Month: May 2025

Cyber Awareness Training Data Breaches and their consequences General Security Issues Identity and Access Management Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security Tools

WHAT DO SMES REALLY NEED TO KNOW ABOUT CYBER SECURITY

Maybe I should have titled this ‘What do SMEs WANT to know’ rather than need to know.  That’s because all too often they want a very cut down version of what they need, because simply put, they don’t have the budget or expertise to get into too much detail and will often look for the easy way out.  That’s becoming more and more of a problem given the concerted effort by cyber criminals to attack all sizes and types of business, here in the UK.  I posted a bit about this earlier, you can read it here.  Do SMEs really need a cyber strategy and if so, what exactly does that entail.

What is a Cyber Security Strategy?

A cyber security strategy is a plan that outlines an organisation’s approach to protecting its information systems and data from cyber threats. This strategy typically includes measures such as implementing security controls, conducting regular risk assessments, training employees on security best practices, monitoring network activity for suspicious behaviour, and responding to security incidents in a timely manner. The goal of a cyber security strategy is to minimise the risk of cyber-attacks and protect the confidentiality, integrity, and availability of an organisation’s sensitive information.

Do I really need that – I’m an SME and not really a target, am I?

Well yes, you are a target and there are a ton of statistics available which shows that SMEs globally are a very real target for cyber-attacks and can in fact, be very profitable for cyber criminals.  There are a lot of reasons for that but one of the top reasons is that typically, SMEs spend very little on cyber defence and generally have very weak defences.  Add to this that they don’t tend to carry out cyber awareness training for their staff, have limited resources and generally don’t have a good grasp of the issues.

Not their fault.  Most are focused on their core business, trying make a quid or two and are pressed for time.  They tend to rely on whatever company, usually local, that supplied their network, hardware and software, generally on a retainer.  The problem is that those companies don’t really have a good grasp of the issues either, concentrating on technology, and then, not necessarily the right technology.

The real trick here is in devising a strategy that works whilst staying within budget and having the resources to make it work.  Not an easy path to tread but one that is very definitely a must.

Secure by default and design

Now that’s an interesting title, but what does it mean?  Secure by default and design means that a system or product is inherently built with security measures in place from the start. This ensures that security is a priority throughout the development process and that users can trust that their data and information will be protected. It also means that security features are enabled by default, reducing the risk of vulnerabilities or breaches. This approach helps to create a more robust and resilient system that is better equipped to withstand potential threats.

It applies as much to your network and systems as it does to software development and possibly more importantly to you, it is a legal requirement under the Data Protection Act 2018, or as it is becoming known, UK GDPR.

The first problem many people come up against is that they already have a network, probably connected to the cloud of some sort, very possibly for SMEs, MS365, but when the design was done, there wasn’t a full risk assessment undertaken which is a requirement to underpin that design.  In other words what we in the cyber security industry refer to as Security Architecture Design (SAD), wasn’t a prominent consideration.

Not unusual and the common technologies were probably set up, firewalls and anti-virus, but not much else.  And that is where a well thought out strategy comes into play.

What should I be considering in my Cyber Security Strategy

We’ve already said you are an SME, so do you need the sort of comprehensive cyber security strategy that we would see in a major corporate?  No, but it should still cover off the major points and should continue to be reviewed alongside things like your Health and Safety policy and other industry standards that are required to be reviewed for you to stay in business, usually annually.  I know, it’s a pain and you’ve got enough to do without increased paperwork.  But this isn’t red tape, this is designed to keep your business protected and can save you a lot of money, time and trouble.

You need to be thinking about the key components needed to effectively protect an organisation’s digital assets and data. These components may include:

  1. Risk assessment: Assessing potential cybersecurity risks and vulnerabilities to identify areas of weakness and prioritise areas for improvement.
  • Security policies and procedures: Establishing clear and enforceable policies and procedures for data protection, access control, incident response, and other security-related activities.
  • Employee training: Providing ongoing training and education to employees on cyber security best practices, such as password management, phishing awareness, and safe browsing habits.
  • Incident response plan: Developing a detailed incident response plan that outlines the steps to be taken in the event of a security breach or cyber-attack, including communication protocols, containment measures, and recovery strategies.
  • Collaboration with external partners: Establishing a partnership with cyber security company that understands the issues that affect SMEs and who themselves can establish a solid working relationship with the IT provider that is providing and administering your network and IT resources, will enhance your protections, significantly improve your employee and managerial awareness of the issues, and provide you with the peace of mind you need, allowing you to concentrate on your core business.

So, to wind this up, everyone needs a strategy that is tailored to them and covers off their needs.  In order to make sure that your cyber, or if you prefer, your information assets, are secured, you need to understand what they are and how vulnerable they are to attack.  Only then can you start to put in place protections that are appropriate to you, and affordable, making sure that your budget is spent wisely.  Don’t be put off by all the stuff above, some of it, or perhaps much of it, won’t apply to you, but some of it definitely will.  Don’t be afraid to take advice from those who know what they are talking about.

Data Breaches and their consequences General Security Issues News Security

Data Protection – A Timely Reminder

Data Protection is a somewhat dry subject that many companies, particularly SMEs, and many think they can get away from by simply paying a bit of lip service.  The Data Protection Act 2018, or as it has become known, UK GDPR, is far from a toothless beast and can cause businesses to find themselves in all sorts of problems if they’re not careful.

As M&S has discovered and now, the Ministry of Justice.   The cyber-attack was on the Legal Aid Agency and appears to have accessed a ‘significant amount’ of applicants’ personal data, to which the government admitted.  ‘This data may have included contact details and addresses of applicants, their dates of birth, national ID numbers [national insurance], criminal history, employment status and financial data such as contribution amounts, debts and payments,’ the MoJ said.

…….. ‘it has become clear that to safeguard the service and its users, we needed to take radical action. That is why we’ve taken the decision to take the online service down. We have put in place the necessary contingency plans to ensure those most in need of legal support and advice can continue to access the help they need during this time’.  Serious indeed.

Initial findings suggest that this is the result of systemic issues within the organisation which they have failed to correct, over many years.

What are the possible fall outs from this?

That very much depends on how the Information Commissioner views it.  If this is seen as negligence, then the potential fine could be very significant indeed.  If, on the other hand, it is deemed that the MOJ took all reasonable precautions that they could to protect the data, then that is a good mitigation which will reduce the potential punishment. 

But that’s not the end of it.  The reputational damage that this does is incalculable and the cost of fixing the issues will be high.  Then there is the potential for legal action by anyone whose data was compromised, that could easily be the biggest issues that the MOJ faces.

Only time and a thorough investigation will determine the outcome.

Data Protection and the SME

My subscribers wi8ll know that my focus is the SME, large and small.  So how does data protection impact them.  Not so long ago a London estate agent was fined £80,000 by the Information Commissioner’s Office (ICO), after leaving the personal data of more than 18,000 customers exposed for almost two years.

The incident occurred when the estate agent passed the details from its own servers onto a partner company. An “Anonymous Authentication” function was not switched off, which meant there were no access restrictions to the data.

It’s surprising just how much PII estate agents hold.  Just think about what they ask for when you’re buying a house.  In this case the exposed details included bank statements, salary details, copies of passports, dates of birth and addresses of both tenants and landlords.

Then, as above, that might not be the end of it.  Individuals can sue companies that release data into the wild.  In fact, there are now law firms advertising no win no fee when representing these cases.  Remember that data breaches almost always involve multiple people, sometimes hundreds if not thousands of records.

What size does a business need to be for the regulations to apply?

The regulations apply to all businesses large and small, although some exceptions exist for SMEs. Companies with fewer than 250 employees are not required to keep records of their processing activities unless it’s a regular activity, concerns sensitive information or the data could threaten an individuals’ rights.  Just exposing PII can threaten an individual’s right to privacy.

Just about everyone processes personal data of some sort.  Data that can identify a living individual.  HR data will have bank account information, home addresses, NOK, phone numbers, maybe references from previous employers.  The exposure of some or all of that could be judged as prejudicial to an individual’s rights.  Some companies may have bigger problems, for example Solicitors, Estate Agents, Financial Advisors and Recruiters (the list is not exhaustive), which hold an abundance of personal data about their clients, much of which, under other legislation they are required to retain for up to 7 years.

Do I need written policies and processes?

Yes – What this means is that a significant number of policies and processes will need to be written and taken into use by the organisation.  It is not unusual for many to visit the web and download templates to cover their requirements.  However, whilst these templates in themselves maybe adequate when used by someone who knows what the requirement is, they may be less than effective in the hands of someone who is just looking for a quick tick in the box.

How is UK GDPR effected by cyber security?

The Act requires personal data to be secured by ‘default and design’.  This means that cyber security requirements must be designed into your protections.  This could mean at least another 6 or 7 policies and procedures.

How can I keep track of all my PII holdings and keep it secure?

When we are first approached by a prospective client and we begin our offer of a 30 day free trial to examine their requirements, one of the first things we find is that they don’t know what data they are holding, or where it all is.  Oh, they have a general idea; it’s on the cloud server(s), it’s not on laptops or desktops, it’s just the stuff we need to process our clients’ requirements and yes, we’ve only got one copy.  And then we install our software that first carries out a discovery exercise and we find that their laptops/desktops are holding lots of copies of the data that is on the cloud server(s).  How does that happen?  Over time, especially with many now employing the hybrid system of working, ie between the office and remote (home) locations, employees log on to the cloud, find they have a bit of shaky internet link and download the data they need, work on it and then upload it again, forgetting to delete it from their machine.  Or they need to share it and attach it to an email and send it out, forgetting, or perhaps not realising, that the data is now stored, attached to an email, on their email server.

Then comes the issue with audit trails.  If the ICO ever wanted to carry out an investigation, then having an audit trail of who created/copied/deleted/forwarded what to who, is essential.  And let’s not forget the member of the public who is fully entitled to submit a Data Subject Access Request or DSAR, which demands that you reveal what data you are holding on that person.  The law insists on it, and you can’t refuse it.  I know of a financial firm that took nearly 3 weeks to satisfy a DSAR, taking an employee off billing, for that time.

Are there solutions suitable and affordable for SMEs?

We have a solution that meets the requirements and not only that, has a built in encryption system, all within the same monthly cost.  It’ll cost you nothing to trial it and we’d be very surprised if once you’ve seen it and seen the ridiculously low monthly charge for the managed service, you don’t want to keep it.

Cyber Awareness Training Data Breaches and their consequences Identity and Access Management News Ransomware, Phishing and other Malware Security Tools Supply Chain Security

Cyber Attacks on SMEs

We’ve posted a few pieces recently on why setting a realistic budget for cyber security is so important and we thought we’d follow that up with some real-life examples.

Small and medium-sized enterprises (SMEs) are increasingly being targeted by cybercriminals in 2025 and are facing a range of sophisticated threats that exploit limited resources and evolving technologies. Here’s a quick look at some of the most pressing cybersecurity incidents and trends that have affected SMEs so far this year:

Major Cybersecurity Incidents Impacting SMEs

  • Co-op Supermarket Chain Cyberattack (UK)

A “highly sophisticated” cyberattack disrupted Co-op’s IT systems, leading to customer data theft, contactless payment failures, and empty shelves in Scottish stores. The breach also affected other major retailers like Marks & Spencer and Harrods, with investigations pointing towards hacker groups such as Scattered Spider and Lapsus$. 

  • Lockbit Ransomware Group Breach

The notorious ransomware gang Lockbit was itself hacked, resulting in leaked communications that revealed aggressive targeting of small businesses for extortion. This breach has temporarily disrupted Lockbits operations and exposed their tactics.

  • Berkeley Research Group (BRG) Data Breach

A cyberattack on BRG compromised sensitive data related to Catholic Church sex-abuse cases. The attacker used impersonation tactics via Microsoft Teams to deploy Chaos ransomware, leading to concerns over the exposure of victims’ identities.

 Emerging Cyber Threat Trends for SMEs

  • AI-Powered Phishing and Deepfake Attacks

Cybercriminals are leveraging AI to craft convincing phishing emails and deepfake audio impersonations of executives, deceiving employees into authorising fraudulent transactions.

  • Ransomware-as-a-Service (RaaS)

The availability of RaaS platforms has lowered the barrier for launching ransomware attacks, making SMEs prime targets due to their valuable data and often limited security infrastructure.

  • Supply Chain Vulnerabilities

Attackers exploit weaknesses in third-party vendors to infiltrate SMEs’ systems, as seen in incidents involving compromised software packages on platforms like NPM.

  • Business Email Compromise (BEC)

Scammers use AI to mimic emails from corporate partners and managers, leading to fraudulent financial transactions. In Australia, BEC attacks have increased by 7% year-on-year, with SMEs being particularly vulnerable.

Proactive Measures for SMEs

To mitigate these threats, SMEs should consider the following actions:

  • Implement Multi-Factor Authentication (MFA)

Enhance account security by requiring multiple verification methods.

  • Regular Employee Training

Your staff are your first line of defence and need to be educated on recognising phishing attempts and social engineering tactics.

  • Secure Supply Chains

Vet third-party vendors for cybersecurity compliance and monitor for unusual activities.   Are you in a supply chain for a major company?  Are you facilitating a back door into their systems?

  • Invest in AI powered security tools

Utilise advanced solutions capable of detecting and responding to sophisticated threats.  H2 has a couple of suggestion here that are affordable to SMEs.

  • Protective Monitoring

How do you know that your expensive solutions are protecting you?  Do you know if you’ve suffered a stealth attack where the attacker has built a back door into your systems?  Do you know if you’re hard-earned cash is being siphoned off?  How vulnerable are you to an attack? A monitoring solution for SMEs is now available at an affordable price.

  • Data Loss Prevention

Are you sure you know exactly where all your data is?  Are you sure that documents attached to emails aren’t still sitting on your email server?  Do you know if other documents have been downloaded from your cloud storage whilst your staff work from home, and then uploaded but a copy is still sitting on their laptop?  Data proliferation over time is almost a given.  Can you encrypt your sensitive data so that even if it’s stolen, it’s useless to the thief?  An affordable solution now exists.

  • Develop an Incident response and business continuity plan

No matter how well you protect yourself, you still need to prepare for potential breaches with a clear strategy to minimise impact and recover operations swiftly.

Cyber Awareness Training General Security Issues Ransomware, Phishing and other Malware Security Supply Chain Security

FEAR, UNCERTAINTY AND DOUBT

Or as it’s known amongst cyber security sales teams, FUD.  It’s a tried and tested method of trying to hook new sales and is often used by sales teams at, shall we say, a slightly lower level than the top end enterprise sales teams who, like me, don’t like it and stay shy of it.

OK, so now I’ve established my ethical credentials, how do I let my clients and potential clients, know what the threats are and how vulnerable to them, they are.  There’s a fine line between FUD and education.  People don’t need to be scared into doing things, they need to be educated into it and they have every right to know what the threat landscape looks like, and how vulnerable they are to it.

What’s the Threat in 2025?

It is expected that in 2025, organisations can expect to face a variety of cyber threats, including AI-powered attacks (see https://hah2.co.uk/?s=Artificial+Intelligence), ransomware with complex extortion tactics (https://hah2.co.uk/?s=Ransomware), supply chain attacks (https://hah2.co.uk/?s=Supply+Chain), vulnerabilities in IoT and 5G networks, and the rise of deepfake technology. Cybercriminals are leveraging AI to automate attacks, develop advanced malware, and bypass traditional security measures. Additionally, ransomware attacks are becoming more sophisticated, with some now stealing data alongside encryption, increasing the pressure on victims to pay. Supply chain vulnerabilities are also a major concern, as attackers can target third-party vendors to gain access to larger networks. The increasing number of IoT devices (see https://hah2.co.uk/?s=IOT) many of which lack robust security, also presents a significant challenge, as they can be easily exploited for attacks that disrupt critical infrastructure. Deepfake technology is also becoming more accessible, making it easier for attackers to create realistic fake content for various malicious purposes. 

How Does This Impact SMEs?

So where do SMEs sit in this space?  There is still the perception amongst them that they are too small to be worth attacking, that the rewards for the cybercriminals aren’t enough and they won’t bother.  Well, let’s debunk that.  SMEs are seen as low hanging fruit.  They will have much smaller budgets than the bigger players, they will almost certainly outsource their IT and as I’ve said often, you can outsource your IT, but not your responsibility.  There is a dearth of cyber security expertise, not just within the SMEs themselves, but also amongst the IT outsourcers they use.

In 2025, it is anticipated that SMEs will face evolving cyber threats, including AI-powered phishing, ransomware, and supply chain vulnerabilities, along with insider threats and IoT exploits. AI is going to have a very real impact on the attacks designed against SMEs.  Why?  Because AI provides automation, and automation is the key to making real money when attacking SMEs.  Think it through.  If a criminal organisation can attack hundreds, if not thousands of targets using one automated attack, with an expectation of say 50% success, with extremely little effort using AI, then that’s good business for them.  AI-driven attacks are predicted to be a top concern, with sophisticated phishing campaigns and deepfake fraud attempts on the rise. Ransomware continues to pose a significant risk, especially for SMEs with limited cybersecurity resources. 

Supply Chain Security

Supply chain vulnerabilities are also a growing concern, as hackers can exploit connections with external vendors to breach multiple businesses.  This latter should be a very real concern for any SME that is in the supply chain of a major organisation.  Just imagine the consequences for that SME if their customer is attacked, losing money and reputation, and can pinpoint the attack as coming via the SME.  How would that impact the SME?  Well, the financial and reputational consequences would probably kill their business.

Ramsac, in their 2025 SME threat report, tells us that a mid-sized UK logistics company fell victim to a ransomware attack in June 2023. They infiltrated the company’s network and left a note on screens: “If you’re reading this, it means the internal infrastructure of your company is fully or partially dead.” The attackers had encrypted the firm’s files and threatened to leak confidential data, essentially holding the business hostage.  They also reported that a large retail breach occurred when attackers compromised a small HVAC subcontractor (with far weaker IT security) and used those credentials to penetrate the larger corporate network. That attack led to the theft of millions of customer card details and tens of millions of dollars in damages – all traced back to a third-party SME vendor being hacked via a phishing email.

In Summary

We published a piece recently about cyber security and the SME and rather than repeat it here, we’ll simply give you the link – https://hah2.co.uk/cyber-security-and-the-sme/.  It reiterates some of my hobby horses, chief amongst them being cyber awareness training.  I’ve said before, but it bears repeating, that your staff are your first line of defence and are either your greatest asset, or your greatest risk.  The actions you take as an owner/director/manager, will decide which.

SMEs are facing increased pressures on their resources and the temptation to park cyber security until times are better, increases alongside those pressures, but avoid complacency, let’s discuss what you might be able to do procedurally and at low cost. If you have invested in tech, is it the right tech and is it doing what you think it’s doing? That’s never a given.

Scroll to top