Month: November 2024

Cyber Awareness Training General Security Issues Identity and Access Management Risk Analysis and Security Strategy Uncategorized

BRING YOUR OWN DEVICE (BYOD)

This is a subject that, at one time, was pretty much confined to the larger enterprise organisations but largely because of the pandemic, it is gaining popularity within SMEs and is now getting a lot of attention from the National Cyber Security Centre.

So, what is it?  Well the idea was to allow employees to use their own devices for work purposes.  The thinking was that in this day and age, many employees have developed preferences for what they use.  So whilst many will stick to Microsoft, others may prefer an Android or Apple tablet, whilst others still may prefer a MacBook or Chromebook.  There’s a wide choice these days.

But what do we mean by work purposes?  It can mean anything from accessing your emails, which most of us do on our phones, to accessing critical services and applications.  And this makes it a potentially complex issue.

The pandemic brought with it many issues that needed swift resolutions and now, it’s not uncommon to visit companies that have allowed their staff to continue to work from home often because the cost savings in office accommodation are very beneficial, and some have allowed staff to use their own preferred devices when working, including connecting to the company network and/or cloud services, remotely. 

For just about all SMEs, this has started from a position of necessity.  But like many such events, if it seems to be working, it rapidly becomes the norm and in creeps a complacency that it’s actually all OK.

BYOD solutions need to be planned and thought through.  And pretty much the same as most things, particularly risk based assessments, what you need to do really depends on your organisation.  You need to ask some questions:

  • Is there anything that needs to be done from the office that cannot be done by home workers?
  • Are there functions which employees need to do, that requires the company to have visibility and management of, and is there anything that doesn’t?
  • What do my employees need to do?
  • How can we balance what employees do that also involves your need to protect data and their privacy (DPA2018)?  They are after all, using their own device.

Above all you need a well thought through and comprehensive strategy, which, while offering flexibility and potential cost savings, recognises and deals with several security implications that organisations must address to ensure sensitive data and systems remain secure. Below are the key concerns:

a. Data Security

  • Data Leakage: Employees’ personal devices may lack adequate protections, increasing the risk of unauthorised access or accidental data leaks.
  • Loss or Theft of Devices: Personal devices may not have encryption enabled, making sensitive corporate data vulnerable if the device is lost or stolen.
  • Uncontrolled Sharing: Employees might unknowingly share corporate data via apps or cloud services outside the organisation’s control.

b. Malware and Cyber Threats

  • Insecure Devices: Personal devices might not have up-to-date antivirus software, firewalls, or operating system patches, making them susceptible to malware or ransomware attacks.
  • Unverified Applications: Employees may install unauthorised or malicious applications that could compromise corporate networks.

c. Network Security

  • Untrusted Connections: BYOD devices may connect to public Wi-Fi networks, exposing them to man-in-the-middle (MITM) attacks that could jeopardise corporate data.
  • Device Spoofing: An attacker could mimic a BYOD device to gain unauthorised access to the network.

d. Compliance Risks

  • Regulatory Violations: BYOD policies may lead to data handling practices that violate regulations like GDPR or PCI DSS if personal devices aren’t properly managed.
  • Audit Challenges: Tracking and demonstrating compliance can become difficult with non-standardised, user-managed devices.

e. Access Control

  • Weak Authentication: Personal devices may not support strong authentication mechanisms, increasing the risk of unauthorised access.
  • Lack of Segmentation: Employees’ devices may access both corporate and personal systems, creating potential crossover risks.

f. Insufficient Visibility

  • Limited Monitoring: Organisations may lack full visibility into personal devices, making it harder to detect breaches or policy violations.
  • Shadow IT: Employees might use unauthorised apps or services that bypass official security controls.

g. Employee Turnover

  • Data Retention: When an employee leaves, ensuring the removal of corporate data from their personal devices can be challenging.
  • Device Ownership: Legal and practical issues might arise when attempting to enforce data wiping on personal devices.

Mitigation Strategies

To address these risks, organisations adopting BYOD should:

  • Implement Mobile Device Management (MDM) or Endpoint Detection and Response (EDR) solutions.
  • Enforce strong authentication, such as multi-factor authentication (MFA).
  • Require device encryption and ensure compliance through regular checks.
  • Use some form of file separation to ensure separate corporate data from personal data.
  • Deploy a zero-trust security model with conditional access controls.
  • Establish clear policies and training to educate employees on BYOD security best practices.

By proactively addressing these risks, organisations can leverage the benefits of BYOD while maintaining robust security.

General Security Issues Ransomware, Phishing and other Malware Security Tools The Dangers of WiFi

Remote Working and Encryption

This is a subject that I tend to jump on every so often, because it’s one that people just don’t seem to get.  Whether it’s working from home, from a coffee shop, airport, railway station etc, there is this perception that it’s safe because you’re connected via VPN, or perhaps some other form of application which encrypts data in transit.  Well, let’s explore this subject a bit further.

There is no doubt that the propensity for working from home, or other remote locations, since COVID has introduced some very difficult, or at least challenging, security vulnerabilities into your network.  For instance, prior to the pandemic, when you were 100% office based (except perhaps some mobile salespeople), your local IT provider will have almost certainly set up what we called the bastion security model.  Ie, like a castle, a bastion, you had a wall around you, and for belt and braces, you also had a moat.  The gateway was robust, had a drawbridge and portcullis, or let’s call it a secure firewall and anti-malware system.  Everything was locked up inside and nice and secure (in fact it probably wasn’t but that’s for another day).

Whilst Microsoft didn’t invent the term the ‘new normal’, they were the first, I believe, to apply it to IT, following the enforced change in working practices brought about by the pandemic.  Many companies have embraced this new normal and have settled into some form of hybrid working.  Of course, this is nothing new, it’s been ‘a thing’ for years now, certainly regarding corporate organisations.  The real change came about in SMEs for whom it really was quite revolutionary.  Corporate bodies will have spent a lot of money on a variety or remote access systems to keep their data secure, whilst SMEs not only had to rush unprepared because of the pandemic, but they simply didn’t have the budget to employ more secure connections.

What the pandemic has done is change that, or perhaps arguably, accelerated the change to a more distributed way of working, already underway in corporate organisations but now common amongst SMEs.  What does that mean for us?  Firstly, we have to re-think how we are going to work.  We start from a position where we still have preexisting tech, such as VPNs and whole disk encryption, to tackle modern and evolving issues.

So, what about VPNs?  What are they?  A VPN, or Virtual Private Network, is a service that creates a secure, encrypted connection between your device and the internet. This private “tunnel” protects your data and hides your IP address, effectively masking your online identity and activity.  It works by allowing you to connect to the internet via an encrypted tunnel to a VPN server, which then forwards your requests to the website or service you’re accessing.  The benefits are that it protects your data from being accessed by hackers or eavesdroppers, especially on public WIFI. It masks your IP address and replaces it with one from the VPN server, so it’s harder for websites, advertisers, or even your ISP (Internet Service Provider) to track your online activity.  It’s particularly useful when working from insecure public WIFI but should also be used when working from home.

VPNs are available as standalone apps and more often now, incorporated into other applications, particularly those used to connect to cloud services.

All good, right?  Well yes, anything that helps secure your data is a good thing.  But like all good things it has some downsides.  A VPN does help protect data in transit over an insecure WIFI connection by encrypting the data you send and receive over the internet. This means that if you’re connected to an insecure WIFI network (like in a coffee shop or airport), the VPN will prevent anyone from intercepting and reading your internet traffic.

However, a VPN does not protect data stored locally on your laptop. Files or personal information saved directly on your hard drive are not protected by the VPN. To secure the data on your laptop, you may want to consider using additional protections such as some sort of full disk encryption (BitLocker for Windows or FileVault for macOS are standard with the operating systems) to protect data at rest.  And you should be using strong passwords and multi-factor authentication.

So, what I’m saying here is that should someone manage to gain access to your end point ie your laptop, desktop, even your phone, then your VPN is not going to protect you. 

Let’s now talk a bit more about Bitlocker and FileVault.  BitLocker, Microsoft’s disk encryption tool, provides robust security when configured properly (but I make the point here that it’s often not only incorrectly configured but isn’t even in use, making it pointless). And, like all encryption systems, its security depends on several factors, including the version of BitLocker, implementation practices, and potential vulnerabilities in the system environment. Bitlocker uses strong encryption, either AES 128 or 256 Bit, both of which are considered secure. 

FileVault is the MacOS equivalent of Bitlocker (roughly) and is considered secure and built into the MacOS and is very easy to switch on.  It too offers full disk encryption using AES 128 or 256 Bit.  Once again though it is often not in use by Mac users, many of whom don’t even know it exists.

Are there any drawbacks to whole disk encryption?  Will it protect me against things like ransomware?  Whole disk encryption is designed to secure data at rest by preventing unauthorised access to data on a physical storage device (e.g., in case the device is lost or stolen).  The problem is that once the machine is booted up, using the correct authentication, the disk is unencrypted, allowing you access to the data.  So, the answer to the specific question re ransomware is that such an attack is typically not mitigated by this kind of encryption because:

  • Ransomware Operates at the OS Level: Once a device is booted up and the encrypted disk is unlocked (usually via user login), ransomware can interact with files just like any other software. Since the operating system has access to the data, the ransomware does as well.
  • Ransomware Encrypts Data Independently: Ransomware generally works by encrypting the contents of individual files or directories (not the entire disk), effectively “locking” them within the already-decrypted environment. BitLocker, or any full disk encryption, won’t stop ransomware from doing this, as it doesn’t interfere with file operations once the system is unlocked.
  • No Version Control or Rollback: Whole disk encryption solutions don’t provide a way to revert to previous file versions or recover from ransomware encryption. This is where regular backups (stored separately from the network) play a critical role in protecting against ransomware.

You’re being careful, you have a VPN, and you have Bitlocker configured on your laptop.  You’re feeling nice and secure and have no issues using the local Coffee Shop or your home WIFI.  Your connection to your cloud service is secure and all your data in transit is encrypted.  Even your email is going via a secure tunnel.  All is good with the world.  Except of course that as soon as you logged on your whole disk encryption is switched off and your data is vulnerable even before you transmit it.  Any data you download to work on likewise becomes vulnerable as soon as it lands on your laptop.

Earlier I argued that VPNs were old tech being used to combat modern threats and a different way of working.  Does that mean that I think the VPN is no longer useful and is going out of style.  No of course not, VPNs have a very real place in our security architectures and that won’t go away anytime soon.  But they, like the vulnerabilities they are trying to mitigate, have to evolve and keep pace with present day and future realities.

VPNs, whether stand alone, or incorporated into another technology are great at securing data in transit.  What about your data at rest?  The best VPN in the world won’t protect you from someone who is determined to get in and steal your data or install ransomware.  The problem for SMEs is the same that it pretty much always has been.  Cost.  Can they afford a system that will protect their data and stop it being lost, stolen or ransomed. 

What has long been needed is a simple, flexible and intuitive security solution. We believe we have found such a system that protects your company against all known threats, and puts you firmly in control of your data, working automatically 24/7 to identify and safeguard your sensitive information.

Delivering multi-level protection, it provides real time control over all sensitive data. You can identify and solve every problem with a single click of your mouse!  Instead of whole disk encryption, which is decrypted as soon as you log on, it provides file level encryption which allows authorised users access but no one else.  But it does more, it locates all your data, allows you to decide what is, and what is not, sensitive, and provides subscription pricing for a fully managed solution. 

It’s a system that is designed specifically for SMEs and is therefore appropriate to you, and affordable.  To prove that we offer a 30-day free trial so that you can see it for yourself.  Check it out at https://hah2.co.uk/gdpr-data-protection/.

Cyber Awareness Training Data Breaches and their consequences General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy

Ransomware and the risk to SMEs

There’s a lot of FUD (fear, uncertainty and doubt), going around about Ransomware, and it has to be said that a lot of it comes from cyber security companies.  But amongst the rocks there are some very real diamonds that need the publicity.  There is a very real difference between genuine information and propaganda.  I hope what I do is spread information. 

There is a prevailing feeling amongst small and medium-sized enterprises (SMEs) that they are not a desirable target for Ransomware and it’s therefore not a problem for them.  However, that’s simply not true and they are increasingly vulnerable to ransomware attacks, with recent trends showing a notable rise in these incidents among smaller businesses. Several factors influence the likelihood of SMEs being targeted:

  • Widespread Targeting: SMEs are often viewed as “soft targets” because they may lack the advanced cybersecurity defences of larger corporations. Attackers assume that smaller businesses may have fewer resources dedicated to security, making them easier to compromise.
  • Increasing Ransomware Attacks Overall: Ransomware attacks globally have been on the rise, and attackers have shifted their focus to include not only large enterprises but also smaller organisations across various sectors. This is often due to the lower cost of launching ransomware campaigns, allowing attackers to spread wide nets with mass phishing campaigns and automated attacks.
  • Financial and Operational Impact: Many SMEs are attractive to attackers because the disruption from ransomware can be financially devastating for them. SMEs may feel greater pressure to pay the ransom to restore operations quickly, fearing the loss of business or reputation if the downtime persists.
  • Underinvestment in Cybersecurity: SMEs often underinvest in cybersecurity due to budget constraints, lack of expertise, or other business priorities. This underinvestment can lead to outdated software, limited employee training on cybersecurity best practices, and weaker defences that attackers can exploit.

Likelihood and Statistics

  • High Likelihood: Studies show that more than half of SMEs have experienced a cyberattack in the last year, with ransomware being one of the most common types of attack.
  • Small Business Victimisation: According to a 2022 survey by the Cyber Readiness Institute, nearly 60% of small businesses were targeted by cyberattacks, and a significant portion of these involved ransomware.
  • Increasing Cost: For many SMEs, the average cost of a ransomware attack, including downtime, lost revenue, and recovery expenses, can be as high as £50 to a £100K, making the financial impact severe and sometimes unmanageable without external assistance.

Key Risk Factors for SMEs

  • Lack of Security Awareness and Training: Employees at SMEs may be less well trained on cybersecurity threats, increasing the risk of phishing and social engineering attacks that lead to ransomware.
  • Lack of Backup and Recovery Plans: SMEs may not have effective data backup or disaster recovery strategies, making them more susceptible to extended downtime or paying the ransom.
  • Weak Network and Endpoint Security: Limited resources often mean that SMEs may not have enterprise-grade firewalls, intrusion detection, or antivirus solutions, leaving systems exposed to exploitation. They also struggle with the distributed work practice (office, home etc) that has happened since COVID.
  • Encryption:  Data is often unencrypted on end point machines.

Reducing the Risk

While the risk is high, SMEs can take measures to reduce the likelihood and impact of a ransomware attack:

  • Implementing Regular Backups: Ensuring data backups are frequent, secured, and tested for restoration can significantly reduce the impact of an attack.
  • Employee Training: Conducting regular training to recognize phishing and social engineering can help employees avoid common attack vectors.
  • Monitoring: No or inadequate monitoring of their data and systems, including home and other remote workers.
  • Endpoint and Network Security: Investing in antivirus software, firewalls, and network monitoring can improve defences.
  • Cyber Insurance: Purchasing cyber insurance can help mitigate financial losses associated with an attack.
  • Data encryption.

In summary, while SMEs face a high likelihood of ransomware attacks, increasing awareness, preparation, and proactive defence measures can substantially reduce both the risk and the impact of an attack.

What is the impact of a Ransomware Attack?

Ransomware can have devastating effects on small and medium-sized enterprises (SMEs). Here are some of the key impacts:

Financial Losses

  • Ransom Payment: If SMEs decide to pay the ransom (which is not generally recommended), this can result in significant, sometimes crippling, costs.
  • Operational Downtime: Even if no ransom is paid, businesses often experience significant downtime as they attempt to recover systems, which can halt revenue generation and lead to lost sales.
  • Recovery Costs: In addition to the ransom, SMEs incur expenses related to data recovery, IT support, and forensic investigation. Often, additional security solutions are needed to prevent future attacks.

Loss of Data

  • Data Encryption or Destruction: Ransomware can lead to the permanent loss of critical data if files are corrupted or remain encrypted after an attack.
  • Loss of Sensitive Information: SMEs may lose access to sensitive customer or business data, leading to gaps in operational records or strategic plans.

Reputational Damage

  • Loss of Customer Trust: Ransomware attacks, especially if customer data is exposed or operations are disrupted, can damage customer confidence. Many SMEs rely on personal relationships, and a ransomware incident can harm these relationships.
  • Brand Damage: Businesses often struggle to rebuild trust, and reputation damage may deter new clients and weaken partnerships with vendors or other business partners.

Legal and Regulatory Consequences

  • Compliance Violations: If SMEs operate in regulated sectors (like finance, healthcare, or legal services), a data breach can lead to violations of regulations like GDPR, resulting in fines and other penalties.
  • Legal Liabilities: Affected customers or vendors may pursue legal action if sensitive data is compromised, adding further financial strain.

Operational Disruptions

  • Halting of Services: For many SMEs, especially those without a strong IT infrastructure, ransomware can paralyse day-to-day operations.
  • Long Recovery Times: SMEs often lack the same level of IT resources as larger enterprises, so restoring full operational capacity after an attack can take weeks or months.

Employee Productivity and Morale

  • Reduced Productivity: During and after a ransomware attack, employees may be unable to work if they lack access to necessary files, email, or software.
  • Psychological Impact: The stress and uncertainty from a cyberattack can lead to anxiety or frustration among employees, potentially impacting morale and retention.

Increased Insurance Costs

  • Higher Cyber Insurance Premiums: Cyber insurance costs tend to increase significantly for companies that have experienced ransomware attacks. Additionally, insurers may demand proof of enhanced security measures to continue providing coverage.

Pressure to Strengthen Cybersecurity Measures

  • Increased Security Costs: Post-incident, SMEs often must invest in more robust cybersecurity infrastructure, including advanced threat detection, backup solutions, and employee training.
  • Ongoing Monitoring Needs: Ransomware may prompt SMEs to adopt more rigorous monitoring and endpoint protection tools, leading to continuous IT spending.

Ransomware attacks can be particularly harmful to SMEs because they often have fewer resources for cybersecurity, and a single attack can have a prolonged impact. Many SMEs lack a full-time IT staff or robust data backup protocols, which can compound the impact. Consequently, proactive measures, such as employee training, regular data backups, and up-to-date cybersecurity defences, are critical to reducing the likelihood and impact of ransomware attacks on SMEs.

Scroll to top