Cyber Security – Some Facts

• In the last year, 39% of all businesses in the UK were the victim of a cyber-attack
• 20% of these lost money or data as a direct consequence
• 31% of these estimated they were attacked at least once a week
• The average financial loss to a business is £19,400
• Phishing emails continue to be a major threat to businesses
• Hacking of social media and email accounts to extort victims or to enable cases of fraud is increasing – over 8,000 cases in 2021/22, an increase of 23.5% on the previous year
• Ransomware attacks are one of the most serious threats to businesses and organisations – they can prevent users accessing their devices, network, and data, and confidential information can be deliberately leaked unless a ransom is paid
• There is a rise in Ransomware as a Service (RaaS) transactions where sophisticated ransomware programmes are leased to less technical cyber criminals so they can launch their own attacks
• Most ransomware criminal gangs that target the UK are based in and around Russia
• The NCSC (the National Cyber Security Centre) dealt with more than two million malicious cyber campaigns over the last 12 months
• 63 cyber-attacks needed a national level response
• Only 33% of businesses conduct a cyber risk assessment
• The percentages of business which have Cyber Essentials certification is climbing but is still far too low.
• 45% of businesses have staff using personally owned devices to carry out work related activities (BYOD – Bring Your Own Device policy)
• Only 14% of businesses invested in threat intelligence and only 17% carried out a cyber security vulnerability audit
• Only 23% of businesses have a formal cyber security strategy and only 38% have any kind of cyber security insurance (with only 5% having a dedicated cyber security insurance policy)
• Only 17% of businesses have had training or awareness raising sessions on cyber security in the last 12 months

Glossary

Phishing

Fraudulent attempts to extract important information, such as passwords, from staff.

Ransomware

A type of malicious software designed to block access to a computer system until a sum of money is paid.

Malware
Malware (short for “malicious software”) is a type of computer program designed to infiltrate and damage computers without the user’s consent (e.g. viruses, worms, Trojan horses etc).

Threat Intelligence

Threat intelligence is where an organisation may employ a staff member or contractor or purchase a product to collate information and advice around all the cyber security risks the organisation faces.

Sources

1. The National Cyber Security Centre (NCSC), part of GCHQ
2. UK Government Official Statistics – Cyber Security Breaches Survey

Hybrid Working

Welcome to the changing world of work

Whether you’re an employer or an employee, you’ll know the world of work has changed.

The global Covid-19 pandemic and national lockdowns around the world meant factories shut their gates, shops closed their doors, and offices were forced to quickly transition to remote working. And this has fundamentally changed how many businesses operate today.

According to the Office of National Statistics (ONS), despite lockdown being over, a significant percentage of all UK staff now work remotely some or all of the time.

But these hybrid staff are not just working from home when they’re not in the workplace. They are also working from coffee shops, in shared working spaces, in airports and motorway service stations, and from other locations outside of most SME’s security boundaries.

What’s more, they are connecting to your network, downloading and uploading files, and sharing business sensitive information in more ways than ever before. And they’re using Cloud services and messaging apps (such as WhatsApp), and other communication systems and sharing tools, to ‘do business’ because they’re fast and easy.

But this hybrid way of working, and the speed and convenience of these systems and tools, comes at a cost. Your business information and data is now distributed like never before outside of your network and stored in locations that you may never know about.

For today’s cybercriminal, this presents a huge opportunity. They no longer need to target a company through their workplace network; instead, they can target businesses and their employees – and most importantly, their sensitive and confidential data – on the sites and in the places outside of your protected security network.

That’s why hacking of social media and email accounts to extort victims or to enable cases of fraud has increased by more than 23% over the last year.

And why the NCSC (the National Cyber Security Centre) had to deal with more than two million malicious cyber campaigns.

But with 39% of all businesses in the UK becoming the victim of a cyber-attack, the threats to SMEs in today’s hybrid world are increasing.

The Challenge for SMEs

In the UK and Europe, a business is classified as a SME (a Small to Medium-sized Enterprise) if it has fewer than 250 staff and a turnover of less than €50 million or a balance sheet of less than €43 million (although this definition has changed over the years).

And according to the DTI, 90% of UK GDP comes from SMEs including micro businesses with fewer than 10 staff.

But worryingly – but perhaps not surprisingly – the NCSC (the UK’s cyber security authority) and ENISA (the EU equivalent) are predicting a spike in cyber-attacks on SMEs, following a rise in attacks on smaller businesses in the US and Australia.

Why are SMEs the main target of cybercriminals?

There are two main reasons why cybercriminals are increasingly targeting smaller businesses, as follows:

1. Resources

Cybercriminals know that most SMEs don’t have the resources of enterprise level companies and therefore haven’t invested in the cyber protection that larger companies often do.

Many enterprise level companies use Managed Security Service Providers (MSSP’s) to provide the cyber protection they need, sometimes working alongside their own internal dedicated cyber security staff.

Most SMEs simply don’t have the ‘deep pockets’ to do this, making them an easy target for cyber attackers. 

2. Level of concern

For many smaller businesses, cyber security is simply not something they believe is a priority compared to the numerous other things they have to worry about.

And in most cases, they believe that they are already effectively protected because they use an outsourced IT partner (for things like managing their network or supplying hardware) or because they use Cloud based systems.

But cybercriminals know that things have changed since the onset of Covid and that more and more employees are now working remotely and using many different systems and online tools, outside of their traditional IT security boundary.

What’s more, many companies have adopted a Bring Your Own Device (BYOD) policy that means staff can use their own personal devices – such as laptops and phones – for work purposes.

All of this means cybercriminals have more points of entry then ever before to launch an attack.

Zero Trust Architecture and Shadow IT

When companies have files located in different places and spread across various systems and Cloud based solutions, they need what is known as a zero trust architecture. This model assumes that security breaches will happen, particularly as important data is held on third party systems such as communication apps and third party portals, which are collectively known as shadow IT.

SMEs typically do not understand the principles of zero trust architecture and use (or fail to monitor) shadow IT, meaning they rarely truly know all the locations where their data is held and whether it is protected.

Cyber Security Principles

Despite not having the resources of enterprise level companies, the basic principles of cyber security are the same for small businesses as they are for much larger ones.

Principle 1 – Understand the value of your data

Whether you’re a multibillion pound conglomerate or a sole trader working from home, the first thing you need to know is the value of your information assets and data. This could include your customer records, financial information, your passwords and system login details, intellectual property, and much more. All data has a monetary value.

One way to calculate the value of this is to estimate what the cost would be to your business if this data and information was compromised or stolen. Would the situation be recoverable, or would it mean the end of your business, both financially and reputationally? And even if you’re one of the 5% of UK companies that has a dedicated cyber security insurance policy, would this cover you for all the losses you would experience?

Principle 2 – Understand the threats

Do you really know what cyber-attacks could threaten your business? Could cyber criminals send you or your colleagues phishing emails in an attempt to extract important information or passwords? Or could they attempt to install ransomware software on your network that could lock you and your team out of your systems until a ransom is paid? Or could a virus, worm, or a Trojan horse be installed on your network due to a malware attack aimed at damaging your systems?

It’s important you know the threats facing your business in order to understand your vulnerability to those threats.

Principle 3 – Understand your vulnerability

How exposed is your business to the possibility of a cyber-attack? To understand your vulnerability, think about any security measures you have in place, as well as gaps in your protection that may be easily exploited by a cybercriminal. 

But keep in mind that like many other companies nowadays, your staff are most likely working outside of the traditional workplace environment some (if not most) of the time, and the locations they are now working from – and the methods they use to communicate, share, and work – are likely to be outside of your traditional network boundary. This greatly increases your vulnerability to a cyber-attack.

Principle 4 – Know your risk and mitigate

Once you know the value of your information, the threats that exist, and your vulnerability to a cyber-attack, you’ll know the risk that faces your business. But rather than believing you need to eliminate all risk – which even enterprise level companies and national organisations and governments struggle to do – you need to mitigate it to a level that is acceptable for your business.

This may involve implementing new security procedures or installing new software or changing how staff work or providing cyber security training, so all staff know what to watch out for. Or it could mean you have a cyber security audit carried out on your business or hire a (on-premises or remote) Cyber Security Officer who actively monitors your systems and protects you from existing and new cyber threats.

Perimeter-less 360^o Protection for SMEs

In today’s hybrid world, what’s needed is a new approach to cyber security. A solution that provides advanced shield technology (proactive protection against all known and unknown security threats) and has the following features specifically designed for SMEs:

• Works inside and outside of traditional IT security boundaries across all devices, systems, and platforms
• Is built for a ‘perimeter-less’ ecosystem
• Is designed for zero trust architecture and the use of shadow IT
• Is low cost and flexible
• Doesn’t impose unwieldy security barriers or restrictions but rather has been created to provide protection however and wherever staff are working
• Protects against all external threats including ransomware (which most data loss prevention solutions don’t)
• Has the ability to block ‘zero-day’ threats (an attack that exploits a security vulnerability which a developer has zero days to fix) before a business has even identified that such a threat exists
• Stops all attempts to write known and unknown malware onto the permanent storage of any device
• Doesn’t require a big (and often expensive) effort setting up blocking rules or ongoing costly maintenance
• Doesn’t cause any performance issues and has no impact on a device’s RAM or CPU
• Is a real-time low maintenance ‘fit and forget’ solution that blocks 100% of unauthorised attempts to modify a business’s IT systems

An Innovative Solution

H2 Cyber Risk Advisory Services has developed a low cost managed cyber security solution for SMEs that is designed specifically for hybrid working and 360^o perimeter-less protection.

360^o Real Time Work Anywhere Cyber Protection fuses industry leading cross platform data discovery functionality with robust and innovative data flow monitoring capabilities so that you’ll know where every one of your files and all of your data is and how to protect it.

It provides both valuable insight and protection to stop you becoming the next victim of cybercrime.

Insight

• The system analyses your cyber-attack vulnerabilities and risks factoring in every device connected on your network.
• It quantifies the threats against your organisation’s particular appetite or tolerance for risk.
• It prioritises responses based on factors important to your business and monitors the effects of your actions.
• It provides clear actionable insight including security recommendations such as security patches, updates, or workarounds.

Protection

• Advanced shield technology that provides a ‘one time’ fit security solution that prevents against malware, ransomware, zero-day attacks, and all other cyber threats, known and unknown.
• Shield technology does not use signatures so there is no need for constant updates to add newly discovered threats and no risk of becoming a zero-day victim.
• The system proactively scans workstations, laptops, and other devices for sensitive data using smart patterning, and assigns a financial value to the risks you’re exposed to.
• It tracks and audits data risk in real time by continually monitoring incoming and outgoing sensitive data flows to and from your perimeter-less organisation.
• It uses a patented encryption process to automatically secure sensitive data across all endpoints, Cloud apps, third party portals, and shadow IT.  The entire process from initial deployment through to data risk analysis and remediation by automatic encryption takes as little as 72 hours.

Benefits

H2’s 360^o Real Time Work Anywhere Cyber Protection provides the following benefits:

• Perimeter-less cyber protection for wherever you or your staff are working – at home, in a coffee shop, at an airport, or anywhere else

• Ideal for remote and hybrid workers

• Real time 24-hour protection inside and outside of the Cloud

• Protects your network, your devices, and your information

• Enterprise grade shield technology specifically developed for the growing number of SMEs being targeted by hackers and cyber criminals

• 360^o protection against data breaches and cyber-attacks and scams

• Simple subscription-based per month pricing – pay for just what you need and cancel anytime with 30 days notice

Ask yourself, do you know with absolute certainty where your data is?  Are you sure that an employee hasn’t downloaded a piece of sensitive data onto their laptop or desktop at home to work on, before uploading it again?  Have they forgotten to remove the copy they have on their machine, resulting in there now being two copies of the sensitive data, one sitting outside of your security boundary or outside of your Cloud systems? Or have they used a shadow IT tool, such as WhatsApp or some other communication system, to share the data outside of your network?

Ask about our free no-obligation trial to see how H2’s 360^o Real Time Work Anywhere Cyber Protection can protect your business however and wherever your staff are working.

The Experts in Cyber Protection

H2 Cyber Risk Advisory Services was founded by industry leading experts in cyber protection who previously worked for a number of Fortune 500 companies, national governments, and leading technology companies including Symantec, Hewlett-Packard (HP), and BAE Systems.

Their experience in the security sector goes back to the late 1980s and includes designing the first security operations centre for the Foreign and Commonwealth Office (FCO), as well as leading security projects for the Ministry of Defence (MOD) and the Passport Office.

H2 was established in 2016 to provide the same quality of cyber and data protection to mid-market businesses and SMEs in the UK.

What else can H2 do for you?

As well as providing 360^o Real Time Work Anywhere Cyber Protection, H2 provides the following services, each of which can be bundled into a comprehensive managed service:

• Managed Cyber Security Officer – dedicated remote cyber security expert who proactively monitors your systems and cyber threats to your business, offered on a number of hours a month basis to suit the client
• Innovative anti-malware solutions – these protect against malware threats and ransomware attacks
• Patch management across your entire network
• Cyber maturity assessments – examines and analyses all aspects of your cyber security stance, including policies and processes
• Cyber Awareness Training for your staff – aimed at IT users and non-technical staff, and offered on-line as well as face to face
• Cyber Essentials and Cyber Essentials + certification

Contact

H2 Cyber Risk Advisory Services

T: 0800 4947478

E: hello@hah2.co.uk

W: www.hah2.co.uk