Month: April 2025

Cyber Awareness Training Data Breaches and their consequences General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security

Cyber Security and The SME

What are we facing?

The world is in somewhat of a flux at the moment and SMEs are being battered from all sides it seems.  First, we have the increase in the minimum wage, which impacts SMEs, generally, more than the corporate sized businesses, and then the increase in NI.  What we didn’t need was tariffs, although how much of an impact that will have on SMEs won’t be known for some time yet.  The EU is the world’s largest single market area and is the largest economy in the world, whether some people agree or not.  Many may attribute that market size to large organisations and multi-national companies. While these are important contributors to the overall EU economy, the Small Medium Enterprise (SME) businesses form the backbone of that economy.  This is also true of the UK where the DTI estimates that SMEs make up nearly 95% of the UKs GDP.   A huge percentage and one that might surprise you.

According to the Cyber Security Breaches Survey (gov.uk), half of SMEs in the UK had experienced some form of cyber-attack in 2024, with email phishing, spear-phishing, and social engineering continue to trend as the most common and reliable means of illegally accessing a network.

NinjaOne produced are report which says that there were 7.78 million Cyber Attacks on UK Businesses in 2024. More than 400,000 cases of fraud and computer misuse were recorded. 50% of UK businesses experienced a cyber-attack.

The economic effects of the measures hitting SMEs discussed above, are already having an effect in that many SMEs are putting enhancing their protections against cyber-attacks, on the back burner.  Those we speak to acknowledge the problem but are reluctant to spend money on anything that isn’t their core business.  And we get that, we really do.  After all we are an SME ourselves.

What are the potential impacts of a cyber-attack on your business?

A successful cyber-attack can wreak havoc on your business. Damaging your financial stability, customer trust, and reputation while inviting legal issues. The fallout includes:

  • Loss of corporate, financial, and personal data
  • Disruption to trading and potential fines from ICO
  • Repair costs for affected systems
  • Imagine building customer trust and an impeccable reputation over years, only to see it shatter in hours due to a cyber-attack.
  • The consequences, loss of customers and decreased sales and profits

The fear of legal repercussions is real too. Deploying inadequate security measures can lead to fines, regulatory sanctions and even legal action.

So, what can you do to better protect your business?

Despite today’s digital landscape, cyber security remains a non-negotiable aspect of business success. The threats are real, and SMEs are not immune. In fact, they’re often the most vulnerable to cyber-attacks.

Solutions need not be complicated or expensive, yet many SME owners still act reactively, not proactively, to cyber threats.  The result? Huge costs to put things right and a massive hit on the company’s reputation and trust with their customers.

An underlying issue common to all SMEs is management awareness and commitment, which in turn drives budget, allocation of resources and effective implementation of the cybersecurity practices. Six categories of major challenges for SMEs have been identified:

  • Low cybersecurity awareness of the personnel.
  • Inadequate protection of critical and sensitive information.
  • Lack of budget.
  • Lack of ICT cybersecurity specialists.
  • Lack of suitable cybersecurity guidelines specific to SMEs.
  • Low management support.

Risk Management

Now I know that many will say that this is a technical matter and that we have a company under contract that looks after our IT infrastructure and therefore we can safely leave it to them.  Wrong.  Ask them some simple questions: 

  • Have they fully identified your security assets?  Security assets are not just   hardware and software, in fact those are often the least of your worries.  It’s the data, where it is and how it’s protected that is important.
  • Have they done a risk assessment on those assets.
  • Have they recommended or implemented controls to manage the risk down to your acceptable residual risk level.  That is assuming they have spoken to you about what that acceptable risk is. 

It’s very important that business owners grasp the difference between the technical requirements of their networks, and the business requirement. 

You carry out risk management on a daily basis as you go about your business.  Cyber security is no different and a simple risk management process can save you money by targeting your limited spend where it really needs to go, not where you may think it needs to go.  Here is a link to a short video on that risk management process, which should help you see that it’s not onerous and need not be costly.

https://bit.ly/3FdZ6x0

Cyber Awareness Training

Some of you who are amongst my regular readers, will be quite aware of my mantra in regard to Cyber Awareness Training for staff and managers.  A big misconception is that because cyber security can be an issue connected to technical measures, it lies squarely within the realm of IT.  Wrong.  Cyber security needs to be part of the culture of the organisation, second nature to all.  Staff need a basic awareness and how their attitude and actions can have a damaging effect on the business.  A report for ENISA, the EU security agency, suggests that 84% of Cyber attacks rely on some form of social engineering, and that the number of phishing attacks within the EU continues to grow.  This is echoed in the UK.

Budgets

Budgets remain a problem.  Many SMEs are low margin organisations, heavily reliant on cash flow, and therefore reluctant to spend on things that are not connected to their core business.  But they must get used to asking themselves, ‘Is IT part of my core business?’, and ‘how long could I continue to operate my business if I lost my IT systems?’.  Cyber security needs to be factored into budgets. Cyber security is an iterative process, it isn’t something that needs to be done once and then forgotten about.  The criminals are constantly evolving, and defences must evolve with them.

Cyber Expertise

Cyber security expertise is something that isn’t cheap and easy to obtain.  Many IT companies will talk about their expertise in this area but if you delve into that, it is generally focused on products, mainly firewalls and anti-malware.  Cyber security expertise goes much much deeper than that and is as much procedural as it is technical.  It starts with risk management, understanding the risks you face, which in turn is derived from threat and vulnerability analysis, matched to your cyber security assets.  Those latter are not necessarily hardware and software but can be much wider ranging than that.  Typically, the type of person who can legitimately call themselves experts in this field, can command salaries north of £80K.  I doubt there are many SMEs prepared to pay that, or indeed, many of the smaller IT companies.

Security Standards

It can also be advantageous to follow a standard.  By far the most comprehensive is the International Standard for Cyber Security, ISO27000 series.  However, this might be seen as a little heavy for many SMEs, although at the higher end, they may want to follow it, rather than seek certification.  At the lower end the UK Cyber Essentials scheme, mandated for anyone wishing to do business with the public sector, is very suitable, inexpensive, and obtainable.

Cloud Services

More and more SMEs are now moving to a cloud environment.  Be it MS365, Amazon Web Services, Digital Ocean, amongst others.  I usually recommend that SMEs take this approach as it can solve a lot of problems, particular with home working still very much in vogue.  However, it is not the panacea that most think it is and still has some security issues, usually but not always at the user end, that need to be addressed.

About H2

Here at H2 we use our long experience of providing cyber security solutions to the large enterprises, to craft solutions for the SME community, having first identified the issues that the business faces.  We take an approach that looks at things from the business point of view, managing risk and coming up with cost effective solutions which can be brought in in a phased way, for a subscription price.  No large bills to damage that all important cash flow.

General Security Issues Risk Analysis and Security Strategy Security Supply Chain Security Working Practices

Cyber Resilience – What Does It Entail?

The Cyber Security and Resilience Bill

Following the fallout last year, from the CloudStrike sensor failure that led to significant outages worldwide, we wrote a piece questioning whether we are truly addressing Cyber challenges. Subsequently, the UK introduced The Cyber Security and Resilience Bill, which was debated in Parliament in 2025. This legislation seeks to enhance the UK’s cyber defences and bolster resilience across essential services, infrastructure, and digital offerings. It will revise current cyber security regulations, including the NIS Regulations, and broaden the scope of protected digital services and supply chains.

The primary goal of this bill is to safeguard the UK’s digital economy, positioning it as one of the most secure in the world while protecting services, supply chains, and citizens. Additionally, it aims to enhance our cyber resilience and stimulate growth and prosperity. With an expanded scope, it encompasses a wider array of essential digital services beyond those currently covered by the NIS regulations and builds upon them. The bill includes mandatory reporting requirements and emphasises the UK’s Critical National Infrastructure (CNI).


Ministerial Policy Statement


You can read more about it here: https://www.gov.uk/government/publications/cyber-security-and-resilience-bill-policy-statement/cyber-security-and-resilience-bill-policy-statement.

Relationship with EU Regulations


Although the UK’s Cyber Security and Resilience Bill is tailored for the UK, it draws inspiration from the EU’s Cyber Resilience Act (CRA) and the NIS2 Directive. The CRA emphasises cybersecurity for products with digital elements, whereas the UK’s legislation focuses on fostering overall resilience within its digital ecosystem. Furthermore, it aims to align with principles found in the NIS2 Directive adopted by the EU in 2024.

How will SMEs navigate this?

In the cybersecurity sector, there has long been a divide between product vendors and those of us focused on services. After three decades in this industry, I’ve repeatedly observed that product sales often prevail. Why? Because selling services is more challenging with a longer sales cycle compared to quicker product sales. People prefer to see a quick if not immediate return, on their investment; they like tangible products doing their job even if they don’t fully grasp how they function or whether they’re suited for their needs.

Risk Management

A risk managed approach remains vital. This principle hasn’t changed over my 30 years in the field. However, this bill makes it even more critical due to potential penalties for non-compliance. The focus should be on People, Process, and then Technology. I often reference Bruce Schneier, a Harvard scientist and thought leader in cybersecurity. He states, “If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology.” Essentially, understanding your risks begins with identifying your cyber assets, not just hardware or software but your data and your ability to maintain system access for staff and customers when needed.

Once you recognise your assets, you must identify potential threats to them and assess how vulnerable you are to those threats. Threats combined with vulnerabilities equal risk, the risk to your business if things go awry.

Having completed this assessment you can assign a risk score to each asset aiming to manage that risk down to an acceptable level, known as risk appetite. This will vary from business to business or even asset to asset; for instance, you wouldn’t assign the same risk level to a revenue-generating system as you would to an admin-only system lacking personal data.

This may sound daunting and costly; hence many businesses avoid it or only partially implement it. However, without a comprehensive assessment, it’s challenging to ensure that you are allocating your limited budget toward appropriate protections in key areas. You need to determine potential damage from failures and explore ways to mitigate that damage. While consulting a lawyer after a crisis is one option, wouldn’t it be wiser to prevent or reduce issues before they escalate?

General Security Issues Security Security Tools

HONEYPOTS

I seriously doubt if any of my clients would find a honeypot of any use, if only because they take a lot of time, effort and expense, but I thought I’d do a piece on them because they do exist and might be of interest, if only to understand what’s out there.

What is a Honeypot, in terms of cyber security that is?  Well, we’re not talking about a seductive member of the opposite sex, using their wiles to wheedle info out of you.  In this instance honeypots are cybersecurity tools designed to look like an attractive target, that act as decoys to attract and study cyberattacks. They mimic real systems or resources, but are isolated and monitored, allowing security teams to observe and analyse attacker behaviour without risking real data or systems. This information helps organisations improve their defences against malicious activity.  They can also be used to attract an attacker to the honeypot and away from your actual crown jewels.  Although this latter has fallen out of favour in recent years.

How Do They Work?

The honeypot is configured with vulnerabilities that are designed to lure attackers, leading them to believe they have successfully accessed a real system.  Meanwhile the security team monitors the honeypots activity to track the attackers’ movements, tools, and techniques.  Once the information is gathered it is used to understand attacker motivations, vulnerabilities in the organisation’s systems, and emerging threats.  The knowledge gained helps organisations strengthen their defences, identify potential blind spots, and improve their overall cybersecurity strategy.

Types of Honeypots

  • Low-interaction honeypots – These are simple, basic decoys that provide limited interaction with attackers, allowing them to study the attacker’s initial steps.
  • High-interaction honeypots – These are more complex, providing a more realistic experience for attackers, allowing for detailed analysis of their behaviour and techniques.
  • Research honeypots – These are used specifically for studying and analysing attacker behaviour, often in a sandbox environment.
  • Production honeypots – These are deployed in live networks to monitor and deflect real-world attacks.

A simple low interaction Honeypot

Benefits

I started this piece by saying I doubt if any of my clients would set up a honeypot.  They are expensive and resource heavy, but there are benefits:

  • Deflecting attacks – Honeypots can divert attackers away from valuable production systems, protecting critical assets.
  • Threat intelligence – They provide valuable information about attacker tactics, techniques, and procedures, helping organisations prepare for future threats.
  • Vulnerability assessment – By observing attacker behaviour, organisations can identify potential weaknesses in their security infrastructure.
  • Improved security posture – The knowledge gained from honeypots helps organisations strengthen their security defences and improve their overall security posture.

Who is likely to use a Honeypot?

Primarily honeypots are used by cybersecurity researchers and government agencies to monitor the latest threats and cybercriminal activities and methods, to improve defences.  This is especially true of companies that produce threat intelligence for their customers, and threat reports.

However, they might also be used by businesses to identify and analyse attacks targeting their production networks, helping them understand attack methods and improve their security posture. They can be used to distract attackers from critical assets and provide an early warning system for potential attacks. 

What is a Honeynet?

Research organisations might also utilise a honeynet.  A honeynet is a decoy network that contains one or more honeypots. It looks like a real network and contains multiple systems but is hosted on one or only a few servers, each representing one environment. For example, a Windows honeypot machine, a Mac honeypot machine and a Linux honeypot machine.

I hope you have found this brief introduction to honeypots interesting, if not particularly pertinent to you.  We do like to educate and spread the word in regard to cyber security.

Cyber Awareness Training General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security Tools

Cyber Security is a Business Issue

I know that I tend to include the statement in the title, in many articles and posts that I produce, but I haven’t really expanded on it and explained in more detail why I say that this is a business issue and one that owners and boards need to fully embrace if they are to stay safe.

We still see many ‘tick in the box’ exercises happening when we talk to SMEs, particularly when they have encountered an issue and tell us that they have taken precautions which, when examined, aren’t doing what the company thought, or perhaps hoped, they were doing.  Compliance and auditable solutions need to underpin what precautions you are taking.  If you can’t check and make sure that everything is up to scratch, and do it easily and often, then you have wasted your money. 

Far too much money is spent on one size fits all solutions and those that are reactive to one off threats, which produces a firefighter mentality that is at odds with the holistic preventive protection that is required to combat the current and emerging threat landscape.

This is not just a technical issue

A great quote which I use a lot comes from Bruce Schneier, an American scientist and

information security thought leader.  He says:

If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology.

And there’s a lot of truth in that statement, particularly when it comes to SMEs, simply because they don’t understand the technology, and leave it to the IT management company that looks after their network, who mainly focus on technology, because that’s their comfort zone and selling licenses is a big part of their business.  And neither the SME nor the IT Management company have a handle on the emerging threat landscape.

Another good quote comes from the Chair of the Australian Securities and Investments Commission.  He says, ‘If boards do not give cybersecurity and cyber resilience sufficient priority, this creates a foreseeable risk of harm to the company and thereby exposes the directors to potential enforcement action by [insert here your regions governance requirements] based on the directors not acting with reasonable care and diligence.’

Cyber security needs to be flexible and adaptable to the changing threats as they occur, because once they have become prevalent, it’s often too late to play catchup.  This means a holistic strategy that encompasses technology but also process, personnel, compliance and audit.  Don’t be complacent.  If you stand still, you will as they say, come a cropper.

Keep saying – PEOPLE, PROCESS and TECHNOLOGY – in that order.

Is there a Misleading Message Coming from the Technology Industry?

Perhaps, because there is a considerable amount of what we call FUD, fear, uncertainty and doubt, doing the rounds constantly. It concentrates people on thinking about specifics, instead of looking at the bigger picture.  Whilst there is no doubt that phishing, ransomware, and other scams have certainly concentrated the mind somewhat, and these attacks are most definitely not confined to the large enterprise businesses, but have been attacking, with a lot of success, the small to medium business market, this causes vendors to try and exploit the issues around that and push their technology solutions and of course, SMEs rarely, if ever, have the expertise to judge whether or not a particular product will actually give them the protection they need.  We now must add into the mix AI and its capacity for increasing cyber-attacks at all levels, making the production of malicious code so much easier and making it available to those perhaps less skilled than heretofore.

Another problem is that the advertising tends to give the impression that Cyber security is something new when in fact it’s just an evolution of the physical security issues that existed when information was all on paper.  Think of it like that and you’ll realise that it’s been around for a very long time and that what you are trying to protect is information of all kinds.  It’s information that makes your business work efficiently.  The very word Cyber brings with it the illusion that it’s something modern and/or futuristic, when in fact that word is essentially meaningless and the old description of Information Security or Infosec, is far more accurate and descriptive.  Cyber is a blatant attempt to push the technological aspect of information security.

Risk Management

I’m going to slip in a link to a short video on risk management as it pertains to Cyber (yes, I’m using that word because it’s sadly become de facto).  This video describes the process at a high level.

https://bit.ly/3FdZ6x0

Technology can be an essential part of your protection, but it must be targeted in the right way, which not only means you have the right piece of kit doing the right thing, but that you are targeting your IT spend to support your business goals and give a maximum return on investment (ROI).  It should also be married to good policies and processes that are enforceable and auditable and fully understood by your work force.  To do this you have to understand exactly what your risks, vulnerabilities and threats are to ensure that your solution to those risks, vulnerabilities, and threats, is targeted for maximum effect and ROI and that the technology is supporting the policies and processes, all of which is underpinned with good security awareness training.

It’s also necessary to have some way of measuring the effectiveness of your solutions through a monitoring or auditing solution.  Such solutions for SMEs have long been considered too expensive to even consider but that is no longer the case and affordable solutions are now on the market.

We must all grasp that these risks are owned by the board, and if you don’t have a formal board, then the management team.  This needs to be understood fully by those at the top.  They team need to understand what level of risk is acceptable and agree what risks they are prepared to tolerate to achieve the business aims.   They need to ensure that supporting policies are produced, implemented, understood by employees, and regularly reviewed and updated.  At H2 we tend to produce an information security and data protection handbook which can run into many pages.  Producing these policies is not as easy as it sounds.

You may also wish to look at some recognised standards by which you can regulate your risk management.  One such is the international standard for information security, ISO 27000 series but perhaps the most appropriate for SMEs is the Cyber Essentials Scheme which will help you demonstrate an appropriate level of information security and risk management within your company.

Once you have a risk management framework in place, owned from the top, then you can identify your information assets and assess the risk to your business should those assets be compromised in some way.  Then and only then can you adequately assess what processes and technologies you need to mitigate the risks identified for each asset thus targeting your spend for maximum effectiveness.

Sadly, that’s not the end.  User education is probably the most important element of all for SMEs.  Ensuring that your staff are aware of the policies and why they exist.  Protect yourself against scams which sadly, form the biggest danger to SMEs rather than hacks.  Scams can be very low tech or high tech using malware, but however they come in, your staff need to be aware of them.

Scroll to top