Month: October 2024

Cyber Awareness Training Data Breaches and their consequences General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security

What Do SME Owners and Directors Want From Cyber Security?

I wrote a post earlier this week exploring what SME owners and directors really care about when it comes to cyber security! Do they really care about the how the latest technological solutions work? Do they really care about the scare stories, or at least, do they really think that they apply to them. Oh, they might have a sneaky suspicion that it could be a problem but is it on their mind enough for them to do something about it.

The argument was made that this is especially true in an economic downturn when they are focused on costs, even more than they normally are. They want robust cyber security solutions that don’t cost an arm and a leg.  And what they don’t want is jargon and tech speak that they feel is aimed at bamboozling them with science in order to convince them they should buy something that they don’t actually need. 

We are believers that what is needed is simplicity. SMEs are looking for user-friendly security measures that don’t require a PhD in Cyber Science. They don’t want jargon or even industry metrics. Remember the KISS principle – Keep It Simple Stupid.

Of course they are going to have a focus, and you need to understand what is important to them and what isn’t. That will depend on the nature of their business to a great extent. Whilst there are commonalities regardless of the vertical they work in, there will always be differences, some big, some more subtle, that will impact any cyber security solutioning.

Nowadays many SMEs are increasingly aware of cybersecurity risks, but a significant number still underestimate the importance of cybersecurity risk management. SMEs often face unique challenges in this area due to limited resources, competing priorities, and often a lack of expertise not just in their organisation but also in the IT support company’s they use. Here are some insights into the current landscape:

  • Growing Awareness: SMEs have started to recognise that they are just as likely to be targeted by cyber threats as larger companies, partly due to high-profile ransomware attacks and data breaches affecting businesses of all sizes. As a result, awareness is rising, especially as more businesses transition to digital platforms and remote work, which increases exposure to cyber risks.
  • Resource Constraints: For many SMEs, the cost of robust cybersecurity measures can be prohibitive. They often lack dedicated IT and cybersecurity teams, which makes it challenging to implement and maintain comprehensive security protocols. Cybersecurity solutions can be expensive, so SMEs may prioritise short-term operational needs over what they might perceive as longer-term security investments.
  • Risk Perception and Underestimation: Some SMEs mistakenly believe they are too small to be targeted by cybercriminals, assuming that attackers primarily focus on large corporations. However, this “security by obscurity” mindset has been proven false, as attackers often view SMEs as easier targets due to their weaker defences.
  • Impact of a Breach on SMEs: Unlike larger companies, SMEs are less likely to recover from a significant cyber incident. A data breach or ransomware attack can be devastating, leading to financial losses, reputational damage, and even closure. Despite this, many SMEs may not fully understand the potential scale of these consequences.
  • Compliance and Regulatory Pressure: With increasing data protection regulations (e.g., GDPR, PCI), SMEs are under more pressure to adopt better cybersecurity practices to remain compliant. This has led to greater awareness among some SMEs, especially those handling sensitive data like healthcare, finance, or customer and payment information.
  • Cybersecurity Awareness Training and Culture: Even when SMEs implement some cybersecurity measures, they may lack the necessary employee training and risk management practices that foster a security-focused culture. Human error remains a leading cause of data breaches, so SMEs need to prioritize employee awareness and training.

In summary, while awareness of cybersecurity risk management is growing among SMEs, gaps remain, particularly around adequate investment, robust risk perception, and ongoing management of cybersecurity threats. Cybersecurity can seem overwhelming for small businesses, but as the digital landscape continues to evolve, understanding and addressing these risks is becoming essential for SME survival and growth.

General Security Issues Risk Analysis and Security Strategy Security Security Tools

Is Protective Monitoring Necessary for an SME?

I’ve talked about protective monitoring in the past but there is still some misperceptions about it, particularly amongst SMEs.  Probably first and foremost is that it is way too expensive, which leads to thinking that it’s not for them and is much more of a nice to have than a necessity.  I thought I’d take a bit of a deeper dive into this.

So, what is it? 

Protective monitoring in cyber defence is a systematic approach to continuously observing and analysing an organisation’s digital environment to detect, prevent, and respond to security threats. It involves gathering and analysing data about network traffic, system activity, and user behaviours to identify potential vulnerabilities or malicious activities. Here’s a breakdown of its key components and purposes:

For a small or medium-sized enterprise (SME), implementing cyber protective monitoring is crucial for a variety of reasons. This proactive approach can be the difference between quickly identifying and mitigating threats or facing significant damage from a cyber-attack. Here are key reasons why SMEs should consider cyber protective monitoring:

1. Protection Against Data Breaches

SMEs often hold sensitive data like customer information, financial records, and intellectual property.  Companies like law firms, financial advisors and estate agents, will hold years worth of personal identifiable information as defined by the Data Protection Act, or UK GDPR if you prefer.  Protective monitoring helps identify unusual activity within their network, such as unauthorised access or data exfiltration attempts, allowing for swift action to prevent breaches.

This is especially important as SMEs can be perceived as easier targets by cybercriminals compared to larger enterprises with more robust defences.

2. Regulatory Compliance

Many industries have strict regulations around data privacy and cybersecurity, such as GDPR and PCI-DSS. Protective monitoring helps SMEs stay compliant by providing visibility into how data is accessed, used, and secured.

It allows them to maintain audit trails of activity, which are often required to prove compliance during an audit or investigation.

3. Early Threat Detection

Cyber threats are constantly evolving, and attackers are often inside a network for days or weeks before launching an attack (such as ransomware). Protective monitoring enables the detection of anomalous behaviour that could indicate a security threat before it becomes critical.

This helps minimise damage by enabling a faster response to potential threats like malware infections, unauthorized access, or network vulnerabilities.

4. Cost-Effectiveness in the Long Run

While some SMEs may view cyber protective monitoring as an additional cost, it is often more cost-effective than dealing with the fallout of a cyber-attack. The financial impact of a breach includes legal fees, loss of business, damage to reputation, and potential fines from regulatory bodies.

By investing in monitoring, SMEs can save significantly on these potential costs, making it a smart investment, especially now that there are systems specifically designed and costed for SMEs.

5. Building Trust with Clients and Partners

Customers and business partners expect their data to be handled securely. An SME with strong cybersecurity practices, including protective monitoring, can build trust and demonstrate its commitment to data security.

This can serve as a competitive advantage, especially when dealing with larger enterprises or industries that prioritise security.

6. Rapid Incident Response

When a security incident occurs, the speed of the response is critical. Cyber protective monitoring provides real-time alerts when suspicious activities are detected, enabling SMEs to quickly isolate affected systems and take necessary actions.

A rapid response can help contain potential damage, maintain business continuity, and limit operational disruptions.

7. Mitigating Insider Threats

Not all cybersecurity risks come from outside the organisation. Insider threats, whether malicious or accidental, can cause significant damage. Protective monitoring can help detect unusual behaviour from employees or contractors, such as unauthorised access to sensitive data or suspicious data transfers.

This allows SMEs to address these issues before they lead to data leaks or other security incidents.

8. Scalability and Adaptability

As SMEs grow, their digital footprint and potential vulnerabilities expand as well. Cyber protective monitoring solutions can scale alongside the business, ensuring that security measures remain effective even as new systems, networks, and applications are added.

This adaptability makes it easier for SMEs to adjust their cybersecurity strategy as their needs change, without a complete overhaul of their security infrastructure.

9. Insights for Better Decision-Making

Beyond just identifying threats, protective monitoring can provide valuable insights into network usage and performance. SMEs can leverage this data to make better strategic decisions regarding their IT infrastructure, such as identifying redundant systems or optimising network resources.

It can also highlight areas that require further security investments, helping prioritise spending on cybersecurity.

10. Improving Overall Cybersecurity Posture

Cyber protective monitoring is a key part of a broader cybersecurity strategy. By continuously monitoring and analysing network activities, SMEs can better understand their vulnerabilities and areas for improvement.

This helps create a culture of security within the organisation, where cybersecurity is not just an afterthought but an ongoing priority.

Overall, cyber protective monitoring provides visibility, control, and peace of mind for SMEs, helping them navigate the complex and ever-changing landscape of cyber threats. By taking a proactive stance, they can protect their assets, maintain customer trust, and ensure long-term resilience against cyber-attacks.

Protective monitoring is not just for corporate organisations, but is for everyone, especially now that there are systems and services designed especially for SMEs and priced accordingly.  Don’t leave it until it’s too late. Playing catch up and fixing problems after the event, is always much more expensive that taking a pro-active stance.

To learn more about the protective monitoring managed solutions we provide please click here https://www.hah2.co.uk/

Cyber Awareness Training Ransomware, Phishing and other Malware Risk Analysis and Security Strategy

Cybersecurity Awareness Month

Did you know that October is Cybersecurity Awareness Month?  No – not terribly surprised after the poll we put out asking how important this subject was.  The response was truly frightening.  Cybersecurity Awareness month has participants in many countries and sponsored by many governments and tries to push awareness of the importance of this subject, across all industries.

Why do we think it’s so important?  Why would an SME bother with it?  Well, in short, it’s probably the single most cost effective and quickest win you can make.  It really doesn’t have to cost a fortune, it’s not techie if done right, is educational and it beefs up your security by ensuring your staff can spot a scam when they see one, can recognise social engineering and how to counter it, won’t open a rogue email and it generally keeps the subject in the forefront of minds.

OK, but what’s the threat?  Do hackers/scammers prey on SMEs?  Is there sufficient financial reward there for them?  Yes, yes and again yes.  The UK GDP is made up of north of 90% from SMEs.  Just think about that – 90% of the countries wealth is generated by SMEs, so a huge financial target.  The big companies spend a fortune on cyber security protections.  Most spend up to 15% of their annual IT budget on security and when you think that the IT budget often runs into millions, that’s big bucks.  SMEs can’t afford that and that makes them a much easier target.

I wrote a blog recently about the findings of the 2024 cyber security breaches survey.  The report tells us that among businesses, there has been a shift in the proportion saying cyber security is a “fairly” high priority (e.g. from 35% of businesses last year, to 40% this year). The proportions of businesses saying it is a very high priority is consistent with last year (36% last year and 35% this year). In 2023, as evidenced by the qualitative interviews, it was felt that cyber security had moved down the agenda among the businesses where it was already seen as a more marginal priority, and among businesses that typically have the fewest resources to deploy. The qualitative findings this year point towards an increased awareness of the risks that are faced when not prioritising cyber security, which could explain the increase in businesses this year rating it as a high priority.

It is more common for larger businesses to say that cyber security is a high priority (93% of medium businesses and 98% of large businesses, vs. 75% overall). The same is true for high-income charities (93% of those with income of £500,000 or more, vs. 63% overall). This continues the pattern seen since 2020, where larger organisations tend to treat cyber security more seriously, and consequently allocate more resources to it.

Businesses in the following sectors tend to treat cyber security as a higher priority than others:

  • information and communications (65% a “very” high priority)
  • finance and insurance (61% say it is a “very” high priority)
  • health, social care and social work (62% a “very” high priority).

These percentages are still very low and amongst this, if we drill down, we will find that the prevailing answer amongst SMEs remains to reach for technology for protection.  Technology will help, but it isn’t the full answer. When faced with constraints such as a tight budget it’s essential that a business prioritises its spend, making sure that it is targeting what really needs protection, and making sure that the protections in place are actually doing what you think they’re doing.  That is essentially what we refer to in regard to risk management.  It’s a business issue, not an IT issue.

In the 2024 survey, half of businesses and around a third of charities report having experienced some kind of cyber security breach or attack in the last 12 months. As in previous years, larger businesses and charities are more likely to identify breaches or attacks than smaller ones.  This latter point is worth mentioning because it’s generally only the larger businesses that have some kind of monitoring in place to identify an attack and many smaller businesses only find out when they start losing money.

Of course, good old COVID has had its effect, and I know we still bang on about it but that’s because its effect is long term.  It has changed our working practices in many respects although there is more of a move towards a return to the workplace currently, but some businesses have embraced the hybrid working practice and look unlikely to change.  My own client base has only seen one client move to 100% remote working, but they are all working some form of hybrid working pattern.

Many corporates have had some form of hybrid working for a long time, pre-COVID.  When I was at HP and before that in Symantec, we worked the hot desk system with people working remotely a couple of days a week.  It’s not new at that level but it is at the SME level, and we need more sophisticated ways of protecting ourselves at a price we can afford.  And that’s been the focus for us, and we are now confident that we have solutions that fit an SMEs requirement, at a price they can afford.

Cyber Awareness Training General Security Issues Risk Analysis and Security Strategy

Cyber Resilience – what it means and just as importantly, what it doesn’t mean

Cyber resilience can mean different things to different people, depending upon their priorities, their perception of cyber security and the business they are in.  This means that there are a lot of misconceptions about what it means, and I’m sure I’ll get some disagreeing with what I write here.  And that’s OK, because it really can depend on your situation as I’ve said above.  Essentially though it refers to an organisation’s ability to prepare for, respond to, and recover from cyber incidents, ensuring that critical operations continue despite attacks, failures, or unexpected events. Unlike cybersecurity, which focuses mainly on preventing attacks, cyber resilience combines prevention with the capability to withstand and adapt to adverse conditions, even if breaches or disruptions occur.

It encompasses five main aspects:

  • Identify: Understanding what an attack or scam might look like.
  • Protection: Implementing strong security measures to prevent cyberattacks and minimise vulnerabilities.
  • Detection: Quickly identifying and recognising cyber threats or breaches when they occur.
  • Response: Reacting effectively to contain and mitigate the impact of a cyber incident.
  • Recovery: Restoring systems and data to normal functioning after an incident, while learning from the event to improve future preparedness.

A cyber-resilient organisation is not only prepared to handle potential attacks but is also structured to adapt, recover, and continue functioning in the face of disruptions. This approach ensures minimal downtime, data loss, and damage to reputation.

Now let’s look at some misconceptions around cyber resilience.

  • Complete Immunity from Cyber Attacks: Cyber resilience does not mean that an organisation will be entirely immune to cyber threats. Rather, it focuses on minimising the impact and ensuring continuity in the face of such events. No system can be entirely hack proof.
  • Just Having Strong Cybersecurity: While cybersecurity is a crucial part of cyber resilience, the latter encompasses more than just security measures like firewalls or anti-virus software. It also involves having an effective strategy encompassing sound policies and processes, incident response plans, business continuity plans, and recovery strategies. A purely preventive approach, without considering recovery, does not constitute true cyber resilience.
  • A One-Time Effort: Cyber resilience is not a one-time project or a static state. It requires continuous assessment, updating of policies, and adaptation to new threats. It’s an iterative process of improvement and adjustment to maintain resilience against evolving threats.
  • Quick and Easy Recovery: While resilience involves the ability to recover, it does not guarantee that recovery will be quick or without challenges. It means that recovery is possible, but it might still take time and effort to restore normal operations depending on the severity of the incident.
  • An IT Department’s Responsibility Alone: Cyber resilience is not just about technical solutions managed by the IT department. It involves a holistic approach, including organisational culture, employee training, risk management strategies, and coordination across different business functions. It’s an organisational-wide commitment.  In a nutshell, it’s a business issue, not an IT issue.

Understanding what cyber resilience is not helps organisations better align their strategies towards truly being prepared for and able to recover from cyber incidents.

Don’t get bogged down in this though, don’t think it’s way too difficult and not really something that an SME for instance, can afford to do.  It’s a matter of scale and there are some things that a corporate business will need to do, that an SME doesn’t need to do, or perhaps can scale down. 

Help is at hand and if you want to talk this over then do please give me a call.

Cyber Awareness Training General Security Issues Ransomware, Phishing and other Malware Security Tools The Dangers of WiFi

Can Remote Working be Dangerous?

Well frankly, yes it can be dangerous.  There is a myriad of issues which have sprung out of remote working since COVID, with many SMEs, now operating a hybrid working scenario, although in my experience, certainly amongst my customer base, there are very few going 100% remote.

Businesses of all sizes have been forced to transform their operations to support remote work and by and large have done well, but not without many challenges—including video conferencing burn out, (along with wishing they’d taken out shares in Zoom!!), and a yearning to work together in person again, someday.  We all realise that group working, face to face, is often necessary not just for efficiency, but because we are social animals.  Experience has taught many businesses many things, but strangely, to my mind at least, many have simply not grasped the potentially dire consequences in terms of cyber security and data protection.

A distributed work environment i.e., personnel spread around various locations, office, home working, even the local coffee shop, creates critical challenges and new security threats as a result.  The speed with which this has happened has meant that many simply did not take this into account and if they did, thought, well, this is temporary, and it won’t matter in the long run.  Well perhaps, but as many are now finding, there have been advantages to home working, not least a lowering of costs in terms of how much office space is needed to carry out the business function.  Many are now looking at Hybrid working i.e., from home with a day or two in the office during the week.  There are pros and cons to this outside of the scope of this article, and businesses will have to make their own judgements, but one thing is clear and that is that businesses need to understand the risks now inherent in distributed work and need to get better at cyber security and data protection, in those environments.

Employees when remote working, are at much greater risk than those in offices. Since home connections are less secure, cybercriminals have an easier entry into the company network.  Furthermore, the explosion of various online tools, solutions, and services for collaboration and productivity tend to have the bare minimum of security default setting, and updates from third-party vendors can change security preferences and be easily overlooked.

Phishing becomes an even greater threat to home workers simply because, in an office environment, they have access to colleagues and managers, who they can approach for advice and guidance.  This is much harder to replicate with remote workers, especially those who may not be particularly tech savvy and who may not wish to become ‘burdensome’ to their co-workers.

Ransomware also enjoys an advantage in the remote working model.  If their connection to the company is blocked, it is more difficult for workers to get assistance from the right experts and authorities.  And since trust levels are lower when working from home, some workers will be concerned that they have “done something wrong” and so may be more reluctant to seek help. While this risk can be addressed by increased training, as well as messaging that vigilance and involving corporate IT will be rewarded, it can still be an uphill battle.

One of the biggest dangers I still see day to day is the dangers inherent in working from the local coffee shop.  This is a subject that I tend to jump on every so often, because it’s one that people just don’t seem to get.  Whenever I drop into a coffee shop for my caffeine infusion, there are usually at least a couple of people with their laptops open, working away on business issues.  I could see open spreadsheets (and easy to read if you were sitting behind them), and all have their email open.  They are often on a video call, and I can often hear all their side of the conversation, annoying enough for other café users but they are oblivious of the data being released into the wild.

If you are among those free Wi-Fi lovers, there’s bad news for you… your online privacy and security is at risk, if you rely on the weak to non-existent Wi-Fi security protocolsat coffee shops.  This means that you could be exposed to various threats such as identity theft which has over 15 million cases each year, data theft/breaches, introducing malware to your business network and that of your customers/suppliers.  This list is not exhaustive.

Free or public Wi-Fi’s are hotspots for hackers and data snoopers who want to steal your private data or financial information. It is easy for hackers to do that nowadays. You will be surprised to know the different ways hackers can compromise your device or your private information and why you shouldn’t rely on Wi-Fi security at coffee shops as they come with a lot of risk.

  • Unencrypted Data Exposure: If the Wi-Fi network is not encrypted, your sensitive information (e.g., passwords, emails, and financial data) can be intercepted by hackers using packet-sniffing tools.
  • Man-in-the-Middle Attacks: Hackers can position themselves between you and the network, intercepting and potentially altering the communication between your device and the server, leading to data theft or manipulation.
  • Fake Hotspots (Evil Twin Attacks): Cybercriminals may create a rogue Wi-Fi network that mimics the coffee shop’s legitimate network. If you connect to it, they can access all the data transmitted over the connection.
  • Malware Injection: Open networks can allow hackers to inject malware or viruses onto your device, which can lead to long-term breaches of your data or systems.
  • Session Hijacking: Attackers can intercept your session cookies, giving them access to your accounts, even if you’re using secure websites.
  • To mitigate these risks, use a VPN, avoid sensitive transactions, and ensure your firewall and antivirus software are active.  Although a VPN may not save your data if it’s stored on your laptop.

We are huge supporters of Cyber Awareness training for managers and staff, arguing that this is no longer a ‘nice to have’ and is now very much a necessity.  In fact, it is arguably the biggest quick win, giving the greatest potential return on investment that there is.  Of course, this means that companies must understand what their threats, vulnerabilities and risks are, to assess exactly what training is going to be the most effective.

But that alone won’t save you from a dedicated hacker.  We need to look at some more technical solutions to help you beat attacks.  Here at H2 we have researched and developed services using Software as a Service (SaaS), which, being cloud based, work wherever you are, office, home or coffee shop, and encrypts your most sensitive data whether on your machine, or in transit. 

If you feel a no obligation chat about this would be helpful, give us a call.

Scroll to top