Kevin Hawkins, Author at H2 Cyber Security for SMEs

Is Cyber Security about Tech or the Business?

It’s simply a fact that many owners, managers, directors etc, believe that cyber security is a technology issue and is best left to those guys in IT who understand that stuff. Here at H2 we spend a lot of time and effort trying to educate C level people, that it really is a business issue, although it has significant input from the techies. It’s a business issue because breaches can have a significant financial and reputational impact. It’s also an IT issue because it involves implementing technical measures to protect systems and data. Effective cyber security requires a collaboration between business leaders and IT professionals to address both the strategic and technical aspects of security.

The crux of the issue though, is that it must be led by the business, and at board level. It requires a strategy to be followed, which is laid down at board level and which is focused on the goals and aspirations of the business, especially when your IT is outsourced. You can outsource your IT, but you can’t outsource your responsibility.

A valid argument is that the proliferation of security tools creates an illusion of safety. Organisations, large and small, often believe that by deploying a firewall, antivirus software and maybe some other tools, such as intrusion detection systems, they are adequately protected. This ignores the fact that such tools are controls put in place to mitigate risks identified and qualified in terms of importance, in a risk assessment and unless the benefits they bring are properly identified, and the solutions placed and configured correctly, they may well not be doing what you think they are doing. This thinking can also introduce significant third-party risks into your domain. The most recent example of this is the CrowdStrike issue which caused so much chaos throughout the globe.

To be fair to most companies in the smaller and mid-market arenas, their focus is on obtaining IT solutions as cost effectively as possible, and with the minimum of support costs. Cost control is vital to most. This means that they are extremely reluctant to spend money on what they see as not being part of their core business. Of course, if they get a cyber-attack or scam, or worse a data breach attracting the attention of the ICO, then their costs trying to fix the issue can easily outstrip any costs in prevention. Unless they have a well thought out risk managed strategy, they are wide open to slick sales pitches which push products. The rub is that in order to have that well thought out strategy, it means spending on what they see as expensive services that can seem somewhat nebulous, not something they can see and feel, and there is that vague feeling that they are being led to do something that really isn’t all that important.

The approach most take is to trust their IT provider to give them the protections they need. Most of these IT providers are what is known as re-sellers, ie they sell other people’s products and will push those products because that’s their business model. What they won’t do is take a risk managed approach which is essential in ensuring that any limited spend on security, limited because of cost constraints, is targeted where it’s needed and will be most effective. In other words, the technological approach taken by most IT support company’s will do half a job at best.

In essence then, if you don’t understand the risks you face, how can ensure that your cyber security strategy and protections are fit for purpose? Risk management is all about helping us to create plans for our future in a deliberate and responsible way. This requires us to explore what could go wrong in an organisation, on a day-to-day basis.

A quote from Bruce Schneier, Fellow at the Berkman Center for Internet & Society at Harvard Law School, goes like this:

‘If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology’.

How do we approach this then? First and foremost, you need to identify the risks that you face. How can you identify that risk and then mitigate it? Taking risks is a part of business. You assess risk every day when doing business. Do you want to do this deal? What happens if it goes not as expected? Do I want to take this person on? Whether you formally undertake a risk assessment or whether you assess that risk informally, you are working out what is appropriate to a level that is consistent with the risk that your organisation is prepared to take. Failure to do that will almost certainly be damaging to your business, perhaps fatally so.

The difference between assessing day to day business risk and assessing risk to cyber assets, is one of understanding. What is a cyber asset? In this context insert the word ‘information’ instead of cyber. It is the information contained within the IT system that is the important asset, not the piece of hardware it is sitting on. You understand your business risk, after all it is your business, but do you understand information risk? Do you have a clear idea of what information assets you have and where they are? Before you answer that think it through. Do you really know where all the data is? OK, you know that you have a server or servers probably in a cloud somewhere (cloud storage and access is a whole other subject) and that somewhere in those servers there is a bunch of data which runs your business. How much of that data has been saved onto staff workstations when they needed it to carry out some work? How much has been copied off somewhere else for what was probably a very good reason at one point? How well is your firewall functioning? Can malware work its way onto the network because the firewall does not have Universal Threat Management installed and can therefore be probing the servers and workstations. And we haven’t even thought about changes in working patterns. How many of your staff now work remotely some or all of the time. I could go on.

How can we be sure where all this information is and how important each bit is to the business? How can we assess this risk to the business, if information is lost or otherwise compromised? What about ransomware, phishing scams etc? The good news is that some of this can now be automated and managed for you at an affordable price and you can even arrange a 14 day totally free trial to assess its effectiveness.

AI and Risk Management – What’s Changed?

The answer to the question posed is, quite simply, nothing, in terms of risk management. The process of analysis of the threats posed to any particular organisation or infrastructure, the assessment of how vulnerable that organisation is to those threats, and the application of controls to bring down the risk to an acceptable level, remains pretty much the same.

Of course, the threat is changing, quite considerably, with billions being invested globally in the field of AI, which is affording huge advances in technology which brings with it great benefits but also new risks which are potentially more dangerous than those associated with current IT systems.

There is guidance coming out from several sources internationally on these risks and how to address them, but the EU has gone one step further and is producing the first comprehensive continental legislation on AI, the EU AI Act. Unlike most countries guidance, it is not voluntary but will become law and has real teeth. It wouldn’t be a shock to find other countries following suite.

The EU AI Act focuses on impacts to the rights, freedoms and safety of the public within the EU but is nevertheless a landmark legislative proposal by the European Union aimed at regulating artificial intelligence across its member states. Proposed in April 2021, the Act seeks to establish a comprehensive legal framework for AI that ensures the technology is developed and used in a way that respects fundamental rights, safety, and democratic values.

Here are the key points of the EU AI Act:

1. Risk-Based Approach

The Act adopts a risk-based classification system that categorises AI systems into four risk levels:

Unacceptable Risk: AI systems deemed harmful (e.g., social scoring by governments) are banned outright.
High Risk: AI systems with significant potential to impact safety, rights, or wellbeing (e.g., biometric identification, critical infrastructure) must meet strict requirements regarding transparency, accuracy, oversight, and documentation.
Limited Risk: Systems with moderate risk must comply with transparency obligations (e.g., AI chatbots must inform users they are interacting with AI).
Minimal Risk: Systems with negligible or no risk (e.g., spam filters, AI in video games) are largely unregulated.

2. High-Risk AI Regulation

For high-risk AI systems, the EU AI Act imposes stringent regulatory requirements. These include:

Thorough risk assessments before deployment.
Ongoing monitoring during use.
Ensuring traceability and transparency in the system’s decision making processes.
Compliance with technical documentation and human oversight standards.

3. Prohibited Practices

Certain AI uses are banned outright because they are considered to violate fundamental rights. Examples include:

Real-time remote biometric identification in public spaces for law enforcement purposes (with some exceptions).
AI systems that exploit vulnerabilities of specific groups, such as children or the elderly.

4. Governance and Enforcement

A new European Artificial Intelligence Board (EAIB) will be created to oversee the implementation of the AI Act. This body will work alongside national regulators to enforce compliance across the EU.

5. Penalties

Non-compliance with the AI Act can result in hefty fines, with penalties of up to €30 million or 6% of global annual turnover, whichever is higher, for serious violations.

6. Promoting Innovation

While the AI Act imposes strict controls on high-risk systems, it also includes provisions to encourage innovation in the AI sector. It proposes the creation of regulatory sandboxes, controlled environments where companies and public institutions can test AI systems under the supervision of regulators before full deployment.

7. Scope

The AI Act has a broad scope, applying not just to companies and institutions based in the EU, but also to non-EU organisations that place AI systems on the European market or whose AI systems affect individuals within the EU.

The EU AI Act is significant because it represents the first major attempt globally to create a legal framework that balances the benefits and risks of AI. It aims to position the EU as a global leader in AI regulation, prioritizing ethical AI development while promoting safety, transparency, and accountability.

As I said earlier, there are other sets of guidance being issued but they are not enforceable and can be adopted in whole or in part or ignored. The US Dept pf Commerce National Institute for Standards and Technology (NIST) and the UK National Cyber Security Centre (NCSC) have issued such guidance. The NIST guidance for example covers Harm to People, Harm to an Organisation and Harm to an Ecosystem. But it remains just guidance. On the upside it is all based on sound risk management and for those of us who have been steeped in that culture, almost for as long as information security has been taken into the IT sphere, that is music to our ears.

If you want to know more or to chat over the issues, drop me a message. I’d be only too pleased. If you are interested in knowing a bit more about risk management then this article might be of interest to you https://hah2.co.uk/still-on-the-subject-of-cyber-resilience/.

New Cyber Threats and Innovations

Cybersecurity is an ever-evolving field, with new threats and innovations emerging regularly. Not all these threats will apply to everyone, the trick is, and has always been, identifying the threats that apply to you, working out how vulnerable you are too those threats, and applying controls to bring those down to an acceptable level. That acceptable level will change, not just from company to company, but also asset to asset. Don’t waste valuable time and energy trying to achieve a zero-threat level. It doesn’t exist. You need to understand clearly what your appetite for risk is, ie what is an acceptable level of risk for you, and then go for it.

But what emerging threats are there that you just might have to combat in your daily business life. These trends highlight the ongoing innovation in both cyber threats and defences, driven by the growing reliance on digital infrastructure and the rapid evolution of technology.

Here are some suggestions and trends in cybersecurity as of late 2024:

1. AI-Powered Cyber Attacks and Defences

Threats: Cybercriminals are increasingly using AI to launch more sophisticated attacks, such as AI-driven phishing campaigns, automated hacking attempts, and machine learning-based malware that adapts to security measures. We’re seeing AI powered social engineering, phone calls mimicking voices of managers, and similar. Like with just about all AI usage, what it does it make things much easier by reducing human effort. So, attacks can be set up using AI and become almost fire and forget, just letting it get on with it in the background.

Defense: Organisations are countering this with AI-based threat detection systems, anomaly detection, and predictive analytics to identify potential breaches before they occur. What about your defences? Are they keeping up with these types of threat. What about mobile workforces, are your staff covered once they leave the office; do you have a hybrid or even fully remote workforce? If so, are your defences up to the job? Check out https://hah2.co.uk/

2. Ransomware Evolution

Ransomware continues to be a major threat, but it’s evolving with more advanced encryption techniques, and multi-stage attacks where attackers exfiltrate data before encrypting it. They then threaten to publish the stolen data unless a ransom is paid. I recently heard of a company that had been infiltrated through its website which was transactional, ie it sold stuff via the website and the website was connected to their database of products and sales order processing system. The web developer didn’t have sufficiently robust security in place. A good example of an SME being exploited via their supply chain.

Double extortion and Ransomware-as-a-Service (RaaS) have become more common, where hackers sell ransomware kits to other criminals.

3. Zero Trust Architecture

Zero Trust has moved from a buzzword to a mainstream security model. Organisations are adopting a “never trust, always verify” approach, assuming that every user and device, both inside and outside the network, could be compromised.

Implementing least privilege access, micro-segmentation, and continuous authentication are key features of this approach. And no, this doesn’t have to be cost prohibitive.

4. Supply Chain Attacks

Attacks targeting third-party vendors and software providers have increased. By compromising trusted suppliers, attackers can infiltrate many organisations through a single breach.

Notable Examples: The SolarWinds and Kaseya attacks were significant instances that highlighted the dangers of such supply chain vulnerabilities. The attack on the NHS via a contracted service provider, is also a good example but it doesn’t just affect the big organisations. See above for an example of how an SME was attacked via a third-party web designer.

5. Post-Quantum Cryptography

With quantum computing on the horizon, there’s increasing focus on developing encryption algorithms that can resist quantum attacks. Post-quantum cryptography is becoming a hot topic as organisations prepare for the future of computing.

Even without quantum computing, many organisations do not use encryption, even for their critical data. If you are subject to a data breach, but that data is encrypted, you could save yourself a lot of money and reputational damage.

6. Cloud Security and Misconfiguration

As cloud adoption accelerates, the security of cloud environments remains a top concern. Misconfigured cloud settings continue to expose sensitive data, while cloud-native security solutions (e.g., CSPM, CWPP) are becoming more prevalent.

Securing multi-cloud environments and addressing shared responsibility models are critical challenges.

7. Cybersecurity for IoT and OT

The Internet of Things (IoT) and Operational Technology (OT) are becoming frequent attack targets. Securing connected devices, industrial systems, and critical infrastructure from cyber threats is a growing concern, especially as they are often lacking in adequate security protocols.

This is becoming more critical as home working becomes more and more popular. Employees connecting to your company cloud and systems using home broadband and WIFI, are also de fact connecting to any IOT devices that they are using in the home, potentially opening up back doors into your system.

8. Data Privacy Regulations and Compliance

Data privacy is a key focus as more countries introduce stricter regulations like the Data Protection Act 2018, now becoming known as UK GDPR (General Data Protection Regulation). There are other compliances such as FSA regulations and other industry bodies, that many need adherence to. Data breaches can produce fines from regulatory bodies, law suites from those affected, and quite severe reputational damage.

9. Cybersecurity Automation and SOAR

Automation is becoming critical in cybersecurity due to the sheer volume of threats. Security Orchestration, Automation, and Response (SOAR) tools help streamline incident detection and response, freeing up analysts to focus on complex tasks.

Do you have anything in place to automate your defences? Do you monitor your systems for threats?

10. Identity and Access Management (IAM)

Identity theft and credential stuffing attacks are rising, making IAM solutions more important than ever. Multi-factor authentication (MFA), password less authentication, and biometrics are seeing widespread adoption to prevent unauthorised access.

Farewell to Bob – A data protection swan song

Today is somewhat of a sad day for me as tomorrow I will attend Bob Hays funeral. Bob and I started this business when we both returned from Dubai where we worked for HPE in their cyber security business, across the Middle East. We came a long way since starting up in 2017 even though COVID happened in the middle, changing the way that business was conducted by many companies and therefore how we had to adapt and change in order to compete and provide the services needed by the new normal. I think we did a pretty good job all told.

In honour of Bob, I thought I’d focus my blog this week on data protection, his pet subject. He always went to great lengths to point out that we weren’t lawyers but were providing the how to, rather than the legal requirements of data protection legislation. He always said that lawyers were great at telling us what we need to do to meet our legal obligations but were lousy at telling us how to do it.

Data Protection, a somewhat dry subject that many companies, particularly SMEs, think they can get away from by simply paying a bit of lip service. The Data Protection Act 2018, or as it has become known, UK GDPR, is far from a toothless beast and can cause businesses to find themselves in all sorts of problems if they’re not careful.

Businesses that you might not think about, like Estate Agents, hold large amounts of personally identifiable information or PII, that is information that can identify a living individual. Not so long ago a London estate agent was fined £80,000 by the Information Commissioner’s Office (ICO), after leaving the personal data of more than 18,000 customers exposed for almost two years.

The incident occurred when the estate agent passed the details from its own servers onto a partner company. An “Anonymous Authentication” function was not switched off, which meant there were no access restrictions to the data.

It’s surprising just how much PII estate agents hold. Just think about what they ask for when you’re buying a house. In this case the exposed details included bank statements, salary details, copies of passports, dates of birth and addresses of both tenants and landlords.

But in some cases that might not be the end of it. Individuals can sue companies that release data into the wild. In fact, there are now law firms advertising no win no fee when representing these cases. Remember that data breaches almost always involve multiple people, sometimes hundreds if not thousands of records.

One thing that many misunderstand is the link between cyber security and data protection. The Act requires personal data to be secured by ‘default and design’. This means that cyber security requirements must be designed into your data protection processes which could considerably increase the number of policies and processes you require to stay safe and within the law.

Data Protection is a bit of a bureaucratic nightmare I have to admit. Here at H2 we have a raft of templates we use, originally drafted up by Bob, that have been successfully introduced into a variety of organisations, often integrated with their company handbooks. These include:

Data Protection – Overarching Policy	Data Protection Training
Data Protection – Consent	Consent Withdrawal
Subject Access Request	Data Protection Complaints
Retention of Records	Data Breach Notification (note there is an electronic version of this on the ICO website)
Data Protection Impact Assessment Procedure	Security & Control of data protection documentation
Policy Management Review Procedure	Internal Data Protection Breach Register
Retention & Disposal of Records Register	Data Protection Officer (DPO) Responsibilities
Required records to be maintained

Of course these aren’t necessarily the only things needed, there are a whole list of cyber security policies required to complement these. Nearly all are available online, but the problem is knowing what you need and what you don’t and not just downloading, topping and tailing, and hoping for the best. That happens all too often.

Our approach to this has been refined over the years as not just the legislation evolves, both here and in Europe, but as working practices evolve alongside it. We have spent many hours researching solutions and crafting them into services that meet the requirements, which in turn have evolved into a system which works, is both affordable and appropriate for all types of business, and is accreditable to standards such as cyber essentials, if that is required. Flexibility is another key attribute that the new working practices demand. Long gone is the old bastion security system whereby everyone works within a secure boundary, protected by firewalls and other similar technologies. These days we need a system of protection that works regardless of where you are working, office, home, on the move, and can switch seamlessly between them.

When we are first approached by a prospective client and we begin our offer of a free trial to examine their requirements, one of the first things we find is that they don’t know what data they are holding, or where it all is. Oh, they have a general idea; it’s on the cloud server(s), it’s not on laptops or desktops, it’s just the stuff we need to process our clients’ requirements and yes, we’ve only got one copy. And then we install our software that first carries out a discovery exercise and we find that their laptops/desktops are holding lots of copies of the data that is on the cloud server(s). How does that happen? Over time, especially with many now employing the hybrid system of working, ie between the office and remote (home) locations, employees log on to the cloud, find they have a bit of shaky internet link and download the data they need, work on it and then upload it again, forgetting to delete it from their machine. Or they need to share it and attach it to an email and send it out, forgetting, or perhaps not realising, that the data is now stored, attached to an email, on their email server.

Then comes the issue with audit trails. If the ICO ever wanted to carry out an investigation, then having an audit trail of who created/copied/deleted/forwarded what to who, is essential. And let’s not forget the member of the public who is fully entitled to submit a Data Subject Access Request or DSAR, which demands that you reveal what data you are holding on that person. The law insists on it, and you can’t refuse it. I know of a financial firm that took nearly 3 weeks to satisfy a DSAR, taking an employee off billing, for that time.

Our solution meets the requirements needed today and not only that, has a built-in encryption system, all within the same monthly cost. It’ll cost you nothing to trial it and we’d be very surprised if once you’ve seen it and seen the ridiculously low monthly charge for the managed service, you don’t want to keep it.

So a final farewell to Bob, with thanks for all his work in the data protection arena, and for the friendship forged in 3 different company’s before we took the bull by the horns and went out on our own.

Disaster Recovery and Business Continuity

I’ve made quite a bit recently about cyber resilience and the focus being placed on computer outages caused by third party suppliers, highlighted by not just the CloudStrike issue but also the ransomware attack on the UK NHS, made possible by infiltrating a key supplier. All of this of course highlights the importance of supply chain security, but my focus today will be all about disaster recovery and business continuity.

Disaster recovery and business continuity are very much connected but are different. The former is basically a plan for when things go sideways—like when a natural disaster hits, a cyberattack happens, or even if there’s a major tech failure. It’s all about making sure that businesses can bounce back and keep things running as smoothly as possible. Imagine your favourite coffee shop gets flooded. Disaster recovery is like their game plan for getting back on their feet: they might have backup equipment stored somewhere, a way to communicate with customers, and a strategy for cleaning up and reopening. In the tech world, it often involves regular backups of data, having alternate servers ready to go, and making sure everyone knows what to do in case of an emergency. The goal? To minimize downtime and get everything back to normal without too much hassle. It’s like having an insurance policy but for your operations—very important for keeping the lights on when the unexpected hits!

However, we need to understand that when it comes to the type of outages caused by supply chain cyber failures as we saw with CloudStrike, there isn’t much a customer can do to recover from that, without fixes from the suppliers. So, in this instance disaster recovery planning becomes a little difficult to say the least.

Business continuity on the other hand, is all about making sure that a company can keep running smoothly when it is deprived of their IT systems, in whole or in part. So, it’s about keeping business running whilst the disaster recovery plan kicks in and gets stuff back online. The idea is to have a plan in place that helps the business bounce back quickly. This includes figuring out which critical functions need to keep going, having some way of operating manually if necessary. Can you place an order, process an order, raise an invoice, pay a bill etc. It’s like having an emergency kit for your business—batteries included! Companies should create a business continuity plan (BCP) that outlines the steps they’ll take during a crisis. This way, they don’t just react on the fly; they can hit the ground running. It’s all about minimising downtime and keeping customers happy. In short, it’s like being prepared for a rainy day—just with more spreadsheets and meetings!

The first thing to decide is what the priorities are regarding business processes. What is essential, what is a nice to have and what you can live without in the short to medium term. Don’t leave it to managers and staff to guess, have it documented. This priority order is determined based on what is known as a business impact analysis (BIA). This determines the impact of an outage on the business and its customers. Don’t ever forget that your reputation is on the line, and you need to keep your customers serviced and happy. Each business process should have recovery time attached to it, ie how long you can do without it before it becomes truly disastrous.

It all sounds terribly complicated and therefore expensive, but in fact, it isn’t. All the information you need to work this out is already in your hands. You know your business best and you know what’s important and what isn’t quite so important. You just have probably never written it down. And that’s the crux of the matter.

Disaster recovery planning addresses the processes, technical requirements and infrastructure an organisation needs to implement to recover data and operations as required by the business in the event of a disaster. The planning process will involve identification of critical business processes, business impact analysis and thus determination of the overall requirements for a cost-effective plan.

Following the disaster recovery plan, business recovery planning is the process that organisations must use to assess appropriate timeframes for business resumption, also allowable data losses and risk tolerances for business disruptions. As stated earlier, it also needs a plan to carry on manually whilst the disaster recovery plan is implemented. Budgetary requirements for infrastructure and processes, to meet the disaster recovery plan, will also be determined by the business recovery planning process.

There are also 2 other key parts to this. Firstly, companies must ensure that their plans are tested, that everyone in the company is aware of them, where they can find them, and what their responsibilities are in this regard. Testing is critical to ensure that processes, systems and business restoration can meet the requirements laid down for them. Where the plans rely on third party service providers and/or indicate the need to support key customers, these should be involved in the testing process. This will give re-assurance that support will be received and/or given as expected.

And then we have key stakeholders. Who in your organisation is responsible for what, regarding disaster recovery and business continuity planning? Do they know their respective responsibilities, have they accepted this? Have you placed this in their job descriptions? Can they be held to this responsibility? Are they part of the planning and testing process? All seems a bit obvious when you say it, but you’ll probably not be surprised to know that it’s often totally overlooked.

Key Stakeholders	Roles and Responsibilities
CEO/Board of Directors	Aware of business continuity processes, inputs as required Approval of business continuity processes and integration with other technical functions – Note 1 Ownership of business continuity processes together with relevant business units – Note 1
Infrastructure (IT operations)	Input into business continuity processes. Consideration of any infrastructure changes which may impact security architecture. Provide inputs and coordination for systems’ resiliency testing and remediation. Provide costs/budgets for systems requirements
Business units	Creation of BIA and corresponding recovery requirements. Budgetary approval.

Note 1 – these two functions would be carried out by a CIO and/or and CISO in a larger organisation, but as most, even top end, SMBs are unlikely to have anyone in that role, then it must be owned by other board members. I hope this is helpful, but it can only be a guide and there is no one size fits all solution.

Still on the subject of Cyber Resilience………

Last week I talked about whether our ability to demonstrate resilience in the cyber field, is impacted by an over reliance on the companies who supply our IT products and services, and whether over time, that reliance has grown to the point where we are ignoring our own responsibilities in this area. I have used the phrase that you can outsource your IT, but you can’t outsource your responsibility. At the end of the day, there is only you and your employees who have the best interests of you company at heart. You wouldn’t tolerate a single point of failure in your business, you would try and ensure that there is resilience built into your business processes. Why then do we not apply that to IT?

It’s a fact, which often goes unrecognised or ignored, that cyber security is not a technical issue but a business issue, and as such much of it is reliant on policy and process. It is also a fact that your employees are both your first line of defence and potentially, your weakest link. Technology comes in in third place. The cyber mantra is People, Process, Technology. If your people don’t have at least a basic understanding of the issues involved, and you do not have the right policies and processes, rolled out to, and understood by all who need them, then all the technology in the world is likely to be a waste of money.

People

Let’s take a closer look, starting with People. Many businesses out there don’t have inhouse IT support but outsource that to an IT provider. That’s fine, you can ensure that your contract with them spells out their responsibilities regarding your security, your data. It then becomes their responsibility to ensure they protect to the standard stated in the contract, and that their people understand their responsibility. However, you still have your own staff who interact with suppliers, customers and possibly members of the public, on your behalf. I’ve discussed in my blogs before that most businesses are more likely to suffer from scams, than they are from technical hacks. Even ransomware can be considered a scam, as can most phishing attacks. The cyber-criminal is relying on someone on your staff to click a malicious link, or access something they shouldn’t, in order to facilitate the scam. Staff often make the mistake of opening malware because they didn’t know they shouldn’t, not because they are themselves malicious or lack common sense. If they fail, it’s often because they haven’t had any training. Likewise, staff can make mistakes, such as copying and releasing data to unauthorised persons, because they didn’t know they shouldn’t. So, whose failures are those, staff or managers?

Cyber Awareness Training (https://hah2.co.uk/cyber-awareness-training-smes/)

It is critical to the success of the cyber-security resilience that the organisation develops a mature culture of understanding and awareness about cyber risks. Above all this is an issue that must be driven from the top of the organisation – unless cyber-security has the full support of the Board it will be impossible to generate the level of commitment necessary to develop the culture of awareness.

Awareness and understanding of cyber risks are so important because these are the essential elements of the “human firewall” that is all that stands between the organisation’s critical IT systems and the clever social engineering tactics of sophisticated cyber-criminals. Such tactics are even more ubiquitous in our “always on” culture that is driven by the social media and applications accessed through smartphones and other mobile devices. Employees need to be aware of the cyber risks inherent in the devices that are part of their everyday lives; and of the damage to their occupation and livelihoods that can be done as a result of ignorance, carelessness or inattention in their use (and abuse) of such devices.

For the security function in an organisation, the development of a mature culture of awareness and understanding is also critical. In order to achieve the shift in thinking needed to develop the culture of awareness, four things are required:

Board and CEO Level involvement and support
Training that is relevant to the job function. Giving technical awareness training to a shop floor worker will have no impact. If lessons from the training can be taken home and used there as well, big dividends will accrue from the reinforcement provide.
Training must be fun. A little humour lightens the load and will brighten the day of employees and mean that they are more likely to remember what was taught.
Training must be continual. It is more effective to do a little training each month than to have a single long session.

Policy and Process

Moving onto to processes now. First and foremost, all companies should have a cyber security policy. It doesn’t need to be more than a page and should lay down what other polices are needed and who is responsible for producing them and keeping them in date. Any of you who have achieved an ISO certification, in whatever subject you needed to, will have had a similar process to go through and if you ever wanted to achieve ISO27001, then you would need to fully understand and comply with this.

The development and documentation of an agreed set of clear and coherent policies and supporting standards, processes and baselines are essential to the success of a cyber-security program. These must be signed off at board level and preferably set within the context of the organisations cyber-security strategy. However, the nature of the policies and supporting elements themselves will, to some extent, also be governed by the risk management controls that are needed in order to manage risk to a level that is consistent with the organisation’s assessed risk, overall risk appetite and budgetary and cost constraints. I talked about risk management last week and that can be found at https://hah2.co.uk/are-we-failing-in-our-cyber-resilience/.

The are 3 elements to this that are essential:

Policy.
Standards and processes.
Minimum baselines.

This may seem onerous and a step too far for many businesses but they are essential to ensure that you are self-reliant and resilient. The whole process need not be that difficult or expensive and it is a lot cheaper than many of the technical solutions managers jump to, without first ensuring that such technologies are actually what is required. We can offer advice and guidance in this area (https://hah2.co.uk/why-use-an-independent-board-advisor/).

Policy is the highest element in the hierarchy – representing “why” the governance controls must be used. Below this, the standards and processes represent “what” needs to be implemented, in order to deliver compliance with the policy. Thirdly, minimum baselines constitute the element that shows “how” the standards and processes should be delivered. Each of the elements is discussed in more detail below.

Technology

Finally, we come to technology. In last weeks blog (https://hah2.co.uk/are-we-failing-in-our-cyber-resilience/ ) I went into more detail about risk management and how we go about putting the right controls in the right place, to reduce our liability to the lowest level we can, without impacting operational resilience. But let’s just reiterate that many of these controls will be procedural and not necessarily technical, or they might be a mix of the two. The message is don’t get hung up on technology, approach it from a risk management point of view, treat IT and cyber security in the same way you would treat any other business process. Don’t get swamped with technical jargon, it’s not that difficult.

Next Week

Another vital piece in our resilience matrix is disaster recovery and business continuity. Not the same thing and I have already touched on this in recent articles (https://hah2.co.uk/you-can-outsource-your-it-but-you-cant-outsource-your-responsibility/), relevant to the current issues around CloudStrike. Disaster recovery is how you plan to recover from a disaster whilst business continuity is all about how you keep the business running whilst you recover your IT assets and data. It’s quite an involved subject and demands an article on its own.

Are we failing in our cyber resilience?

The fallout from the CloudStrike sensor failure, which caused severe outages throughout the globe, is still being felt and will be felt for some time to come. The emphasis has been on recovery but that will start to change, as we focus more on why it happened, and what can be done to mitigate further failures of this kind. I’ve said already, in a piece I wrote last week (https://hah2.co.uk/you-can-outsource-your-it-but-you-cant-outsource-your-responsibility/ ), that we appear to be becoming too reliant on our IT providers, particularly managed services, to ensure that we remain safe and our services can continue, and we aren’t looking too hard at ensuring resilience is built into our systems. It begs the question, is business continuity planning no longer in fashion.

Alexander Rogan of Abatis also wrote a piece that’s worth reading (https://www.linkedin.com/pulse/billions-lost-chaos-lessons-from-crowdstrike-microsoft-rogan-abxde/}. In his article Alexander emphasises the importance of zero trust architecture and processes. What this essentially means is that we cannot afford to trust anyone other than ourselves. Suppliers are there to help and as such they should ensure that their own processes are robust and include thorough pre-production testing, controlled roll outs and good baseline security measures. Where CrowdStrike falls in this regard, will I’m sure, get thoroughly tested in the not too distant future.

The UK Government is also questioning the resilience of business in the UK to cyber threats (https://amp.theguardian.com/uk-news/article/2024/jul/29/uk-desperately-exposed-to-cyber-threats-and-pandemics-says-minister), and in this case a cyber threat is not necessarily confined to security, it can also mean a crash due to a technical or process failure.

In the cyber security industry, there has long been a running war between those that sell products and those of us concerned more with services. Having been in the industry for 30 years, I have seen this time and again and the product sales nearly always win. Why? Simply because services are a hard sell with a long timeline whereas product sales are easier and quicker to achieve. Why would that be? Again, simple, people like to be able to quickly demonstrate a return on investment. They like to see a product, doing its stuff, even when often, they don’t realise how it’s doing what it’s doing, or if it’s the right product in the right place at the right time.

The risk managed approach is the way to go every time. That has not changed at all in the 30 years I’ve been plugging away at it. It’s all about People, Process and then Technology. I often quote Bruce Schneier, a US scientist on the Harvard Faculty, and a thought leader in this space. He says, ‘If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology’. Breaking this down, what he’s getting at is that first and foremost, you must understand the risks that you face and to do that, you have to identify your cyber assets. By that we don’t mean hardware and even software, what we are talking about is your data and the ability to keep your systems online and accessing what your staff and/or customers need to access, when they need to access it. Once you identify your assets, you then need to identify the threats to those assets and how vulnerable you are too those threats. Threat and vulnerability = risk. And by that we mean the risk to the business if it all goes pear shaped.

Once that’s done, we can then allocate a risk score to each asset with the aim of managing that risk down to an acceptable level, known as the risk appetite. That will change business to business, even asset to asset. You wouldn’t for example allocate the same level of risk [to the business], to a revenue earning system, as you would to perhaps a purely admin system that contains no personal data.

This all sounds terribly difficult and expensive, and that’s why many companies simply don’t do it, or maybe they do a subset of it. But unless you do, then it can be very difficult to know for sure that you are spending your limited budget on the right protections, in the right place. In the long run, it can save you a lot of money. This same assessment applies equally to the CrowdStrike problem, or for that matter, any other company that you have in your supply chain. You need to assess what damage they could do to you if they fail, and what you can do to mitigate that damage. It’s very well and good reaching for the nearest lawyer when it’s all gone to hell, how much better to stop it, or mitigate it, before you get there.

You can outsource your IT, but you can’t outsource your responsibility

It’s hard to look anywhere without seeing reference to the CloudStrike/Microsoft disaster that is still causing issues around the globe. There is plenty of plaudits for the way that both CloudStrike and Microsoft have handled the fall out and remediation (https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/) but you can’t escape the conclusion that it shouldn’t have happened in the first place. Something clearly went wrong in the processes either in place, or worse, not in place, to make sure that software releases are thoroughly tested before release. I also read somewhere that there had been a previous problem with CloudStrike software releases which affected at least 2 versions of Linux, but that this went largely unnoticed. I suppose the predominance of Windows machines in the marketplace would make it impossible to hide a problem of this magnitude.

All that said, what is clear is that there was nothing that an organisation using this application, could have done themselves to prevent it, neither could most disaster recovery plans have dealt with this successfully. The remediation has to come from both CloudStrike and Microsoft, which it is.

I wrote a piece recently which included the difference between disaster recovery and business continuity planning (https://hah2.co.uk/what-are-the-questions-business-owners-ask-when-considering-cyber-security/). Disaster Recovery focuses specifically on restoring IT infrastructure and data after a disaster has occurred, and as already pointed out, in this case that fix has to come from outside the affected organisations and there was very little they could do.

Business Continuity refers to the proactive strategies and plans put in place to ensure that essential business functions can continue in the event of a disruption or disaster. This where organisation can help themselves. Of course, all we really see on the news is the effects of the crash of systems, it’s what makes good television. They don’t show organisations that had good business continuity plans in place and could continue to operate, albeit with reduced functionality.

What struck me, watching it all unfold, was that there were some big organisations that were caught completely on the hop. We saw airline staff reverting to manual ticketing but the overall impression is that this was being done on the initiative of individuals and onsite managers, it didn’t seem to be part of coherent planning. Likewise, we saw the same type of issues in the UK NHS and GP surgeries. If there really was a coherent plan in place, I apologise for suggesting that that wasn’t the case, but it sure didn’t look like it was. Those 2 examples are the really big ones that hit the news. There were quite literally hundreds of organisations that were hit and struggled badly.

When I started out in the Cyber Security game, disaster recovery and business continuity planning were absolutely must haves, in fact, as we know, you can’t achieve ISO 2700x certification without it. These days I see very little emphasis being put on this. Have we reached a stage of total reliance on technology and tech giants like CloudStrike and Microsoft, so that we have fallen into a complacency, relying on our suppliers to look after us? If we have, I think that this shows that this is a big mistake. A great saying is that you can outsource your IT but you can’t outsource your responsibility.

Which leads us neatly onto another point. Supply chain security. We talk a lot about making sure our supply chain is as robust as our own systems and that they have good security, and good policies and processes. But this shows that we need to go further than that. We just can’t trust that any software installed will work and not cause problems, we need to ask questions about how rigorous their testing is, who signs off on a release, how is released and by whom? What tests were done before release? These are perfectly valid questions and any software supplier worth their salt has to have good answers for these questions. Any of you ever asked?

As a provider of protective monitoring solutions which require a light touch agent to be installed on systems, albeit on a much smaller scale than CloudStrike, this has given considerable pause for thought. I have already had these discussions with my supply chain and got good answers, but I’m not going to take my foot off the gas and will keep asking before agent upgrades, which admittedly, don’t happen often. But there will be a certain nervousness in the future when it does happen.

How Can We See a Return on Investment from our Cyber Security Spend?

How are businesses improved through good cyber security? It’s a question just about every customer, or prospective customer, of ours asks themselves. They need to see a return on investment, after all, if you don’t see anything tangible for your money, you’re unlikely to keep going down that road.

When my business partner and I set up H2 after we returned from the Middle East where we’d been working for the HP division that was busy merging itself with CSC (been there done that, didn’t fancy returning to it), the whole question of how we could offer something that gave that return on investment, occupied much of our thinking. What services could we offer at a price that businesses were prepared to pay, and what tangible benefits could we offer?

At first, we were purely a services company, proudly product agnostic, recommending the right products for the right solutions for the right customer. Not at all altruistic, but rather we felt that was the right thing to do be doing. Like many people we didn’t see COVID coming around the corner like a freight train. The pandemic didn’t just change how we would be delivering our services, it changed the whole market, it changed working practices, which are still evolving. That meant that we had to change or die. A stark choice but not one that could be avoided or put off. Like many businesses we had to reengineer the business from the ground up whilst still providing services that customers wanted and could see a need for.

An interesting google search is finding out what businesses are researching online. I was quite surprised to find that the question ‘what is a cyber-attack?’, is the most searched phrase, by a long shot. This suggests that many are still confused as to what a cyber-attack actually is. Breaking that down, its probably not all that surprising because of all the various types of cyber-attack that are constantly being rammed down peoples’ throats and I think the cyber security industry needs to take responsibility for that. There’s a big difference between education and propaganda. FUD (fear, uncertainty and doubt) is a common method used by many to sell security. Personally, I’m not in favour of doing that. I like to educate, not scare.

Other subjects being searched for are ransomware, phishing, spoofing, cyber threats, insider threats and cyber awareness (there are more but they’re a long way down the list).

What people want to know hasn’t changed all that much, neither has the types of threats. What has changed is how those threats present themselves, how the methodologies have changed in order to match new technologies and working practices, particularly the move to remote or home working and the additional threats that this poses. AI is making a big impact already and that impact is going to get bigger as time goes on. Email spoofing for example, that is faking an email purporting to come someone legitimate in order to get someone to take some action that is in some way fraudulent, is now being done over the phone with AI being used to fake someones voice. It’s a scary development and there are now several well reported instances of this happening in the US. If it’s happening there, it’s only a matter of time for it to happen in the UK and across Europe.

One of the first services we offered was the Cyber Maturity Assessment and our very first client took that service. Our brief was to examine their Cyber Security and Data Protection posture, including policies, processes and technical configuration and controls. They were pleased that our assessment was very comprehensive in discovering the threats and vulnerabilities to their systems and that we described them in terms of business risk. We developed comprehensive policies and processes that were all encompassing and designed to fit in with the style and presentation of their employee handbook. All good but it required us to attend their site for a couple of days which was, at one time, normal and acceptable but in terms of the ‘new normal’, not so much.

Whilst we still offer that service, remote services are much more popular and much more in keeping with how businesses are now operating. It doesn’t much matter where their staff are working, home, office or on the move. What matters is that their protections are maintained regardless.

As we developed our new offerings we researched and came up with solutions that do just that. We adopted Software as a Service (SaaS) and found some very innovative solutions that we can use to provide a managed security service to our clients at a very affordable price.

Returning to our first paragraph, how do we show a return on investment? Using our SaaS platform, we offer a 14 day free trial during which we can show a client where they currently stand and then carry out some quick remediations to show how that can be improved, so that the client can see the value of what they are going to get, using their own data. It works and I commend it to you.

Check it out – https://hah2.co.uk/

RELATIONSHIP MANAGEMENT

Some introspection is good for the soul they say, and I can’t help but try and apply that to how we, ie so called cyber security professionals, approach prospective clients, or indeed, converse with existing clients. Is there a certain smugness involved where we believe we know best and whether we do or not, try and push what we think a client should have, rather than what a client needs. Does this attitude, no matter how hard we try to suppress it, make prospective clients wary of what we have to say?

Of course we have our methodologies, particularly regarding risk management, and I am a great exponent of getting that right, but how many of us take the time and make the effort, to understand the clients situation. It’s what we used to call situational awareness. It didn’t just refer to a client understanding their own situation, but us appreciating that situation as well. After all, not all clients, even those in the same vertical and the same size of business, has exactly the same problems.

A lot depends on who you are and who you work for. The larger IT system integrators and consultancies do take the time to try and understand their clients. In fact, going back to the early 2000s, working for a multinational IT product and services giant, we never actually outright tried to sell anything. Our salespeople at the enterprise level, were very much relationship managers, they built relationships with their clients, got to know their businesses and made suggestions that the client might be interested in. The mantra was that people buy from people, not from brands. Brands are great in the marketing context, building awareness and a market presence, but they never seal the deal.

Of course, at the start of a sales year some bright young thing sporting an MBA and a burning ambition would move the salespeople around, ruining years of relationship building and vertical knowledge, because ‘it needs shaking up’. The end result is hacked off employees who look elsewhere and hacked off clients who think, well, if I have to start with someone else, I’d might as well see what else is out there. But that’s a whole other story.

Research your client, understand their business, make sure you’re building a relationship with the right person. Understand the industry, their pain points and needs. Only then can you really start to craft a value proposition and call to action that the client can relate to. Foster that relationship, make sure that not every call you make is about your products and/or services, make it more personal. Above all, be genuine, it pays off in the end.

I guess what I’m getting at is that it really is all about building relationships with people. You can have a deep understanding of your subject, fantastic product knowledge and a sparkling personality, but if you talk down to a prospective client, come across as in anyway condescending or patronising, you’ve lost the game. You have to listen, ask intelligent questions, show that you are really interested in understanding the issues that face this prospective client, and make suggestions that might be suitable to solve the pain points being put in front of you.

We decided a couple of years ago, to offer a service which we entitle Board Advisor (https://hah2.co.uk/why-use-an-independent-board-advisor). The point was not to try and sell solutions, not to try and sell any particular product, but to work with our clients to identify the issues they really do face and work through those issues to identify potential solutions that will help them in their business by protecting those critical assets that would cripple the business if they were not available or were corrupted in some way. It’s all about putting appropriate measures in place before disaster strikes and preventing the vastly higher costs of recovery post-breach, from immediate financial impacts to lasting reputational damage.

The security threat landscape is becoming both more sophisticated and easier to exploit by the less sophisticated. This seems to be at odds but such things as artificial intelligence (AI) is transforming nearly every industry, including cybersecurity. Whilst AI enables enhanced threat detection and response, this powerful technology can also be weaponised by cyber criminals. As AI-driven cyber-attacks grow more advanced, organisations must act quickly to implement robust defences. Trying to keep abreast of this whilst running a business and focusing on your core requirements, is daunting and frankly, you’re not going to succeed.

If you’d like to discuss the art of the possible, give us call.

Author: Kevin Hawkins