Author: Kevin Hawkins

Cyber Awareness Training Data Breaches and their consequences Identity and Access Management Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Supply Chain Security

Supply Chain Attacks

There have been a number of recent cyber-attacks that have used supply chains that many large businesses have.  These businesses rely on smaller ones to provide key components that they require in their manufacturing or other processes.  That supply chain is critical to their operations and therefore needs to be robust and secure.  An attacker is constantly looking for weak links in cyber defences, that can be exploited for financial gain.  They will look at an SME as such a weak link, expecting the SME to have a lower understanding of the threat, and lower expenditure on defence.  They will be looking to piggyback on loopholes in the suppliers defences, to attack their main target.

A cyberattack on a supply chain can have far-reaching and severe consequences, not just for the targeted organisation, but also for its partners, customers, and even national security when considering the critical national infrastructure, nuclear, transport, energy, water etc.  In short SMEs are a high‑risk conduit for supply chain attacks. Even minor breaches in small firms can ripple out, causing data loss, operational shutdowns, regulatory scrutiny, and reputational damage—highlighting why third‑party cybersecurity should be a top priority for all.

What real world examples can we give, particularly in the UK.  Below are some notable UK supply chain cyber‑attacks that impacted SMEs and their customers, especially within third-party and vendor ecosystems

  • CTS breach — affecting dozens of UK law firms via SME IT provider

In 2023, CTS, a small IT supplier to multiple conveyancing and legal firms, was compromised. This granted attackers access to the networks of multiple SMEs in the legal sector, enabling potential data theft and operational disruption.

  • Metropolitan Police — hack via a small supplier

In 2023, hackers penetrated the Metropolitan Police by targeting a supplier responsible for police ID badges. Because the SME provider’s systems were breached, attacker access extended to personal staff data (names, ranks, photos, pay numbers), highlighting how SMEs serve as gateways for attacks on major institutions.

  • Synnovis ransomware — disrupting NHS clinical services

In June 2024, Synnovis, a pathology service provider for NHS hospitals, was hit by a Clop ransomware attack. Though Synnovis is not a front-line NHS body, as an essential subcontractor, the breach led to cancellations and testing disruptions in major London hospitals.

  • Blue Yonder — supply chain SaaS hack hits supermarkets & small logistics partners

In November 2024, Blue Yonder, a logistics SaaS provider, suffered a ransomware attack. Major supermarkets like Sainsbury’s and Morrisons were impacted—but crucially, many small UK warehouses and logistics SMEs that rely on the platform had to revert to manual operations, enduring days or weeks of chaos.

  • Systemic SMEs-vulnerability in UK supply chains

Research shows 77% of UK SMEs lack in-house cybersecurity, making them “soft targets” for attackers looking to pivot into larger clients. Meanwhile, 95% of larger UK companies reported experiencing negative impacts via vendor incidents.

Why SMEs are often the weak link in supply chains

  • SMEs often run with minimal cybersecurity budgets, lacking formal certifications.
  • Granted privileged access to larger clients.  Many large organisations operate a just in time supply system, requiring their suppliers to be integrated into their systems.
  • When compromised, they become easy stepping-stones into bigger networks.

Summary Table of SME related supply chain attacks

Incident & DateSME RoleImpact
CTS (2023)IT supplier to law firmsDozens of SMEs exposed
Met Police (2023)Badge/ID card vendorPolice data compromised
Synnovis (June 2024)Pathology providerHospital labs disrupted
Blue Yonder (Nov 2024)Logistics SaaS providerSME warehouses/businesses disrupted

What consequences can we expect from a supply chain attack?

  • Data Breach and Intellectual Property Theft
    • Exposure of sensitive data: Customer data, supplier contracts, or internal communications.
    • Theft of intellectual property: Designs, formulas, or proprietary technologies can be stolen and exploited.
  • Operational Disruption
    • Production halts: If a manufacturer’s software is attacked, it may stop production.
    • Delayed shipments: Logistic partners may be unable to fulfil deliveries.
    • Inventory management issues: Automated systems may become unreliable or inaccessible.
  • Financial Loss

         •       Direct losses: Ransom payments, remediation costs, and legal fees.

         •       Indirect losses: Lost sales, customer churn, and regulatory fines.

            •     Stock impact: Public companies may see a drop in share price following disclosure.

  • Ripple Effects Across the Ecosystem
    • Third-party impact: A breach in one company can compromise many others (CTS attack).
    • Supplier distrust: Loss of trust among partners can damage relationships and business opportunities.
    • Geopolitical risks: If critical infrastructure or government suppliers are hit, it can trigger national security concerns.
  • Legal and Regulatory Consequences
  • Violations of GDPR, PCI, etc.: Leading to hefty fines and legal action.
  • Breach notification requirements: Mandatory reporting can hurt brand image and cause public fallout.
  • Reputational Damage
  • Loss of customer trust: Perception of weak cybersecurity can cause long-term brand damage.
    • Negative media coverage: Public awareness of the breach can linger for years.
  • Competitive Disadvantage
  • Loss of proprietary data: Competitors may gain an edge.
  • Resource diversion: Time and money spent on recovery rather than innovation or expansion.

Protecting against a supply chain attack

This will involve a mix of technical, procedural, and strategic measures. You need to understand that technology alone will not protect you.  You must take a risk managed approach and understand that these attacks target vulnerabilities in third-party vendors, partners, or software dependencies.  They will employ social engineering techniques and phishing in all its forms.

  • Know Your Suppliers and Vendors
  • If you are managing suppliers:
  • Inventory all third parties: Maintain an up-to-date list of all external vendors, software providers, cloud services, and contractors.
  • Assess risk levels: Identify which vendors have access to critical systems or sensitive data.
  • Ensure that you suppliers are aware of your security policies and that they have agreed to abide by them.  Audit that.
  • Include security requirements in contracts (such as regular audits, breach notification timelines, etc.).
  • Ask for compliance evidence (ie, Cyber Essentials etc.).
  • If you are a supplier to a larger organisation:
  • Know and understand your customers security policies and undertake to abide by them.  Don’t pay lip service, actually do it.
  • Make sure you understand your contractual obligations in this regard.  Failure to do so could put you out of business.
  • Use Zero Trust Architecture
  • Apply least privilege access to vendors and third-party applications.
  • Isolate critical systems from less-trusted networks using segmentation.
  • Verify before trusting: Always authenticate and validate access requests, even from trusted sources.
  • Secure Your Software Supply Chain
  • Ensure your software comes from reputable sources and is regularly updated and patches applied.
  • Validate the integrity of software updates (e.g., use code signing and secure CI/CD pipelines).
  • Monitor for tampered or malicious packages.
  • Continuous Monitoring and Audit
  • Monitoring has long been considered too costly for most SMEs with systems such as SIEM not only being expensive but requiring constant analysis by a SOC analyst.  However, there is now a system which is effective, managed and within most SME budgets.  H2 can advise on this.
  • Log and audit changes to critical infrastructure or data access.
  • Use threat intelligence to stay ahead of known supply chain threats.
  • Patch Management and Updates

         •       Stay current with software and firmware updates.

         •       Use automated patch management tools where possible.

         •       Vet updates from vendors for authenticity and origin.

  • Incident Response Planning
    • Create and test a supply chain-specific incident response plan.
    • Ensure you can quickly revoke unauthorised or administrative access if needed.
    • Conduct tabletop exercises that simulate supply chain attacks.
  • Train Your Staff
  • This is often the most effective quick win any organisation can make.
  • Educate employees about phishing, social engineering, and how supply chain attacks often begin.
  • Train procurement and legal teams to evaluate vendors with security in mind.

There is a lot too this subject and you might feel that you need advice and guidance.

Cyber Awareness Training Data Breaches and their consequences General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security Tools

DO YOU HAVE A HANDLE ON CYBER SECURITY?

Over the years I’ve had some very interesting conversations with several people from multiple different verticals, many fitting comfortably within the SME bracket, around Cyber Security.  The conversations tend to take a very familiar turn.  The cry of, ‘I’m covered, my IT support company has put in a firewall and some anti-virus.  They tell me all is good’.  Slightly depressing but hardly surprising.

So why surprising?  A lot of IT Support Companies providing managed services do a very good job of supplying and implementing networks and providing hardware and software.  The Cyber Security field is one where resources are scarce and expensive.  Cyber Security professionals take a very different view than IT support companies and come at security from the risk managed view and recognise that it is not just about technology and in fact, it’s about people, process and then technology.  More about this below.

As we travel around and visit clients or potential clients, it is common to find that they have the view that adequate security is provided by technology.  They rely on their IT provider to provide the guidance they need which tends to involve firewalls, anti-malware software and perhaps a backup regime.  All well and dandy.  I use a quote from Bruce Schneier, Fellow at the Berkman Center for Internet & Society at Harvard Law School, quite a bit, it goes like this:

‘If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology’. 

A common misperception is that IT Security is the same as Cyber Security.  That surprises a lot of people, so let’s explore it a bit.  There is clearly a close symbiotic relationship between the two disciplines.  I would argue, and I know this might meet with some disagreement, that IT security refers to traditional IT security methods which are technology based.  Such as firewalls, anti-malware, end point protection etc.  Whilst Cyber security is based very much on risk management which combines controls which are both non-technical and technical, following the principles of People, Process and Technology.  A good cyber security professional will have a good handle on both approaches.

Even though cyber security and data protection have leapt to the top of many people’s agenda in recent years it is still common amongst many SMEs to believe that it is an IT problem, a technical problem rather than a business issue, even when recognising that the risk of a cyber intrusion or a data breach, impacts the business, the bottom line. 

Since I first wrote about this, we now have the changing landscape of working practices.  Many SMEs have adopted a more flexible approach to work and are utilising a more hybrid working pattern with some working from the office, some from home and other places.  This does have financial advantages for an SME but brings with it a lot more security issues which many are either parking or outright ignoring.

The National Cyber Security Centre (NCSC), a department of GCHQ Cheltenham, estimated, before the hybrid working pattern starting to bed in, that if you are an SME then you have around a 1 in 2 chance of experiencing a cyber security breach.  For the small business this could result in costs of around £1400, for the medium business, considerably more.  One has just been hit for around £30000, which I am sure you will agree, can be extremely damaging to the bottom line of businesses operating under tight margins.  And of course, it’s not just financial penalties but the reputational damage should your customers data and assets be affected as well.

Within the SME world there is an almost total reliance on third party IT providers.  Is that a good thing, after all that’s in the IT providers area of expertise and responsibility, isn’t it?  And here comes the controversial bit.  Third party IT providers, particularly in the SME space, are pretty much exclusively value added resellers or VARs, i.e., companies that sell other company’s products.  Now I’ve no problem with that per se, but it comes with issues.    Notable amongst them is that these companies will have skill sets that are very much limited to the products they sell.  Ie they are proficient in the installation and configuration of those products and their clients are offered those products whether they are best in class, or more importantly, whether they are the most appropriate for the task.  Before I get a social media pile on, I know that some of the bigger VARs do sell multiple vendors products, but they are in a minority.

Before we go any further, let’s briefly explore some issues that are common amongst SMEs.  Some common myths first:

  • Small to medium size businesses are not worth attacking.
  • Cyber Security is an IT Issue.
  • Technology will keep me safe.
  • My policies and procedures are up to the job.
  • My staff are young and have been brought up with IT.  They know the score.

Now let’s look at some of the more common issues that we see often amongst SMEs:

  • Lack of awareness around the current real-world cybersecurity risks
  • False sense of security, with a heavy reliance and dependence on an external IT third-party provider
  • Lack of cybersecurity knowledge and understanding
  • Poor cybersecurity maturity and posture within their businesses
  • Lack of staff training (at all levels) – just like Health & Safety, cybersecurity is everyone’s responsibility.

Here at H2 we offer a cyber maturity assessment that is designed specifically for SMEs.  It is a comprehensive evaluation of an organisation’s cybersecurity capabilities and readiness to effectively mitigate and respond to cyber threats. It involves a detailed analysis of the organisation’s cybersecurity policies, procedures, technologies, and practices. The assessment aims to identify potential vulnerabilities, weaknesses, and areas for improvement in the organisation’s cybersecurity posture.

During the assessment, cybersecurity experts typically examine various aspects, such as:

  • Governance and Management: Reviewing the organisation’s cybersecurity policies, risk management frameworks, and leadership’s commitment to cybersecurity.
  • Security Awareness and Training: Evaluating the level of cybersecurity awareness among employees and the effectiveness of training programs.
  • Technical Controls: Assessing the implementation and effectiveness of security technologies, such as firewalls, intrusion detection systems, antivirus software, and encryption mechanisms.
  • Incident Response and Recovery: Analysing the organisation’s incident response plan, including procedures for detecting, reporting, and responding to cyber incidents.
  • Security Risk Management: Evaluating how the organisation identifies, assesses, and manages cybersecurity risks.
  • Third-Party Risk Management: Assessing the organisation’s approach to managing cybersecurity risks associated with third-party vendors and partners.
  • Compliance and Regulations: Verifying the organization’s compliance with relevant cybersecurity regulations and industry standards.

The results of the Cyber Maturity Assessment provide valuable insights to the organisation, enabling them to enhance their cybersecurity defences and establish a more robust and resilient security posture. It helps organisations prioritise their investments in cybersecurity, address vulnerabilities, and strengthen their overall cyber resilience and provides a road map to reach a standard agreed with the management, taking full account of that managements risk appetite.

Cyber Awareness Training Data Breaches and their consequences General Security Issues Identity and Access Management Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security Tools

WHAT DO SMES REALLY NEED TO KNOW ABOUT CYBER SECURITY

Maybe I should have titled this ‘What do SMEs WANT to know’ rather than need to know.  That’s because all too often they want a very cut down version of what they need, because simply put, they don’t have the budget or expertise to get into too much detail and will often look for the easy way out.  That’s becoming more and more of a problem given the concerted effort by cyber criminals to attack all sizes and types of business, here in the UK.  I posted a bit about this earlier, you can read it here.  Do SMEs really need a cyber strategy and if so, what exactly does that entail.

What is a Cyber Security Strategy?

A cyber security strategy is a plan that outlines an organisation’s approach to protecting its information systems and data from cyber threats. This strategy typically includes measures such as implementing security controls, conducting regular risk assessments, training employees on security best practices, monitoring network activity for suspicious behaviour, and responding to security incidents in a timely manner. The goal of a cyber security strategy is to minimise the risk of cyber-attacks and protect the confidentiality, integrity, and availability of an organisation’s sensitive information.

Do I really need that – I’m an SME and not really a target, am I?

Well yes, you are a target and there are a ton of statistics available which shows that SMEs globally are a very real target for cyber-attacks and can in fact, be very profitable for cyber criminals.  There are a lot of reasons for that but one of the top reasons is that typically, SMEs spend very little on cyber defence and generally have very weak defences.  Add to this that they don’t tend to carry out cyber awareness training for their staff, have limited resources and generally don’t have a good grasp of the issues.

Not their fault.  Most are focused on their core business, trying make a quid or two and are pressed for time.  They tend to rely on whatever company, usually local, that supplied their network, hardware and software, generally on a retainer.  The problem is that those companies don’t really have a good grasp of the issues either, concentrating on technology, and then, not necessarily the right technology.

The real trick here is in devising a strategy that works whilst staying within budget and having the resources to make it work.  Not an easy path to tread but one that is very definitely a must.

Secure by default and design

Now that’s an interesting title, but what does it mean?  Secure by default and design means that a system or product is inherently built with security measures in place from the start. This ensures that security is a priority throughout the development process and that users can trust that their data and information will be protected. It also means that security features are enabled by default, reducing the risk of vulnerabilities or breaches. This approach helps to create a more robust and resilient system that is better equipped to withstand potential threats.

It applies as much to your network and systems as it does to software development and possibly more importantly to you, it is a legal requirement under the Data Protection Act 2018, or as it is becoming known, UK GDPR.

The first problem many people come up against is that they already have a network, probably connected to the cloud of some sort, very possibly for SMEs, MS365, but when the design was done, there wasn’t a full risk assessment undertaken which is a requirement to underpin that design.  In other words what we in the cyber security industry refer to as Security Architecture Design (SAD), wasn’t a prominent consideration.

Not unusual and the common technologies were probably set up, firewalls and anti-virus, but not much else.  And that is where a well thought out strategy comes into play.

What should I be considering in my Cyber Security Strategy

We’ve already said you are an SME, so do you need the sort of comprehensive cyber security strategy that we would see in a major corporate?  No, but it should still cover off the major points and should continue to be reviewed alongside things like your Health and Safety policy and other industry standards that are required to be reviewed for you to stay in business, usually annually.  I know, it’s a pain and you’ve got enough to do without increased paperwork.  But this isn’t red tape, this is designed to keep your business protected and can save you a lot of money, time and trouble.

You need to be thinking about the key components needed to effectively protect an organisation’s digital assets and data. These components may include:

  1. Risk assessment: Assessing potential cybersecurity risks and vulnerabilities to identify areas of weakness and prioritise areas for improvement.
  • Security policies and procedures: Establishing clear and enforceable policies and procedures for data protection, access control, incident response, and other security-related activities.
  • Employee training: Providing ongoing training and education to employees on cyber security best practices, such as password management, phishing awareness, and safe browsing habits.
  • Incident response plan: Developing a detailed incident response plan that outlines the steps to be taken in the event of a security breach or cyber-attack, including communication protocols, containment measures, and recovery strategies.
  • Collaboration with external partners: Establishing a partnership with cyber security company that understands the issues that affect SMEs and who themselves can establish a solid working relationship with the IT provider that is providing and administering your network and IT resources, will enhance your protections, significantly improve your employee and managerial awareness of the issues, and provide you with the peace of mind you need, allowing you to concentrate on your core business.

So, to wind this up, everyone needs a strategy that is tailored to them and covers off their needs.  In order to make sure that your cyber, or if you prefer, your information assets, are secured, you need to understand what they are and how vulnerable they are to attack.  Only then can you start to put in place protections that are appropriate to you, and affordable, making sure that your budget is spent wisely.  Don’t be put off by all the stuff above, some of it, or perhaps much of it, won’t apply to you, but some of it definitely will.  Don’t be afraid to take advice from those who know what they are talking about.

Data Breaches and their consequences General Security Issues News Security

Data Protection – A Timely Reminder

Data Protection is a somewhat dry subject that many companies, particularly SMEs, and many think they can get away from by simply paying a bit of lip service.  The Data Protection Act 2018, or as it has become known, UK GDPR, is far from a toothless beast and can cause businesses to find themselves in all sorts of problems if they’re not careful.

As M&S has discovered and now, the Ministry of Justice.   The cyber-attack was on the Legal Aid Agency and appears to have accessed a ‘significant amount’ of applicants’ personal data, to which the government admitted.  ‘This data may have included contact details and addresses of applicants, their dates of birth, national ID numbers [national insurance], criminal history, employment status and financial data such as contribution amounts, debts and payments,’ the MoJ said.

…….. ‘it has become clear that to safeguard the service and its users, we needed to take radical action. That is why we’ve taken the decision to take the online service down. We have put in place the necessary contingency plans to ensure those most in need of legal support and advice can continue to access the help they need during this time’.  Serious indeed.

Initial findings suggest that this is the result of systemic issues within the organisation which they have failed to correct, over many years.

What are the possible fall outs from this?

That very much depends on how the Information Commissioner views it.  If this is seen as negligence, then the potential fine could be very significant indeed.  If, on the other hand, it is deemed that the MOJ took all reasonable precautions that they could to protect the data, then that is a good mitigation which will reduce the potential punishment. 

But that’s not the end of it.  The reputational damage that this does is incalculable and the cost of fixing the issues will be high.  Then there is the potential for legal action by anyone whose data was compromised, that could easily be the biggest issues that the MOJ faces.

Only time and a thorough investigation will determine the outcome.

Data Protection and the SME

My subscribers wi8ll know that my focus is the SME, large and small.  So how does data protection impact them.  Not so long ago a London estate agent was fined £80,000 by the Information Commissioner’s Office (ICO), after leaving the personal data of more than 18,000 customers exposed for almost two years.

The incident occurred when the estate agent passed the details from its own servers onto a partner company. An “Anonymous Authentication” function was not switched off, which meant there were no access restrictions to the data.

It’s surprising just how much PII estate agents hold.  Just think about what they ask for when you’re buying a house.  In this case the exposed details included bank statements, salary details, copies of passports, dates of birth and addresses of both tenants and landlords.

Then, as above, that might not be the end of it.  Individuals can sue companies that release data into the wild.  In fact, there are now law firms advertising no win no fee when representing these cases.  Remember that data breaches almost always involve multiple people, sometimes hundreds if not thousands of records.

What size does a business need to be for the regulations to apply?

The regulations apply to all businesses large and small, although some exceptions exist for SMEs. Companies with fewer than 250 employees are not required to keep records of their processing activities unless it’s a regular activity, concerns sensitive information or the data could threaten an individuals’ rights.  Just exposing PII can threaten an individual’s right to privacy.

Just about everyone processes personal data of some sort.  Data that can identify a living individual.  HR data will have bank account information, home addresses, NOK, phone numbers, maybe references from previous employers.  The exposure of some or all of that could be judged as prejudicial to an individual’s rights.  Some companies may have bigger problems, for example Solicitors, Estate Agents, Financial Advisors and Recruiters (the list is not exhaustive), which hold an abundance of personal data about their clients, much of which, under other legislation they are required to retain for up to 7 years.

Do I need written policies and processes?

Yes – What this means is that a significant number of policies and processes will need to be written and taken into use by the organisation.  It is not unusual for many to visit the web and download templates to cover their requirements.  However, whilst these templates in themselves maybe adequate when used by someone who knows what the requirement is, they may be less than effective in the hands of someone who is just looking for a quick tick in the box.

How is UK GDPR effected by cyber security?

The Act requires personal data to be secured by ‘default and design’.  This means that cyber security requirements must be designed into your protections.  This could mean at least another 6 or 7 policies and procedures.

How can I keep track of all my PII holdings and keep it secure?

When we are first approached by a prospective client and we begin our offer of a 30 day free trial to examine their requirements, one of the first things we find is that they don’t know what data they are holding, or where it all is.  Oh, they have a general idea; it’s on the cloud server(s), it’s not on laptops or desktops, it’s just the stuff we need to process our clients’ requirements and yes, we’ve only got one copy.  And then we install our software that first carries out a discovery exercise and we find that their laptops/desktops are holding lots of copies of the data that is on the cloud server(s).  How does that happen?  Over time, especially with many now employing the hybrid system of working, ie between the office and remote (home) locations, employees log on to the cloud, find they have a bit of shaky internet link and download the data they need, work on it and then upload it again, forgetting to delete it from their machine.  Or they need to share it and attach it to an email and send it out, forgetting, or perhaps not realising, that the data is now stored, attached to an email, on their email server.

Then comes the issue with audit trails.  If the ICO ever wanted to carry out an investigation, then having an audit trail of who created/copied/deleted/forwarded what to who, is essential.  And let’s not forget the member of the public who is fully entitled to submit a Data Subject Access Request or DSAR, which demands that you reveal what data you are holding on that person.  The law insists on it, and you can’t refuse it.  I know of a financial firm that took nearly 3 weeks to satisfy a DSAR, taking an employee off billing, for that time.

Are there solutions suitable and affordable for SMEs?

We have a solution that meets the requirements and not only that, has a built in encryption system, all within the same monthly cost.  It’ll cost you nothing to trial it and we’d be very surprised if once you’ve seen it and seen the ridiculously low monthly charge for the managed service, you don’t want to keep it.

Cyber Awareness Training Data Breaches and their consequences Identity and Access Management News Ransomware, Phishing and other Malware Security Tools Supply Chain Security

Cyber Attacks on SMEs

We’ve posted a few pieces recently on why setting a realistic budget for cyber security is so important and we thought we’d follow that up with some real-life examples.

Small and medium-sized enterprises (SMEs) are increasingly being targeted by cybercriminals in 2025 and are facing a range of sophisticated threats that exploit limited resources and evolving technologies. Here’s a quick look at some of the most pressing cybersecurity incidents and trends that have affected SMEs so far this year:

Major Cybersecurity Incidents Impacting SMEs

  • Co-op Supermarket Chain Cyberattack (UK)

A “highly sophisticated” cyberattack disrupted Co-op’s IT systems, leading to customer data theft, contactless payment failures, and empty shelves in Scottish stores. The breach also affected other major retailers like Marks & Spencer and Harrods, with investigations pointing towards hacker groups such as Scattered Spider and Lapsus$. 

  • Lockbit Ransomware Group Breach

The notorious ransomware gang Lockbit was itself hacked, resulting in leaked communications that revealed aggressive targeting of small businesses for extortion. This breach has temporarily disrupted Lockbits operations and exposed their tactics.

  • Berkeley Research Group (BRG) Data Breach

A cyberattack on BRG compromised sensitive data related to Catholic Church sex-abuse cases. The attacker used impersonation tactics via Microsoft Teams to deploy Chaos ransomware, leading to concerns over the exposure of victims’ identities.

 Emerging Cyber Threat Trends for SMEs

  • AI-Powered Phishing and Deepfake Attacks

Cybercriminals are leveraging AI to craft convincing phishing emails and deepfake audio impersonations of executives, deceiving employees into authorising fraudulent transactions.

  • Ransomware-as-a-Service (RaaS)

The availability of RaaS platforms has lowered the barrier for launching ransomware attacks, making SMEs prime targets due to their valuable data and often limited security infrastructure.

  • Supply Chain Vulnerabilities

Attackers exploit weaknesses in third-party vendors to infiltrate SMEs’ systems, as seen in incidents involving compromised software packages on platforms like NPM.

  • Business Email Compromise (BEC)

Scammers use AI to mimic emails from corporate partners and managers, leading to fraudulent financial transactions. In Australia, BEC attacks have increased by 7% year-on-year, with SMEs being particularly vulnerable.

Proactive Measures for SMEs

To mitigate these threats, SMEs should consider the following actions:

  • Implement Multi-Factor Authentication (MFA)

Enhance account security by requiring multiple verification methods.

  • Regular Employee Training

Your staff are your first line of defence and need to be educated on recognising phishing attempts and social engineering tactics.

  • Secure Supply Chains

Vet third-party vendors for cybersecurity compliance and monitor for unusual activities.   Are you in a supply chain for a major company?  Are you facilitating a back door into their systems?

  • Invest in AI powered security tools

Utilise advanced solutions capable of detecting and responding to sophisticated threats.  H2 has a couple of suggestion here that are affordable to SMEs.

  • Protective Monitoring

How do you know that your expensive solutions are protecting you?  Do you know if you’ve suffered a stealth attack where the attacker has built a back door into your systems?  Do you know if you’re hard-earned cash is being siphoned off?  How vulnerable are you to an attack? A monitoring solution for SMEs is now available at an affordable price.

  • Data Loss Prevention

Are you sure you know exactly where all your data is?  Are you sure that documents attached to emails aren’t still sitting on your email server?  Do you know if other documents have been downloaded from your cloud storage whilst your staff work from home, and then uploaded but a copy is still sitting on their laptop?  Data proliferation over time is almost a given.  Can you encrypt your sensitive data so that even if it’s stolen, it’s useless to the thief?  An affordable solution now exists.

  • Develop an Incident response and business continuity plan

No matter how well you protect yourself, you still need to prepare for potential breaches with a clear strategy to minimise impact and recover operations swiftly.

Cyber Awareness Training General Security Issues Ransomware, Phishing and other Malware Security Supply Chain Security

FEAR, UNCERTAINTY AND DOUBT

Or as it’s known amongst cyber security sales teams, FUD.  It’s a tried and tested method of trying to hook new sales and is often used by sales teams at, shall we say, a slightly lower level than the top end enterprise sales teams who, like me, don’t like it and stay shy of it.

OK, so now I’ve established my ethical credentials, how do I let my clients and potential clients, know what the threats are and how vulnerable to them, they are.  There’s a fine line between FUD and education.  People don’t need to be scared into doing things, they need to be educated into it and they have every right to know what the threat landscape looks like, and how vulnerable they are to it.

What’s the Threat in 2025?

It is expected that in 2025, organisations can expect to face a variety of cyber threats, including AI-powered attacks (see https://hah2.co.uk/?s=Artificial+Intelligence), ransomware with complex extortion tactics (https://hah2.co.uk/?s=Ransomware), supply chain attacks (https://hah2.co.uk/?s=Supply+Chain), vulnerabilities in IoT and 5G networks, and the rise of deepfake technology. Cybercriminals are leveraging AI to automate attacks, develop advanced malware, and bypass traditional security measures. Additionally, ransomware attacks are becoming more sophisticated, with some now stealing data alongside encryption, increasing the pressure on victims to pay. Supply chain vulnerabilities are also a major concern, as attackers can target third-party vendors to gain access to larger networks. The increasing number of IoT devices (see https://hah2.co.uk/?s=IOT) many of which lack robust security, also presents a significant challenge, as they can be easily exploited for attacks that disrupt critical infrastructure. Deepfake technology is also becoming more accessible, making it easier for attackers to create realistic fake content for various malicious purposes. 

How Does This Impact SMEs?

So where do SMEs sit in this space?  There is still the perception amongst them that they are too small to be worth attacking, that the rewards for the cybercriminals aren’t enough and they won’t bother.  Well, let’s debunk that.  SMEs are seen as low hanging fruit.  They will have much smaller budgets than the bigger players, they will almost certainly outsource their IT and as I’ve said often, you can outsource your IT, but not your responsibility.  There is a dearth of cyber security expertise, not just within the SMEs themselves, but also amongst the IT outsourcers they use.

In 2025, it is anticipated that SMEs will face evolving cyber threats, including AI-powered phishing, ransomware, and supply chain vulnerabilities, along with insider threats and IoT exploits. AI is going to have a very real impact on the attacks designed against SMEs.  Why?  Because AI provides automation, and automation is the key to making real money when attacking SMEs.  Think it through.  If a criminal organisation can attack hundreds, if not thousands of targets using one automated attack, with an expectation of say 50% success, with extremely little effort using AI, then that’s good business for them.  AI-driven attacks are predicted to be a top concern, with sophisticated phishing campaigns and deepfake fraud attempts on the rise. Ransomware continues to pose a significant risk, especially for SMEs with limited cybersecurity resources. 

Supply Chain Security

Supply chain vulnerabilities are also a growing concern, as hackers can exploit connections with external vendors to breach multiple businesses.  This latter should be a very real concern for any SME that is in the supply chain of a major organisation.  Just imagine the consequences for that SME if their customer is attacked, losing money and reputation, and can pinpoint the attack as coming via the SME.  How would that impact the SME?  Well, the financial and reputational consequences would probably kill their business.

Ramsac, in their 2025 SME threat report, tells us that a mid-sized UK logistics company fell victim to a ransomware attack in June 2023. They infiltrated the company’s network and left a note on screens: “If you’re reading this, it means the internal infrastructure of your company is fully or partially dead.” The attackers had encrypted the firm’s files and threatened to leak confidential data, essentially holding the business hostage.  They also reported that a large retail breach occurred when attackers compromised a small HVAC subcontractor (with far weaker IT security) and used those credentials to penetrate the larger corporate network. That attack led to the theft of millions of customer card details and tens of millions of dollars in damages – all traced back to a third-party SME vendor being hacked via a phishing email.

In Summary

We published a piece recently about cyber security and the SME and rather than repeat it here, we’ll simply give you the link – https://hah2.co.uk/cyber-security-and-the-sme/.  It reiterates some of my hobby horses, chief amongst them being cyber awareness training.  I’ve said before, but it bears repeating, that your staff are your first line of defence and are either your greatest asset, or your greatest risk.  The actions you take as an owner/director/manager, will decide which.

SMEs are facing increased pressures on their resources and the temptation to park cyber security until times are better, increases alongside those pressures, but avoid complacency, let’s discuss what you might be able to do procedurally and at low cost. If you have invested in tech, is it the right tech and is it doing what you think it’s doing? That’s never a given.

Cyber Awareness Training Data Breaches and their consequences General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security

Cyber Security and The SME

What are we facing?

The world is in somewhat of a flux at the moment and SMEs are being battered from all sides it seems.  First, we have the increase in the minimum wage, which impacts SMEs, generally, more than the corporate sized businesses, and then the increase in NI.  What we didn’t need was tariffs, although how much of an impact that will have on SMEs won’t be known for some time yet.  The EU is the world’s largest single market area and is the largest economy in the world, whether some people agree or not.  Many may attribute that market size to large organisations and multi-national companies. While these are important contributors to the overall EU economy, the Small Medium Enterprise (SME) businesses form the backbone of that economy.  This is also true of the UK where the DTI estimates that SMEs make up nearly 95% of the UKs GDP.   A huge percentage and one that might surprise you.

According to the Cyber Security Breaches Survey (gov.uk), half of SMEs in the UK had experienced some form of cyber-attack in 2024, with email phishing, spear-phishing, and social engineering continue to trend as the most common and reliable means of illegally accessing a network.

NinjaOne produced are report which says that there were 7.78 million Cyber Attacks on UK Businesses in 2024. More than 400,000 cases of fraud and computer misuse were recorded. 50% of UK businesses experienced a cyber-attack.

The economic effects of the measures hitting SMEs discussed above, are already having an effect in that many SMEs are putting enhancing their protections against cyber-attacks, on the back burner.  Those we speak to acknowledge the problem but are reluctant to spend money on anything that isn’t their core business.  And we get that, we really do.  After all we are an SME ourselves.

What are the potential impacts of a cyber-attack on your business?

A successful cyber-attack can wreak havoc on your business. Damaging your financial stability, customer trust, and reputation while inviting legal issues. The fallout includes:

  • Loss of corporate, financial, and personal data
  • Disruption to trading and potential fines from ICO
  • Repair costs for affected systems
  • Imagine building customer trust and an impeccable reputation over years, only to see it shatter in hours due to a cyber-attack.
  • The consequences, loss of customers and decreased sales and profits

The fear of legal repercussions is real too. Deploying inadequate security measures can lead to fines, regulatory sanctions and even legal action.

So, what can you do to better protect your business?

Despite today’s digital landscape, cyber security remains a non-negotiable aspect of business success. The threats are real, and SMEs are not immune. In fact, they’re often the most vulnerable to cyber-attacks.

Solutions need not be complicated or expensive, yet many SME owners still act reactively, not proactively, to cyber threats.  The result? Huge costs to put things right and a massive hit on the company’s reputation and trust with their customers.

An underlying issue common to all SMEs is management awareness and commitment, which in turn drives budget, allocation of resources and effective implementation of the cybersecurity practices. Six categories of major challenges for SMEs have been identified:

  • Low cybersecurity awareness of the personnel.
  • Inadequate protection of critical and sensitive information.
  • Lack of budget.
  • Lack of ICT cybersecurity specialists.
  • Lack of suitable cybersecurity guidelines specific to SMEs.
  • Low management support.

Risk Management

Now I know that many will say that this is a technical matter and that we have a company under contract that looks after our IT infrastructure and therefore we can safely leave it to them.  Wrong.  Ask them some simple questions: 

  • Have they fully identified your security assets?  Security assets are not just   hardware and software, in fact those are often the least of your worries.  It’s the data, where it is and how it’s protected that is important.
  • Have they done a risk assessment on those assets.
  • Have they recommended or implemented controls to manage the risk down to your acceptable residual risk level.  That is assuming they have spoken to you about what that acceptable risk is. 

It’s very important that business owners grasp the difference between the technical requirements of their networks, and the business requirement. 

You carry out risk management on a daily basis as you go about your business.  Cyber security is no different and a simple risk management process can save you money by targeting your limited spend where it really needs to go, not where you may think it needs to go.  Here is a link to a short video on that risk management process, which should help you see that it’s not onerous and need not be costly.

https://bit.ly/3FdZ6x0

Cyber Awareness Training

Some of you who are amongst my regular readers, will be quite aware of my mantra in regard to Cyber Awareness Training for staff and managers.  A big misconception is that because cyber security can be an issue connected to technical measures, it lies squarely within the realm of IT.  Wrong.  Cyber security needs to be part of the culture of the organisation, second nature to all.  Staff need a basic awareness and how their attitude and actions can have a damaging effect on the business.  A report for ENISA, the EU security agency, suggests that 84% of Cyber attacks rely on some form of social engineering, and that the number of phishing attacks within the EU continues to grow.  This is echoed in the UK.

Budgets

Budgets remain a problem.  Many SMEs are low margin organisations, heavily reliant on cash flow, and therefore reluctant to spend on things that are not connected to their core business.  But they must get used to asking themselves, ‘Is IT part of my core business?’, and ‘how long could I continue to operate my business if I lost my IT systems?’.  Cyber security needs to be factored into budgets. Cyber security is an iterative process, it isn’t something that needs to be done once and then forgotten about.  The criminals are constantly evolving, and defences must evolve with them.

Cyber Expertise

Cyber security expertise is something that isn’t cheap and easy to obtain.  Many IT companies will talk about their expertise in this area but if you delve into that, it is generally focused on products, mainly firewalls and anti-malware.  Cyber security expertise goes much much deeper than that and is as much procedural as it is technical.  It starts with risk management, understanding the risks you face, which in turn is derived from threat and vulnerability analysis, matched to your cyber security assets.  Those latter are not necessarily hardware and software but can be much wider ranging than that.  Typically, the type of person who can legitimately call themselves experts in this field, can command salaries north of £80K.  I doubt there are many SMEs prepared to pay that, or indeed, many of the smaller IT companies.

Security Standards

It can also be advantageous to follow a standard.  By far the most comprehensive is the International Standard for Cyber Security, ISO27000 series.  However, this might be seen as a little heavy for many SMEs, although at the higher end, they may want to follow it, rather than seek certification.  At the lower end the UK Cyber Essentials scheme, mandated for anyone wishing to do business with the public sector, is very suitable, inexpensive, and obtainable.

Cloud Services

More and more SMEs are now moving to a cloud environment.  Be it MS365, Amazon Web Services, Digital Ocean, amongst others.  I usually recommend that SMEs take this approach as it can solve a lot of problems, particular with home working still very much in vogue.  However, it is not the panacea that most think it is and still has some security issues, usually but not always at the user end, that need to be addressed.

About H2

Here at H2 we use our long experience of providing cyber security solutions to the large enterprises, to craft solutions for the SME community, having first identified the issues that the business faces.  We take an approach that looks at things from the business point of view, managing risk and coming up with cost effective solutions which can be brought in in a phased way, for a subscription price.  No large bills to damage that all important cash flow.

General Security Issues Risk Analysis and Security Strategy Security Supply Chain Security Working Practices

Cyber Resilience – What Does It Entail?

The Cyber Security and Resilience Bill

Following the fallout last year, from the CloudStrike sensor failure that led to significant outages worldwide, we wrote a piece questioning whether we are truly addressing Cyber challenges. Subsequently, the UK introduced The Cyber Security and Resilience Bill, which was debated in Parliament in 2025. This legislation seeks to enhance the UK’s cyber defences and bolster resilience across essential services, infrastructure, and digital offerings. It will revise current cyber security regulations, including the NIS Regulations, and broaden the scope of protected digital services and supply chains.

The primary goal of this bill is to safeguard the UK’s digital economy, positioning it as one of the most secure in the world while protecting services, supply chains, and citizens. Additionally, it aims to enhance our cyber resilience and stimulate growth and prosperity. With an expanded scope, it encompasses a wider array of essential digital services beyond those currently covered by the NIS regulations and builds upon them. The bill includes mandatory reporting requirements and emphasises the UK’s Critical National Infrastructure (CNI).


Ministerial Policy Statement


You can read more about it here: https://www.gov.uk/government/publications/cyber-security-and-resilience-bill-policy-statement/cyber-security-and-resilience-bill-policy-statement.

Relationship with EU Regulations


Although the UK’s Cyber Security and Resilience Bill is tailored for the UK, it draws inspiration from the EU’s Cyber Resilience Act (CRA) and the NIS2 Directive. The CRA emphasises cybersecurity for products with digital elements, whereas the UK’s legislation focuses on fostering overall resilience within its digital ecosystem. Furthermore, it aims to align with principles found in the NIS2 Directive adopted by the EU in 2024.

How will SMEs navigate this?

In the cybersecurity sector, there has long been a divide between product vendors and those of us focused on services. After three decades in this industry, I’ve repeatedly observed that product sales often prevail. Why? Because selling services is more challenging with a longer sales cycle compared to quicker product sales. People prefer to see a quick if not immediate return, on their investment; they like tangible products doing their job even if they don’t fully grasp how they function or whether they’re suited for their needs.

Risk Management

A risk managed approach remains vital. This principle hasn’t changed over my 30 years in the field. However, this bill makes it even more critical due to potential penalties for non-compliance. The focus should be on People, Process, and then Technology. I often reference Bruce Schneier, a Harvard scientist and thought leader in cybersecurity. He states, “If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology.” Essentially, understanding your risks begins with identifying your cyber assets, not just hardware or software but your data and your ability to maintain system access for staff and customers when needed.

Once you recognise your assets, you must identify potential threats to them and assess how vulnerable you are to those threats. Threats combined with vulnerabilities equal risk, the risk to your business if things go awry.

Having completed this assessment you can assign a risk score to each asset aiming to manage that risk down to an acceptable level, known as risk appetite. This will vary from business to business or even asset to asset; for instance, you wouldn’t assign the same risk level to a revenue-generating system as you would to an admin-only system lacking personal data.

This may sound daunting and costly; hence many businesses avoid it or only partially implement it. However, without a comprehensive assessment, it’s challenging to ensure that you are allocating your limited budget toward appropriate protections in key areas. You need to determine potential damage from failures and explore ways to mitigate that damage. While consulting a lawyer after a crisis is one option, wouldn’t it be wiser to prevent or reduce issues before they escalate?

General Security Issues Security Security Tools

HONEYPOTS

I seriously doubt if any of my clients would find a honeypot of any use, if only because they take a lot of time, effort and expense, but I thought I’d do a piece on them because they do exist and might be of interest, if only to understand what’s out there.

What is a Honeypot, in terms of cyber security that is?  Well, we’re not talking about a seductive member of the opposite sex, using their wiles to wheedle info out of you.  In this instance honeypots are cybersecurity tools designed to look like an attractive target, that act as decoys to attract and study cyberattacks. They mimic real systems or resources, but are isolated and monitored, allowing security teams to observe and analyse attacker behaviour without risking real data or systems. This information helps organisations improve their defences against malicious activity.  They can also be used to attract an attacker to the honeypot and away from your actual crown jewels.  Although this latter has fallen out of favour in recent years.

How Do They Work?

The honeypot is configured with vulnerabilities that are designed to lure attackers, leading them to believe they have successfully accessed a real system.  Meanwhile the security team monitors the honeypots activity to track the attackers’ movements, tools, and techniques.  Once the information is gathered it is used to understand attacker motivations, vulnerabilities in the organisation’s systems, and emerging threats.  The knowledge gained helps organisations strengthen their defences, identify potential blind spots, and improve their overall cybersecurity strategy.

Types of Honeypots

  • Low-interaction honeypots – These are simple, basic decoys that provide limited interaction with attackers, allowing them to study the attacker’s initial steps.
  • High-interaction honeypots – These are more complex, providing a more realistic experience for attackers, allowing for detailed analysis of their behaviour and techniques.
  • Research honeypots – These are used specifically for studying and analysing attacker behaviour, often in a sandbox environment.
  • Production honeypots – These are deployed in live networks to monitor and deflect real-world attacks.

A simple low interaction Honeypot

Benefits

I started this piece by saying I doubt if any of my clients would set up a honeypot.  They are expensive and resource heavy, but there are benefits:

  • Deflecting attacks – Honeypots can divert attackers away from valuable production systems, protecting critical assets.
  • Threat intelligence – They provide valuable information about attacker tactics, techniques, and procedures, helping organisations prepare for future threats.
  • Vulnerability assessment – By observing attacker behaviour, organisations can identify potential weaknesses in their security infrastructure.
  • Improved security posture – The knowledge gained from honeypots helps organisations strengthen their security defences and improve their overall security posture.

Who is likely to use a Honeypot?

Primarily honeypots are used by cybersecurity researchers and government agencies to monitor the latest threats and cybercriminal activities and methods, to improve defences.  This is especially true of companies that produce threat intelligence for their customers, and threat reports.

However, they might also be used by businesses to identify and analyse attacks targeting their production networks, helping them understand attack methods and improve their security posture. They can be used to distract attackers from critical assets and provide an early warning system for potential attacks. 

What is a Honeynet?

Research organisations might also utilise a honeynet.  A honeynet is a decoy network that contains one or more honeypots. It looks like a real network and contains multiple systems but is hosted on one or only a few servers, each representing one environment. For example, a Windows honeypot machine, a Mac honeypot machine and a Linux honeypot machine.

I hope you have found this brief introduction to honeypots interesting, if not particularly pertinent to you.  We do like to educate and spread the word in regard to cyber security.

Cyber Awareness Training General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security Tools

Cyber Security is a Business Issue

I know that I tend to include the statement in the title, in many articles and posts that I produce, but I haven’t really expanded on it and explained in more detail why I say that this is a business issue and one that owners and boards need to fully embrace if they are to stay safe.

We still see many ‘tick in the box’ exercises happening when we talk to SMEs, particularly when they have encountered an issue and tell us that they have taken precautions which, when examined, aren’t doing what the company thought, or perhaps hoped, they were doing.  Compliance and auditable solutions need to underpin what precautions you are taking.  If you can’t check and make sure that everything is up to scratch, and do it easily and often, then you have wasted your money. 

Far too much money is spent on one size fits all solutions and those that are reactive to one off threats, which produces a firefighter mentality that is at odds with the holistic preventive protection that is required to combat the current and emerging threat landscape.

This is not just a technical issue

A great quote which I use a lot comes from Bruce Schneier, an American scientist and

information security thought leader.  He says:

If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology.

And there’s a lot of truth in that statement, particularly when it comes to SMEs, simply because they don’t understand the technology, and leave it to the IT management company that looks after their network, who mainly focus on technology, because that’s their comfort zone and selling licenses is a big part of their business.  And neither the SME nor the IT Management company have a handle on the emerging threat landscape.

Another good quote comes from the Chair of the Australian Securities and Investments Commission.  He says, ‘If boards do not give cybersecurity and cyber resilience sufficient priority, this creates a foreseeable risk of harm to the company and thereby exposes the directors to potential enforcement action by [insert here your regions governance requirements] based on the directors not acting with reasonable care and diligence.’

Cyber security needs to be flexible and adaptable to the changing threats as they occur, because once they have become prevalent, it’s often too late to play catchup.  This means a holistic strategy that encompasses technology but also process, personnel, compliance and audit.  Don’t be complacent.  If you stand still, you will as they say, come a cropper.

Keep saying – PEOPLE, PROCESS and TECHNOLOGY – in that order.

Is there a Misleading Message Coming from the Technology Industry?

Perhaps, because there is a considerable amount of what we call FUD, fear, uncertainty and doubt, doing the rounds constantly. It concentrates people on thinking about specifics, instead of looking at the bigger picture.  Whilst there is no doubt that phishing, ransomware, and other scams have certainly concentrated the mind somewhat, and these attacks are most definitely not confined to the large enterprise businesses, but have been attacking, with a lot of success, the small to medium business market, this causes vendors to try and exploit the issues around that and push their technology solutions and of course, SMEs rarely, if ever, have the expertise to judge whether or not a particular product will actually give them the protection they need.  We now must add into the mix AI and its capacity for increasing cyber-attacks at all levels, making the production of malicious code so much easier and making it available to those perhaps less skilled than heretofore.

Another problem is that the advertising tends to give the impression that Cyber security is something new when in fact it’s just an evolution of the physical security issues that existed when information was all on paper.  Think of it like that and you’ll realise that it’s been around for a very long time and that what you are trying to protect is information of all kinds.  It’s information that makes your business work efficiently.  The very word Cyber brings with it the illusion that it’s something modern and/or futuristic, when in fact that word is essentially meaningless and the old description of Information Security or Infosec, is far more accurate and descriptive.  Cyber is a blatant attempt to push the technological aspect of information security.

Risk Management

I’m going to slip in a link to a short video on risk management as it pertains to Cyber (yes, I’m using that word because it’s sadly become de facto).  This video describes the process at a high level.

https://bit.ly/3FdZ6x0

Technology can be an essential part of your protection, but it must be targeted in the right way, which not only means you have the right piece of kit doing the right thing, but that you are targeting your IT spend to support your business goals and give a maximum return on investment (ROI).  It should also be married to good policies and processes that are enforceable and auditable and fully understood by your work force.  To do this you have to understand exactly what your risks, vulnerabilities and threats are to ensure that your solution to those risks, vulnerabilities, and threats, is targeted for maximum effect and ROI and that the technology is supporting the policies and processes, all of which is underpinned with good security awareness training.

It’s also necessary to have some way of measuring the effectiveness of your solutions through a monitoring or auditing solution.  Such solutions for SMEs have long been considered too expensive to even consider but that is no longer the case and affordable solutions are now on the market.

We must all grasp that these risks are owned by the board, and if you don’t have a formal board, then the management team.  This needs to be understood fully by those at the top.  They team need to understand what level of risk is acceptable and agree what risks they are prepared to tolerate to achieve the business aims.   They need to ensure that supporting policies are produced, implemented, understood by employees, and regularly reviewed and updated.  At H2 we tend to produce an information security and data protection handbook which can run into many pages.  Producing these policies is not as easy as it sounds.

You may also wish to look at some recognised standards by which you can regulate your risk management.  One such is the international standard for information security, ISO 27000 series but perhaps the most appropriate for SMEs is the Cyber Essentials Scheme which will help you demonstrate an appropriate level of information security and risk management within your company.

Once you have a risk management framework in place, owned from the top, then you can identify your information assets and assess the risk to your business should those assets be compromised in some way.  Then and only then can you adequately assess what processes and technologies you need to mitigate the risks identified for each asset thus targeting your spend for maximum effectiveness.

Sadly, that’s not the end.  User education is probably the most important element of all for SMEs.  Ensuring that your staff are aware of the policies and why they exist.  Protect yourself against scams which sadly, form the biggest danger to SMEs rather than hacks.  Scams can be very low tech or high tech using malware, but however they come in, your staff need to be aware of them.

Scroll to top