June 2025 - H2 Cyber Security for SMEs

Disaster Recovery and Business Continuity

We talk a lot about data breaches, ransomware and other attacks and how we need to protect ourselves as well as we can, against such attacks. But as well and good as our defences are the old saying applies, ‘Aim for the best but prepare for the worst’. And that’s the subject today.

Disaster recovery and business continuity are very much connected but are different. The former is basically a plan for when things go sideways, like when a natural disaster hits, a cyberattack happens, or even if there’s a major tech failure. It’s all about making sure that businesses can bounce back and keep things running as smoothly as possible. Imagine your favourite coffee shop gets flooded. Disaster recovery is like their game plan for getting back on their feet: they might have backup equipment stored somewhere, a way to communicate with customers, and a strategy for cleaning up and reopening. In the tech world, it often involves regular backups of data, having alternate servers ready to go, and making sure everyone knows what to do in case of an emergency. The goal? To minimise downtime and get everything back to normal without too much hassle. It’s like having an insurance policy but for your operations, very important for keeping the lights on when the unexpected hits!

However, we need to understand that when it comes to the type of outages caused by supply chain cyber failures as we saw with CloudStrike, there isn’t much a customer can do to recover from that, without fixes from the suppliers. So, in this instance disaster recovery planning becomes a little difficult to say the least.

Business continuity on the other hand, is all about making sure that a company can keep running smoothly when it is deprived of their IT systems, in whole or in part. So, it’s about keeping business running whilst the disaster recovery plan kicks in and gets stuff back online. The idea is to have a plan in place that helps the business bounce back quickly. This includes figuring out which critical functions need to keep going, having some way of operating manually if necessary. Can you place an order, process an order, raise an invoice, pay a bill etc. It’s like having an emergency kit for your business, batteries included! Companies should create a business continuity plan (BCP) that outlines the steps they’ll take during a crisis. This way, they don’t just react on the fly; they can hit the ground running. It’s all about minimising downtime and keeping customers happy. In short, it’s like being prepared for a rainy day.

The first thing to decide is what the priorities are regarding business processes. What is essential, what is a nice to have and what you can live without in the short to medium term. Don’t leave it to managers and staff to guess, have it documented. This priority order is determined based on what is known as a business impact analysis (BIA). This determines the impact of an outage on the business and its customers. Don’t ever forget that your reputation is on the line, and you need to keep your customers serviced and happy. Each business process should have recovery time attached to it, ie how long you can do without it before it becomes truly disastrous.

It all sounds terribly complicated and therefore expensive, but in fact, it isn’t. All the information you need to work this out is already in your hands. You know your business best and you know what’s important and what isn’t quite so important. You just have probably never written it down. And that’s the crux of the matter.

Disaster recovery planning addresses the processes, technical requirements and infrastructure an organisation needs to implement to recover data and operations as required by the business in the event of a disaster. The planning process will involve identification of critical business processes, business impact analysis and thus determination of the overall requirements for a cost-effective plan.

Following the disaster recovery plan, business recovery planning is the process that organisations must use to assess appropriate timeframes for business resumption, also allowable data losses and risk tolerances for business disruptions. As stated earlier, it also needs a plan to carry on manually whilst the disaster recovery plan is implemented. Budgetary requirements for infrastructure and processes, to meet the disaster recovery plan, will also be determined by the business recovery planning process.

There are also 2 other key parts to this. Firstly, companies must ensure that their plans are tested, that everyone in the company is aware of them, where they can find them, and what their responsibilities are in this regard. Testing is critical to ensure that processes, systems and business restoration can meet the requirements laid down for them. Where the plans rely on third party service providers and/or indicate the need to support key customers, these should be involved in the testing process. This will give re-assurance that support will be received and/or given as expected.

And then we have key stakeholders. Who in your organisation is responsible for what, regarding disaster recovery and business continuity planning? Do they know their respective responsibilities, have they accepted this? Have you placed this in their job descriptions? Can they be held to this responsibility? Are they part of the planning and testing process? All seems a bit obvious when you say it, but you’ll probably not be surprised to know that it’s often totally overlooked.

Key Stakeholders	Roles and Responsibilities
CEO/Board of Directors	Aware of business continuity processes, inputs as required Approval of business continuity processes and integration with other technical functions – Note 1 Ownership of business continuity processes together with relevant business units – Note 1
Infrastructure (IT operations)	Input into business continuity processes. Consideration of any infrastructure changes which may impact security architecture. Provide inputs and coordination for systems’ resiliency testing and remediation. Provide costs/budgets for systems requirements
Business units	Creation of BIA and corresponding recovery requirements. Budgetary approval.

Note 1 – these two functions would be carried out by a CIO and/or and CISO in a larger organisation, but as most, even top end, SMBs are unlikely to have anyone in that role, then it must be owned by other board members.

Protective Monitoring for SMEs

Security operations is a complex subject and there is no doubt that it can be expensive and difficult, even for corporate organisations who generally have the resource, both financial and technical, to run a security operations centre (SOC), or at least can afford to outsource. I saw an RFP from a housing society for a SOC and I would be very interested to see if that contract gets let once the organisation gets the quotes, because I would be shocked if they could afford it.

Their RFP based its premise on the introduction of a Security Information and Event Management system (SIEM), which.in itself, might suggest that they don’t really know what they are asking for, or indeed, what they want. I base this on having designed, built and operated several such operations centres in the past.

Now before the SIEM vendors and resellers pile on, let’s be clear, SIEM systems have their place and are very useful in a SOC, although I would argue that they are most certainly not the end all and be all. My focus these days is on SMEs and for an SME there are several reasons why a SOC and an SIEM may be over the top and a cost too far.

Whilst an SIEM system is a valuable tool for cybersecurity, it comes with several drawbacks, including:

a. High Cost

Expensive Implementation – SIEM systems require significant upfront costs for software, hardware, and licensing.
Ongoing Costs – Maintenance, updates, and skilled personnel add to long-term expenses.

b. Complex Deployment and Management

Difficult Configuration – Setting up a SIEM system to work effectively requires extensive tuning and integration with various security tools.
Frequent Fine-Tuning – To avoid false positives and negatives, organisations must continuously refine alert rules and correlation policies.

c. High Volume of Alerts and False Positives

Alert Fatigue – SIEM systems generate numerous alerts, many of which are false positives, overwhelming security teams.
Difficult Prioritisation – It can be challenging to distinguish between critical threats and routine events without proper tuning.

d. Scalability Issues

Performance Bottlenecks – As an organisation grows, more logs and data sources can slow down the system.
Expensive Scaling – Scaling a SIEM to handle increasing data volumes often requires costly upgrades.

e. Need for Skilled Personnel

Expertise Required – SIEM systems need cybersecurity professionals to manage, analyse, and fine-tune them effectively.
Shortage of Talent – Finding skilled SIEM analysts can be challenging and expensive.

f. Storage and Compliance Challenges

Log Retention Costs – Storing large volumes of logs for compliance can be expensive.
Regulatory Complexity – Ensuring compliance with data protection laws (e.g., GDPR) requires careful log management.

h. Limited Threat Detection Without AI/Automation

Reactive Approach – Many traditional SIEMs rely on pre-set rules, making them less effective against new or sophisticated threats.
Lack of Automation – Without AI-driven analytics, manual investigation can be time-consuming.

Having debunked the usefulness of an SIEM system for an SME, let’s look at what an SME could do to mitigate their cyber risks.

A good cyber security strategy has always been founded upon strength in depth. Sound security architecture, good cyber awareness training, solid access control and identity management, and the ability to protectively monitor your estate for threats, vulnerabilities, and risks.

If you are not monitoring the effectiveness of the protections, you have spent good money on, how do you know it’s money well spent? Are those protections doing what you think they are. Monitoring is central to the identification and detection of threats to your business. It acts as your eyes and ears when detecting and recovering from security incidents and it enables you to ensure that devices are used in accordance with your organisational policies.

Many small to medium-sized businesses struggle with stretched resources, lean budgets, and a critical technical expertise gap. This fight against sophisticated cyber threats and outdated systems turns them into easy targets for cybercriminals. Exposed and at risk, these businesses stagger on the edge of significant disruption, financial loss, and reputational damage. Although on the surface an SIEM system might seem to be what an SME needs, it would not fit the profile of most SMEs, being too resource intensive and costly.

We have been researching the market, looking for a way of providing a security managed service that would serve an SME, at an affordable price. And we think we’ve found it – no, we are SURE we have found it. Simplicity is at its core, employing enterprise-grade technology to simplify and streamline the day-to-day work. Our unified platform and onboarding process, seamlessly detects, prevents, and responds to cyber threats in the most holistic, hassle-free, and cost-effective way.

We are offering a 14 day free trial and will cover:

Email security.
Cloud data.
Automated cyber awareness training.
External risk.
Endpoint security.
Secure browsing.
Phishing simulation.
And as an added bonus we can provide cyber insurance at a price which is directly linked to your risk score within or system. The lower your risk, the cheaper the insurance.

This system is deliberately aimed at 1-250 IT users in your business. Most SMEs come in around 10 to 15 IT users, but we’re not precious about it. It is a managed service, and we have our eyes on the glass and can mitigate your risks in concert with our clients providing advice, guidance and remediation as part of the service. All this for a mere £12 per user per month.

Check it out at the link below.

Cyber Security: why do I need protective monitoring?

Supply Chain Attacks

There have been a number of recent cyber-attacks that have used supply chains that many large businesses have. These businesses rely on smaller ones to provide key components that they require in their manufacturing or other processes. That supply chain is critical to their operations and therefore needs to be robust and secure. An attacker is constantly looking for weak links in cyber defences, that can be exploited for financial gain. They will look at an SME as such a weak link, expecting the SME to have a lower understanding of the threat, and lower expenditure on defence. They will be looking to piggyback on loopholes in the suppliers defences, to attack their main target.

A cyberattack on a supply chain can have far-reaching and severe consequences, not just for the targeted organisation, but also for its partners, customers, and even national security when considering the critical national infrastructure, nuclear, transport, energy, water etc. In short SMEs are a high‑risk conduit for supply chain attacks. Even minor breaches in small firms can ripple out, causing data loss, operational shutdowns, regulatory scrutiny, and reputational damage—highlighting why third‑party cybersecurity should be a top priority for all.

What real world examples can we give, particularly in the UK. Below are some notable UK supply chain cyber‑attacks that impacted SMEs and their customers, especially within third-party and vendor ecosystems

CTS breach — affecting dozens of UK law firms via SME IT provider

In 2023, CTS, a small IT supplier to multiple conveyancing and legal firms, was compromised. This granted attackers access to the networks of multiple SMEs in the legal sector, enabling potential data theft and operational disruption.

Metropolitan Police — hack via a small supplier

In 2023, hackers penetrated the Metropolitan Police by targeting a supplier responsible for police ID badges. Because the SME provider’s systems were breached, attacker access extended to personal staff data (names, ranks, photos, pay numbers), highlighting how SMEs serve as gateways for attacks on major institutions.

Synnovis ransomware — disrupting NHS clinical services

In June 2024, Synnovis, a pathology service provider for NHS hospitals, was hit by a Clop ransomware attack. Though Synnovis is not a front-line NHS body, as an essential subcontractor, the breach led to cancellations and testing disruptions in major London hospitals.

Blue Yonder — supply chain SaaS hack hits supermarkets & small logistics partners

In November 2024, Blue Yonder, a logistics SaaS provider, suffered a ransomware attack. Major supermarkets like Sainsbury’s and Morrisons were impacted—but crucially, many small UK warehouses and logistics SMEs that rely on the platform had to revert to manual operations, enduring days or weeks of chaos.

Systemic SMEs-vulnerability in UK supply chains

Research shows 77% of UK SMEs lack in-house cybersecurity, making them “soft targets” for attackers looking to pivot into larger clients. Meanwhile, 95% of larger UK companies reported experiencing negative impacts via vendor incidents.

Why SMEs are often the weak link in supply chains

SMEs often run with minimal cybersecurity budgets, lacking formal certifications.
Granted privileged access to larger clients. Many large organisations operate a just in time supply system, requiring their suppliers to be integrated into their systems.
When compromised, they become easy stepping-stones into bigger networks.

Summary Table of SME related supply chain attacks

Incident & Date	SME Role	Impact
CTS (2023)	IT supplier to law firms	Dozens of SMEs exposed
Met Police (2023)	Badge/ID card vendor	Police data compromised
Synnovis (June 2024)	Pathology provider	Hospital labs disrupted
Blue Yonder (Nov 2024)	Logistics SaaS provider	SME warehouses/businesses disrupted

What consequences can we expect from a supply chain attack?

Data Breach and Intellectual Property Theft
- Exposure of sensitive data: Customer data, supplier contracts, or internal communications.
- Theft of intellectual property: Designs, formulas, or proprietary technologies can be stolen and exploited.

Operational Disruption
- Production halts: If a manufacturer’s software is attacked, it may stop production.
- Delayed shipments: Logistic partners may be unable to fulfil deliveries.
- Inventory management issues: Automated systems may become unreliable or inaccessible.

Financial Loss

• Direct losses: Ransom payments, remediation costs, and legal fees.

• Indirect losses: Lost sales, customer churn, and regulatory fines.

• Stock impact: Public companies may see a drop in share price following disclosure.

Ripple Effects Across the Ecosystem
- Third-party impact: A breach in one company can compromise many others (CTS attack).
- Supplier distrust: Loss of trust among partners can damage relationships and business opportunities.
- Geopolitical risks: If critical infrastructure or government suppliers are hit, it can trigger national security concerns.

Legal and Regulatory Consequences

Violations of GDPR, PCI, etc.: Leading to hefty fines and legal action.
Breach notification requirements: Mandatory reporting can hurt brand image and cause public fallout.

Reputational Damage

Loss of customer trust: Perception of weak cybersecurity can cause long-term brand damage.
- Negative media coverage: Public awareness of the breach can linger for years.

Competitive Disadvantage

Loss of proprietary data: Competitors may gain an edge.
Resource diversion: Time and money spent on recovery rather than innovation or expansion.

Protecting against a supply chain attack

This will involve a mix of technical, procedural, and strategic measures. You need to understand that technology alone will not protect you. You must take a risk managed approach and understand that these attacks target vulnerabilities in third-party vendors, partners, or software dependencies. They will employ social engineering techniques and phishing in all its forms.

Know Your Suppliers and Vendors

If you are managing suppliers:

Inventory all third parties: Maintain an up-to-date list of all external vendors, software providers, cloud services, and contractors.
Assess risk levels: Identify which vendors have access to critical systems or sensitive data.
Ensure that you suppliers are aware of your security policies and that they have agreed to abide by them. Audit that.
Include security requirements in contracts (such as regular audits, breach notification timelines, etc.).
Ask for compliance evidence (ie, Cyber Essentials etc.).

If you are a supplier to a larger organisation:

Know and understand your customers security policies and undertake to abide by them. Don’t pay lip service, actually do it.
Make sure you understand your contractual obligations in this regard. Failure to do so could put you out of business.

Use Zero Trust Architecture
Apply least privilege access to vendors and third-party applications.
Isolate critical systems from less-trusted networks using segmentation.
Verify before trusting: Always authenticate and validate access requests, even from trusted sources.

Secure Your Software Supply Chain
Ensure your software comes from reputable sources and is regularly updated and patches applied.
Validate the integrity of software updates (e.g., use code signing and secure CI/CD pipelines).
Monitor for tampered or malicious packages.

Continuous Monitoring and Audit

Monitoring has long been considered too costly for most SMEs with systems such as SIEM not only being expensive but requiring constant analysis by a SOC analyst. However, there is now a system which is effective, managed and within most SME budgets. H2 can advise on this.
Log and audit changes to critical infrastructure or data access.
Use threat intelligence to stay ahead of known supply chain threats.

Patch Management and Updates

• Stay current with software and firmware updates.

• Use automated patch management tools where possible.

• Vet updates from vendors for authenticity and origin.

Incident Response Planning
- Create and test a supply chain-specific incident response plan.
- Ensure you can quickly revoke unauthorised or administrative access if needed.
- Conduct tabletop exercises that simulate supply chain attacks.

Train Your Staff
This is often the most effective quick win any organisation can make.
Educate employees about phishing, social engineering, and how supply chain attacks often begin.
Train procurement and legal teams to evaluate vendors with security in mind.

There is a lot too this subject and you might feel that you need advice and guidance.

DO YOU HAVE A HANDLE ON CYBER SECURITY?

Over the years I’ve had some very interesting conversations with several people from multiple different verticals, many fitting comfortably within the SME bracket, around Cyber Security. The conversations tend to take a very familiar turn. The cry of, ‘I’m covered, my IT support company has put in a firewall and some anti-virus. They tell me all is good’. Slightly depressing but hardly surprising.

So why surprising? A lot of IT Support Companies providing managed services do a very good job of supplying and implementing networks and providing hardware and software. The Cyber Security field is one where resources are scarce and expensive. Cyber Security professionals take a very different view than IT support companies and come at security from the risk managed view and recognise that it is not just about technology and in fact, it’s about people, process and then technology. More about this below.

As we travel around and visit clients or potential clients, it is common to find that they have the view that adequate security is provided by technology. They rely on their IT provider to provide the guidance they need which tends to involve firewalls, anti-malware software and perhaps a backup regime. All well and dandy. I use a quote from Bruce Schneier, Fellow at the Berkman Center for Internet & Society at Harvard Law School, quite a bit, it goes like this:

‘If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology’.

A common misperception is that IT Security is the same as Cyber Security. That surprises a lot of people, so let’s explore it a bit. There is clearly a close symbiotic relationship between the two disciplines. I would argue, and I know this might meet with some disagreement, that IT security refers to traditional IT security methods which are technology based. Such as firewalls, anti-malware, end point protection etc. Whilst Cyber security is based very much on risk management which combines controls which are both non-technical and technical, following the principles of People, Process and Technology. A good cyber security professional will have a good handle on both approaches.

Even though cyber security and data protection have leapt to the top of many people’s agenda in recent years it is still common amongst many SMEs to believe that it is an IT problem, a technical problem rather than a business issue, even when recognising that the risk of a cyber intrusion or a data breach, impacts the business, the bottom line.

Since I first wrote about this, we now have the changing landscape of working practices. Many SMEs have adopted a more flexible approach to work and are utilising a more hybrid working pattern with some working from the office, some from home and other places. This does have financial advantages for an SME but brings with it a lot more security issues which many are either parking or outright ignoring.

The National Cyber Security Centre (NCSC), a department of GCHQ Cheltenham, estimated, before the hybrid working pattern starting to bed in, that if you are an SME then you have around a 1 in 2 chance of experiencing a cyber security breach. For the small business this could result in costs of around £1400, for the medium business, considerably more. One has just been hit for around £30000, which I am sure you will agree, can be extremely damaging to the bottom line of businesses operating under tight margins. And of course, it’s not just financial penalties but the reputational damage should your customers data and assets be affected as well.

Within the SME world there is an almost total reliance on third party IT providers. Is that a good thing, after all that’s in the IT providers area of expertise and responsibility, isn’t it? And here comes the controversial bit. Third party IT providers, particularly in the SME space, are pretty much exclusively value added resellers or VARs, i.e., companies that sell other company’s products. Now I’ve no problem with that per se, but it comes with issues. Notable amongst them is that these companies will have skill sets that are very much limited to the products they sell. Ie they are proficient in the installation and configuration of those products and their clients are offered those products whether they are best in class, or more importantly, whether they are the most appropriate for the task. Before I get a social media pile on, I know that some of the bigger VARs do sell multiple vendors products, but they are in a minority.

Before we go any further, let’s briefly explore some issues that are common amongst SMEs. Some common myths first:

Small to medium size businesses are not worth attacking.
Cyber Security is an IT Issue.
Technology will keep me safe.
My policies and procedures are up to the job.
My staff are young and have been brought up with IT. They know the score.

Now let’s look at some of the more common issues that we see often amongst SMEs:

Lack of awareness around the current real-world cybersecurity risks
False sense of security, with a heavy reliance and dependence on an external IT third-party provider
Lack of cybersecurity knowledge and understanding
Poor cybersecurity maturity and posture within their businesses
Lack of staff training (at all levels) – just like Health & Safety, cybersecurity is everyone’s responsibility.

Here at H2 we offer a cyber maturity assessment that is designed specifically for SMEs. It is a comprehensive evaluation of an organisation’s cybersecurity capabilities and readiness to effectively mitigate and respond to cyber threats. It involves a detailed analysis of the organisation’s cybersecurity policies, procedures, technologies, and practices. The assessment aims to identify potential vulnerabilities, weaknesses, and areas for improvement in the organisation’s cybersecurity posture.

During the assessment, cybersecurity experts typically examine various aspects, such as:

Governance and Management: Reviewing the organisation’s cybersecurity policies, risk management frameworks, and leadership’s commitment to cybersecurity.

Security Awareness and Training: Evaluating the level of cybersecurity awareness among employees and the effectiveness of training programs.

Technical Controls: Assessing the implementation and effectiveness of security technologies, such as firewalls, intrusion detection systems, antivirus software, and encryption mechanisms.

Incident Response and Recovery: Analysing the organisation’s incident response plan, including procedures for detecting, reporting, and responding to cyber incidents.

Security Risk Management: Evaluating how the organisation identifies, assesses, and manages cybersecurity risks.

Third-Party Risk Management: Assessing the organisation’s approach to managing cybersecurity risks associated with third-party vendors and partners.

Compliance and Regulations: Verifying the organization’s compliance with relevant cybersecurity regulations and industry standards.

The results of the Cyber Maturity Assessment provide valuable insights to the organisation, enabling them to enhance their cybersecurity defences and establish a more robust and resilient security posture. It helps organisations prioritise their investments in cybersecurity, address vulnerabilities, and strengthen their overall cyber resilience and provides a road map to reach a standard agreed with the management, taking full account of that managements risk appetite.

Month: June 2025

Disaster Recovery and Business Continuity

Protective Monitoring for SMEs

Supply Chain Attacks

DO YOU HAVE A HANDLE ON CYBER SECURITY?

Search

Recent Comments

Recent Posts

Archives