the same thing happened to them, as happened to Company One.  They received the ransomware message which was even more damaging because it not only encrypted their data, but it knocked out the temperature control systems.  This meant a more sophisticated attack than just embedding malware in an email, the attackers must have gotten into the system and identified a serious weakness that they could exploit.

This wasn’t as difficult as it seemed.  There were several weaknesses in their defences.  First, they had changed broadband provider, but the old broadband connection was still active and connected to their network.  Second, they had security cameras which were remotely maintained.  These cameras were also on the main network and therefore there was a remote backdoor into the system.  There were other weaknesses, but these will do as explanations as to what happened.

As the gravity of the situation dawned on everyone, the decision was made to pay up and prevent a potential disaster in regard to the cold stores.  Understandable I suppose but ultimately not a good solution.  They did get back online within half a day.  So far so good.  But they wanted to make sure that this couldn’t happen again and so they called in some cyber experts to look things over.  What was discovered was quite horrifying.  Firstly, the attackers left a back door into the system which was discovered and closed down.  This would have allowed the attackers easy access to do it all again.  The issue with clicking on a dodgy link was also raised.  But the real problem was that it was discovered that the ransomware attack was used to also disguise the theft of data.  Missing was a considerable amount of financial information, including bank account details not just for them, but for their customers and suppliers, and PII relating to their customers and suppliers, but nothing too damaging other than business email and postal addresses.  Luckily their HR and payroll was outsourced and so they held very little about their staff.  Nevertheless, it was estimated that the cost of this breach would eventually reach 5 figures.

Lessons included very much the same as Company One but with the addition of having a security architecture review with the aim of tightening things up and introducing network segmentation.

Summary

  • Cyber security is a business issue not an IT issue.  It’s the business that suffers, not the IT support. 
  • Cyber Awareness training is the biggest and cheapest quick win that any company can take to protect itself.
  • Make sure your backups are adequate and up to date.
  • Make sure you have a disaster plan to recover from an attack.
  • Make sure you have a business continuity plan to continue working whist you recover from a disaster.
  • Make sure you privileged access management is adequate.
  • Make sure your anti-malware solution is the best available to protect against modern threats.
  • Don’t be complacent.  Just because your cloud provider is popular, doesn’t necessarily mean it’s up to par.
  • Don’t rely on firewalls alone, the bastion model of security is well out of date now.
  • Consider adhering to a standard such as Cyber Essentials or perhaps even ISO27000 series.
Cyber Awareness Training General Security Issues

What irritates SME Owners and Founders, when it comes to Cyber Security?

Ask that question amongst said SME Owners and Founders and I strongly suspect that you’ll get some differing answers, and possibly some colourful language.  But I also suspect that there will be several recurrent themes.  Chief amongst them will be that they feel they are being pressured into buying this or that solution and get inundated with sales emails.  The use of FUD, Fear Uncertainty and Doubt, is also a real irritant, and with good reason.  Keep crying wolf and the message starts to get samey and eventually ignored.  That of course is a big problem because regardless of the FUD, the dangers are very real.

I tend to come back again and again, probably boring the pants off people, with the argument that relying on your local IT provider to give you good advice and guidance on cyber security, is a major part of the problem.  They will almost always push the technical solution.  Their focus is on selling hardware and software, whereas cyber security is first and foremost a business issue, not an IT issue, and many of the protections needed revolve around people and process, not technology.  Pushing that thought though, is an anathema to the IT support company because, firstly, they don’t get it any more than you do, and secondly, it doesn’t sell licences.

Conversely though, an SME neither needs, not can afford, a full time cyber security professional on staff, and for that matter, neither can the IT support company.  So what’s the answer?  Now this is where I get accused of trying to sell in my services, rather than giving good advice.  I would counter that by saying that taking my services is taking good advice.  I can provide over 20 years of experience in cyber security to an SME, or indeed a startup, using a day or half day rate, and providing advice and guidance when it’s needed, without breaking the bank.

I usually start with telling the Board that SMEs should prioritise cyber security awareness training for all employees. This training should cover topics such as recognizing phishing emails, creating strong passwords, and safely using company resources etc.  Crafting a programme is not difficult and delivery can be automated, keeping time away from the day job to an absolute minimum.  Those that read my stuff regularly will no doubt not be at all surprised that I push this.  Cyber awareness training is the quickest win any SME can undertake, and it’s not expensive.

Keep in mind that a successful cyber attack can disrupt operations, compromise customer data, and lead to financial losses. For SMEs, which often rely heavily on customer trust and loyalty, a breach can tarnish their reputation and erode the confidence of existing and potential clients.

What most SMEs lack is the understanding that they have a responsibility for continuous improvement.  Having said that technology comes third after people and process, it is still extremely important when examining threats to the business from hacks and scams.  A business owner needs advice, guidance and recommendations for continuous improvement of the processes and solutions required to provide adequate defences.  How many SME owners have the time to keep up with the latest cyber threats?  How many have a good handle on the latest scams, an understanding of how well cyber criminals are getting to grips with AI and using it to create new attacks and scams, and to update existing ones.  Not many SME owners have that time to spare, if any.

How many SMEs can devise a cyber security strategy that provides not just the answer to the threats today, but can grow and flex with the business, taking into account the latest threat assessments?  For that matter, how many local IT support companies have the skill set to do that, and indeed, the inclination to do that?

Advice and guidance is needed to identify and prioritise security controls based on the specific needs of that particular SME, enabling them to allocate resources effectively and efficiently, in order to proactively and significantly reduce the risk of successful cyber attacks.

And very importantly this approach allows an SME to target their very limited spend on what the risk to the business actually is and to ensure that the protections being put in place are what is needed, and that it is giving value for money,

Cyber Awareness Training General Security Issues Identity and Access Management Ransomware, Phishing and other Malware Security

Artificial Intelligence – It’s here to stay

Artificial Intelligence is coming more and more to the front in the news, in just about all spheres of IT, no matter the vertical it serves. 

What exactly is AI?

Artificial intelligence (AI) describes computer systems which can perform tasks usually requiring human intelligence. This could include visual perception, speech recognition or translation between languages.

Of course, that’s not the only description you’ll find if you use your best research tool, Google, but it’s one used by the National Cyber Security Centre, so it’ll do for me.

I’m willing to bet that many of you, most of you, have some form of AI app downloaded on your devices.  ChatGPT is arguably the most popular amongst the general populace but it’s not the only game in town.  These apps are becoming more and more available and popular. ChatGPT is an artificial intelligence chatbot developed by OpenAI, a US tech startup. It’s based on GPT-3, a language model released in 2020 that uses deep learning to produce human-like text.  It has an underlying technology that has been around much longer, but this blog isn’t about the technicalities of AI, but more about how it affects SMEs as they go about their business.

I’ve been arguing that perhaps the biggest potential threat in terms of proliferation, ie the number of attacks waged at a relatively low level, aimed at quick wins in terms of scamming money, is the re-emergence of the script kiddie.  I wrote, some time ago, about how code could be written to be inserted into a Ransomware attack, quite easily, using AI. 

Script Kiddie

A script kiddie was what we called someone of relatively low skill levels who would go online to the dark web, and purchase scripts written by more advanced criminals that they had put up for sale.   The script kiddie would then use these scripts to mount an attack on a company or organisation.  These often failed because the script kiddie wasn’t all that bright, but just occasionally, they were harmful and even devastating.

Another scam, reported in The Washington Post, was an update on the very well reported CEO Scam, whereby someone impersonates the CEO of a company using spoofed email, but this time it’s using AI spoofing the CEOs voice, attempting to scam money from the company.  This one worked, and the company lost a lot of money.

So why am I bringing this up again so soon?  Well AI continues to be reported in the news, sometimes with a good result and sometimes not so good.  So, I thought I’d ask Chat GPT what it thought about AI and Cyber Security.  I asked 2 questions, the first was, ‘Is AI a danger in terms of Cybersecurity?’.  The answer came back:

Double Edged Sword

AI can be both a boon and a potential danger in terms of cybersecurity.  On one hand, AI can enhance cybersecurity by detecting and mitigating threats more efficiently, analysing vast amounts of data for anomalies, and automating certain security tasks.  On the other hand, AI can also pose risks if it falls into the wrong hands or is used maliciously.  Sophisticated AI powered attacks could exploit vulnerabilities, evade detection, or launch targeted attacks at an unprecedented scale.  It is crucial to develop robust safeguards ethical guidelines, and responsible AI practices to ensure AI remains a force for good in cybersecurity.

So even ChatGPT thinks this is a double edged sword.  The real problem for my target clientele, the SME space, is that affording AI powered tools to detect and mitigate threats and analyse large amount of data, will seemingly be too costly for them.  But as many defences use AI themselves now, it’s actually quite affordable.  So, when we are talking about developing robust safeguards, understanding the risks becomes even more vital, if that’s possible, than it ever has been before.  It also brings Zero Trust solutions sharply into focus and finding such solutions that are affordable, is going to become crucial.

The next question I asked was, ‘How do we ensure that AI isn’t a cybersecurity threat?’.  The answer came back:

Key Considerations

Ensuring that AI is not a cybersecurity threat requires a multi-faceted approach. Here are some key considerations:

1. Robust Security Measures: Implement strong security protocols, encryption, and access controls to safeguard AI systems and their underlying data from unauthorized access or manipulation.

2. Rigorous Testing and Validation: Thoroughly test and validate AI algorithms and models to identify and fix vulnerabilities, including potential avenues for cyberattacks, before deployment.

3. Adversarial Testing: Conduct adversarial testing to simulate potential attacks and evaluate the resilience of AI systems against different cybersecurity threats.

4. Data Privacy and Governance: Establish clear policies and practices for data privacy, ensuring that sensitive information is properly handled, stored, and shared in compliance with relevant regulations.

5. Ongoing Monitoring and Updates: Continuously monitor AI systems for potential security risks, promptly address vulnerabilities, and keep software and hardware up to date with the latest security patches.

6. Ethical AI Development: Integrate ethical considerations into the design and deployment of AI systems, emphasizing transparency, fairness, and accountability to mitigate potential biases or unintended consequences.

7. Collaboration and Information Sharing: Foster collaboration among industry, academia, and government entities to share knowledge, best practices, and emerging threats, enabling a collective effort to combat AI-related cybersecurity challenges.

8. Education and Awareness: Promote cybersecurity awareness and provide training to AI developers, users, and stakeholders, emphasizing responsible AI usage and the identification of potential threats.

By following these guidelines and continuously adapting to emerging risks, we can enhance the security of AI systems and minimize the potential for them to be exploited as cybersecurity threats.

Next Steps & Relevance

Again, looking at this from an SME perspective, some of it isn’t relevant i.e., No6 for example, SMEs aren’t going to be developing their own AI solutions.  And much of it I would have come up with on my own, without the aid of a machine.  It would appear that AI uses some common sense, which is nice.  No8 for example.  I bang on and on about this.  It is low cost and easy to implement.  It’s staggering how many companies don’t do this. This list also shows the value of Zero Trust solutions and encryption, which on its own, vastly reduces the risk to data, particularly PII (personal identifiable information – UK GDPR).

The argument then is that AI might encourage a proliferation of low level attacks, largely aimed at SMEs who generally have the lowest defences.  Quite low level criminals can utilise AI to carry out attacks that heretofore would have been beyond their skill level.  Common Cyber sense can go a long way to mitigating these attacks.  Technology evolves, attacks evolve, but the basic understanding of threat + vulnerability = risk, has never gone away.  Understand that and you stand a good chance of staying safe.

Cyber Awareness Training General Security Issues Risk Analysis and Security Strategy

Can a Board Advisor Help You Devise Your Cyber Security Strategy?

I’ve always dabbled in Board Advisory roles, even when working for major IT integrators, because consultancy at a senior level, often crosses that boundary.  The bigger companies will often value having independent advice, although I have found it’s not always welcomed by their in house IT/Cyber team, who can become quite defensive.  The more experienced of them do see the value, even if it’s only validating what they have already put forward as a solution to a particular problem.  And they often use a Board advisor to craft the boring bits, around strategy and policies.  And I’m OK with that.

When we set up H2 to service the SME sector, we naively thought that they’d welcome an advisor who could guide them through what can be a difficult minefield.  It was a bit of an eye opener that SMEs don’t see the value in this at all.  In fact, what they see is a drain on resources.  It’s a little strange because they are very happy to spend money on getting advice from their local IT company that supplies, and often manages, their IT infrastructure, but who are also focused of selling a product set, dressed up as a solution.  Now, I know that that will upset some IT providers and I’ll water my comments down a little by saying I’m referring to Cyber Security which is a distinct discipline which many nibble around the edges without any in depth knowledge or experience. 

So, what does a Board Advisor do? 

Board Advisors help to guide businesses but are not legally authorised to bind them. As companies establish themselves, moving from an idea to a fully structured and realised organisation, they typically prepare for full operation, sales, and/or fundraising, and in my case, Cyber Security.

As they begin these processes, experts in the field – including mentors or specialists brought into the organisation by a mentor – become hugely valuable as the organisation works to achieve its goals. Advisors are key assets, and it’s crucial to formalise exactly what they will provide, their availability, who they can introduce you to, and how much time they can give you – as well as how they will be compensated in exchange for these services.  A board advisor can help fill in any gaps in your team in terms of both experience and expertise. They can also help you bring in new team members and sometimes sources of funding as opportunities allow. Most crucially, they can do all of this while giving you time to think about what you need to be doing to grow your business, or just get it and keep it, running.

Board Advisors are also far more flexible, offering services either on an ongoing basis, in parallel to a Board of Directors, or as part of your transition into a formal, Board-run business.  In other words, they are not full time employees, but work on a part time basis where you pay them for their time, bounded as you see fit.

How does a board advisor add value?

In terms of cyber security, a Board Advisor is an experienced cyber security professional who provides advice and support to a business’s leadership without sitting on their Board. They provide counsel based on their prior experience in this field to help the Board make decisions, especially when faced with unfamiliar challenges.  And most challenges in the field of Cyber Security will be unfamiliar to them. 

When working as an advisor it is essential that we are excellent coaches and can demonstrate our deep knowledge of the subject.  We need to take both their board members, their in house IT teams and IT users, getting them onside and letting them know that we are there to enhance their knowledge and skills, we are not their enemies.  We must also be prepared to work with any IT company they may have under contract, although that can be a bigger challenge.

Summary

Having a Board Advisor who can mentor the leadership team and other employees, either on a retainer or paid for actually hours worked, can be a great boon for an SME.  Just having someone who can debunk the myths and devise strategy, training programmes and advise on cyber risk, is something that any SME management team should value.

Defend Your Business Against The Latest Cyber Threats

Please get in touch and a member of our team will be in touch with you soon to discuss your requirements.
CHAT WITH OUR TEAM
Phone

0845 5443742 / 0845 5443730

EMail

hello@hah2.co.uk

Address

57 High St
Somersham
Huntingdon
PE28 3JB

Privacy Policy
All rights reserved H2 CRAS 2023

Facebook-f Twitter Linkedin Envelope
Scroll to top