Month: March 2025

Cyber Awareness Training General Security Issues Identity and Access Management Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Working Practices

Social Engineering

I frequently share insights on the significance of Cyber Awareness Training and its critical role in helping organisations defend against cybercrime. Cyber awareness training is a vital aspect of contemporary security strategies for everyone. It provides employees with the essential knowledge and skills needed to identify, respond to, and reduce cyber threats. This training is particularly effective in combating social engineering.

While many people are now familiar with the term social engineering, they may not fully understand its meaning. In the context of cybersecurity, social engineering involves manipulating, influencing, or deceiving individuals to gain unauthorised access to IT systems or to steal personal and financial information. It employs psychological tricks to lead users into making security errors or divulging sensitive data. The most prevalent form of social engineering is phishing.

Social engineering heavily relies on the six Principles of Influence identified by Robert Cialdini, a behavioral psychologist and author of “Influence: The Psychology of Persuasion.” These six principles are: Reciprocity, Commitment and Consistency, Social Proof, Authority, Liking, and Scarcity. Simply put, what these criminals seek is information, login credentials, passwords, names, phone numbers, and more. They are profiling your organisation to identify vulnerabilities, such as who manages accounts payable or whether you have an IT support company under contract that they could impersonate. In addition to phishing, they utilise various forms including vishing (voice phishing), smishing (SMS phishing), and simply calling to ask questions.

A rising threat that criminals are increasingly adopting is help desk social engineering tactics. In these schemes, attackers call an organisation’s IT help desk while posing as a legitimate employee, trying to convince the help desk agent to reset passwords or multi-factor authentication (MFA) for a specific account.

In recent years, this technique has been used to access single sign-on (SSO) accounts and cloud-based application suites. Multiple criminals adopted this approach in 2024, targeting academic and healthcare institutions; in these cases, attackers utilised compromised identities to extract data from cloud-based software as a service (SaaS) applications or alter employee payroll information.

IT help desks typically require employees requesting password and MFA resets to provide their full name, date of birth, employee ID, and manager’s name or answer a pre-set security question. However, cybercriminals attempting to socially engineer help desk personnel often answer these questions accurately. Much of this information is not confidential and can be found in public resources and social media sites. The dark web frequently harbours data that should remain private. At H2, we continuously scan the dark web for our clients to uncover any exposed information.

Often, help desk social engineering calls occur outside of regular working hours. This tactic allows criminals to maintain access to compromised accounts for longer periods before the legitimate account owner detects any suspicious activity. Attackers using this method may register their own devices for MFA to secure ongoing access to compromised accounts. They also frequently delete emails from compromised mailboxes related to suspicious account activities or configure mail transport rules to redirect relevant emails away from the main inbox.

Over the past year, several criminals have openly sought callers on popular forums. Advertisements typically call for English-speaking individuals familiar with RMM tools and experienced in conducting remote sessions. Some criminals are also exploring effective ways to spoof phone numbers or encrypt calls, ensuring caller IDs appear more credible. This trend suggests that phone-related social engineering will pose a significant threat in 2025 as demand for these capabilities increases.

So how can we combat this? I began with cyber awareness training, and I’ll conclude with it as well. When your staff, regardless of their technical expertise, understand what social engineering is and its intentions, they are much more likely to recognise it when it occurs. Simple practices such as asking unknown callers to call back using a verified number instead of one provided by the caller can make a difference. If you receive an email from a senior manager or board member that seems suspicious, open a new email thread for confirmation rather than replying directly, this helps avoid potential spoofing by scammers masquerading as legitimate sources. And of course, never click on links!

Cyber awareness training doesn’t need to be costly; it can be delivered face-to-face, online, or through automated means. At H2, we offer all these options! Regardless of your choice, please consider this training an essential component of your strategy.

General Security Issues Risk Analysis and Security Strategy Security The Dangers of WiFi

The Internet of Things

There’s a lot being said in various quarters about the Internet of Things (IOT) but whenever it comes up in conversation with senior people in the SME world, even those businesses that are in the medium bracket, with significant numbers of employees, it raises a titter or two.

So, what is it and why would that be?  According to Wikipedia IOT describes devices with sensors, processing ability, software and other technologies that connect and exchange data with other devices and systems over the Internet or other communication networks. The IOT encompasses electronics, communication, and computer science engineering and encompasses a vast array of devices — from household appliances to industrial equipment — all connected online. These devices often lack robust security features, making them susceptible to attacks. Common vulnerabilities include insecure firmware, weak authentication protocols and unsecured network services. For example, IOT devices can be compromised to create botnets that launch massive Distributed Denial of Service (DDoS) attacks. As the IOT continues to grow, securing these devices becomes increasingly critical, necessitating the development of new security strategies that encompass IOT.

IOT in a nutshell then, does not just refer to everyday household items that have a processor and remote capability, but also systems within your business.  For instance, if you can turn on your lights, start a cooker going, turn on the kettle etc, all from your phone on your way home, you can do the same on your way into work.  And of course, we have Siri, and Alexa amongst other systems, all interconnected in some way in your home, and increasingly, in your office, and to the internet. 

Whenever it’s discussed all the usual lighthearted comments about being hacked by your kettle, or held to ransom by your toaster, come out in the conversation.  And there is some amusement to be had.   But there is a serious side to this.  

Increasingly now we are seeing smart appliances in the workplace, that could be used to jump onto the more serious elements of a network, we are already at a place where some functions, perceived as routine, even mundane, can already be used to jump onto other network devices.  For instance, most have security cameras and alarm systems.  Many of these are IP based and are connected via the LAN.  OK, but many also are remotely maintained by a variety of suppliers.  I have found it not uncommon for these suppliers to arrange for their own backdoor into the system to maintain these systems, often without the client knowing how that is done.  This provides a very neat circuit around the router and firewall and, when most SME networks are flat, access onward to all parts of the network.  A flat network refers to a network that is unsegmented ie all devices are attached to a single WIFI or wired network with no further network protection once through the gateway.

This of course is not the only example, but it shows how poor security architecture, often times by local network providers, can have a quite seriously detrimental effect.  So, what I am saying is that as many more devices become ‘smart’ and interconnected via the LAN, security architecture becomes just as important for the SME as it does for the larger enterprise.  The problem is that the awareness and support within the SME community and their suppliers, tends to be lacking.

These days we have to add in the move towards remote working, either full or part time, and the increasing use of AI, which adds many other threats to your systems, and I have explored these in other blogs, which you can view on my website, https://hah2.co.uk/news/.  How many of your staff, using their home WIFI to connect to your company systems, also have IOT devices connected to the same WIFI router that they are using to connect to you?  How are you managing that risk?  Or are you?

Cyber Awareness Training General Security Issues Risk Analysis and Security Strategy Security

Societal Perception of Cyber Security

Cyber Security continues to be, all too often, treated as an IT issue.  Now this is a drum that cyber security professionals have been banging for a long long time.  Cybersecurity is NOT and IT issue, it is very much a business issue.  But we do struggle to get that across, particularly in the SME market who continue to view it as purely technical in nature.

Now, whilst I’m not always enthusiastic about the stats and reports that are published, simply because they tend to be industry publications with the authors often having an axe to grind but they can make some very good points.  Let’s look at some key challenges being encountered:

  • Cybersecurity spending appears to be slowing (although that depends on who you speak to), while boards are starting to push back and ask what they have achieved after years of heavy cybersecurity spend.
  • Boards and senior executives are asking the wrong questions about cybersecurity, leading to poor investment decisions.
  • Many current approaches to improve cybersecurity are falling short of providing appropriate and defensible levels of protection.

SMEs are invariably focused on cost, which means optimising their spend to ensure that they get the biggest bang for their buck, to coin a phrase.  However, time and again we see that they have spent, sometimes considerable, sums on technology without actually understanding what risks that technology is there to mitigate, therefore having no real idea if it is doing what they have been told its doing.  The amount of money they are spending is of course relative.  To a small business the sum invested might be a minor consideration to a much larger business.  So, it becomes crucial that the mitigations put in place are appropriate to the risks they are there to mitigate. 

This comes down to another drum we like to beat, that of risk management.  Below is a link to a short video which explains the risk management process as it appertains to cyber security.  Look at it with the view that it can be a matter of scale, and the smaller businesses may not need to go through the whole process but will need to go through much of it.

The risk management process

Note the I use the term mitigate rather than prevent.  That’s simply because eradication of risk is simply not possible if you are going to continue to do business.  The best you are going to achieve is to mitigate that risk to the lowest level achievable without getting in the way of business.

Let’s consider the following challenges and impacts:

ChallengeImpact
Societal perception of cybersecurity is that it is a technical problem, best handled by technical people, although that tends to be amongst the SME community.  There is evidence though that that is changing slowly.Societal perception is dominated by fear, uncertainty and doubt. It results in poor engagement with between management and suppliers, unproductive exchanges and unrealistic expectations. Ultimately, it leads to bad decisions and bad investments in cybersecurity.

Organisations are focused on the wrong questions about cybersecurity.  The question of what do I need to buy to secure my data is asked rather than what do I need to secure and what is the priority.
Unproductive questions are indicative of poor understanding, and drive attention away from an improving that understanding and therefore drive better investments.
Current investments and approaches designed to address known limitations are not productive.Many SMEs focused on technology and have a poor understanding of cyber risk management.  This is often compounded by an equally poor understanding within the IT management company’s they often outsource to.  This leads to a combination of poorly scoped solutions and all too often failed execution and unrealistic expectations.
Real failures are not getting enough attention to productively change behaviour.Compliance with any regulation does not equal appropriate levels of protection.

Now, whilst some of these impacts may not be a 100% fit for many SMEs, particularly at the smaller end of the bracket, they are close enough to be taken very seriously indeed.  Poor decisions are being taken every day in regard to the purchase of hardware and software to protect against cyber threats, without having carried out any kind of risk assessment to actually understand what risks they are trying to mitigate.  End result, an investment in technology that on its own, will not prevent many of the cyber threats that abound today, coupled with a false sense of security.

A competent cyber security professional will approach the problem from the point of view of People, Process and Technology, understanding that many mitigations require a combination of 2 or 3 of those to provide an adequate response to the threat.  For many SMEs, one of the biggest and quickest wins they can achieve is cyber awareness training for their staff.  If their staff are aware of the issues, they have a much greater chance of recognising a scam, a phishing attack, an attempt at social engineering etc.  And oftentimes such things can be mitigated by sound policies and processes.  All of this prior to even considering spending money on technology. However, the very first thing that should be considered is to undertake a risk management process to identify the threats and vulnerabilities inherent in the business, thus enabling the risks to be identified and working out what mitigations are needed to drive the risks down to an acceptable level.  SMEs almost never do this and it is a fundamental mistake.

Cyber Awareness Training Data Breaches and their consequences General Security Issues Identity and Access Management Risk Analysis and Security Strategy Working Practices

Remote or Office?  The Debate Goes On

Barely a week goes by without the remote working v office-based argument surfaces somewhere, usually it must be said, at the corporate level, although many SME owners remain nervous of it, with others downright against it.  My client base appears to be largely OK with a hybrid model of working and only one is 100% remote based, having given up their office.

The COVID pandemic was the catalyst for this with businesses of all sizes being forced to transform their operations to support remote work and by and large have done well, but not without many challenges, including video conferencing burn out, (along with wishing they’d taken out shares in Zoom!!), and a yearning to work together in person again, someday.  We all realise that group working, face to face, is often necessary not just for efficiency, but because we are social animals.  Experience has taught many businesses many things but are often still struggling with the potentially dire consequences in terms of cyber security and data protection.

I should perhaps mention that in the corporate IT world, where I worked for many years for major system integrators like HP, hot desking and remote working was introduced in the early 2000s and therefore this was no problem for us.

A distributed work environment i.e., personnel spread around various locations, office, home working, even the local coffee shop, creates critical challenges and new security threats as a result.  The speed with which this has happened has meant that many simply did not take cyber security issues into account and if they did, thought, well, this is temporary, and it won’t matter in the long run.  Well perhaps, but as many are now finding, there have been advantages to home working, not least a lowering of costs in terms of how much office space is needed to carry out the business function.  Many are now looking at Hybrid working i.e., from home with a day or two in the office during the week.  There are pros and cons to this outside of the scope of this article, and businesses will have to make their own judgements, but one thing is clear and that is that businesses need to understand the risks now inherent in distributed work and need to get better at cyber security and data protection, in those environments.

Employees when remote working, are at much greater risk than those in offices. Since home connections are less secure, cybercriminals have an easier entry into the company network.  Furthermore, the explosion of various online tools, solutions, and services for collaboration and productivity tend to have the bare minimum of security default setting, and updates from third-party vendors can change security preferences and be easily overlooked.

Phishing becomes an even greater threat to home workers simply because, in an office environment, they have access to colleagues and managers, who they can approach for advice and guidance.  This is much harder to replicate with remote workers, especially those who may not be particularly tech savvy and who may not wish to become ‘burdensome’ to their co-workers.

Ransomware also enjoys an advantage in the remote working model.  If their connection to the company is blocked, it is more difficult for workers to get assistance from the right experts and authorities.  And since trust levels are lower when working from home, some workers will be concerned that they have “done something wrong” and so may be more reluctant to seek help. While this risk can be addressed by increased training, as well as messaging that vigilance and involving IT support will be rewarded, it can still be an uphill battle.

In a study carried out by Entrust it was clear that many organisations are grasping the concept of cyber awareness training, although there are still too few amongst SMEs that take this on board.  Of those who responded to Entrust:

  • 94% said employee training has a positive impact on data security.
  • 95% agreed that they trust remote employees to comply with data security best practices and training.
  • 93% said they felt positive about the impact data security training had on them.

Of course, this was a sampling and only 61% of employees said that their company offered training.

Whatever system of hybrid you are proposing to use, or are using, it is clear that you will need to go beyond baseline security measures.  In this case we are almost certainly dealing with baseline protections such as multi-factor authentication, known as MFA or sometimes 2FA, and virtual private networks (VPNs).  Both have their place and will be needed. 

The Entrust report cites a contradiction here, and it’s one I have also noted.  Many company owners/directors say they believe company data is protected with these baseline solutions, yet they also say that home internet connections, leaked sensitive company information and cyber-attacks are their top concerns.

If organisations are going to use hybrid work models successfully over the long term, then they will need to further invest in their security strategy. MFA and VPNs, while important, should be seen as part of a larger strategy for data security in a hybrid work model. Throughout and beyond the pandemic, bad actors have exploited security deficiencies of remote environments such as insecure home tech hardware, poor password hygiene and employee use of unapproved tools.


If you are going to adopt this new normal, or already have adopted it, then the process must start with understanding your risk posture which will inform you of what measures you need to take to secure your data.  Below is a link to a short video explaining cyber risk management, at least at a high level.

https://bit.ly/3FdZ6x0

Once you have a clear understanding of what your risks are, then you might like to consider a zero-trust approach to data security.

With employees having the ability to work anywhere in a hybrid environment, the office perimeter is no longer relevant to digital security.  Zero Trust frameworks are designed to apply the concept of least privileged access to people, systems and devices, giving these entities only the access they need to fulfil their role and nothing more. Additionally, a Zero Trust approach continually monitors user and device behaviour to identify suspicious patterns and take preventive action, including a step-up authentication challenge.

You may need to consider other protections such as:

  • Passwordless single sign on involving Privileged Access Management (PAM) to facilitate a Zero Trust approach. 
  • Data Loss Prevention.  Whilst a VPN will protect your data in transit, file level encryption ensures that it is protected at rest, at both ends of the tunnel, so that if it does get stolen or otherwise compromised, the impact is severely lessened.  There is more information in the short video below.

https://bit.ly/4berDPa

  • Protective Monitoring.  This has long been considered too expensive for an SME.  Well, no longer, there is now a system which is effective and affordable and is explained in the video below.

https://bit.ly/3Qy4u0x

If you feel a no obligation chat about this would be helpful, give us a call.

Scroll to top