Kevin Hawkins, Author at H2 Cyber Security for SMEs

Is Protective Monitoring Necessary for an SME?

I’ve talked about protective monitoring in the past but there is still some misperceptions about it, particularly amongst SMEs. Probably first and foremost is that it is way too expensive, which leads to thinking that it’s not for them and is much more of a nice to have than a necessity. I thought I’d take a bit of a deeper dive into this.

So, what is it?

Protective monitoring in cyber defence is a systematic approach to continuously observing and analysing an organisation’s digital environment to detect, prevent, and respond to security threats. It involves gathering and analysing data about network traffic, system activity, and user behaviours to identify potential vulnerabilities or malicious activities. Here’s a breakdown of its key components and purposes:

For a small or medium-sized enterprise (SME), implementing cyber protective monitoring is crucial for a variety of reasons. This proactive approach can be the difference between quickly identifying and mitigating threats or facing significant damage from a cyber-attack. Here are key reasons why SMEs should consider cyber protective monitoring:

1. Protection Against Data Breaches

SMEs often hold sensitive data like customer information, financial records, and intellectual property. Companies like law firms, financial advisors and estate agents, will hold years worth of personal identifiable information as defined by the Data Protection Act, or UK GDPR if you prefer. Protective monitoring helps identify unusual activity within their network, such as unauthorised access or data exfiltration attempts, allowing for swift action to prevent breaches.

This is especially important as SMEs can be perceived as easier targets by cybercriminals compared to larger enterprises with more robust defences.

2. Regulatory Compliance

Many industries have strict regulations around data privacy and cybersecurity, such as GDPR and PCI-DSS. Protective monitoring helps SMEs stay compliant by providing visibility into how data is accessed, used, and secured.

It allows them to maintain audit trails of activity, which are often required to prove compliance during an audit or investigation.

3. Early Threat Detection

Cyber threats are constantly evolving, and attackers are often inside a network for days or weeks before launching an attack (such as ransomware). Protective monitoring enables the detection of anomalous behaviour that could indicate a security threat before it becomes critical.

This helps minimise damage by enabling a faster response to potential threats like malware infections, unauthorized access, or network vulnerabilities.

4. Cost-Effectiveness in the Long Run

While some SMEs may view cyber protective monitoring as an additional cost, it is often more cost-effective than dealing with the fallout of a cyber-attack. The financial impact of a breach includes legal fees, loss of business, damage to reputation, and potential fines from regulatory bodies.

By investing in monitoring, SMEs can save significantly on these potential costs, making it a smart investment, especially now that there are systems specifically designed and costed for SMEs.

5. Building Trust with Clients and Partners

Customers and business partners expect their data to be handled securely. An SME with strong cybersecurity practices, including protective monitoring, can build trust and demonstrate its commitment to data security.

This can serve as a competitive advantage, especially when dealing with larger enterprises or industries that prioritise security.

6. Rapid Incident Response

When a security incident occurs, the speed of the response is critical. Cyber protective monitoring provides real-time alerts when suspicious activities are detected, enabling SMEs to quickly isolate affected systems and take necessary actions.

A rapid response can help contain potential damage, maintain business continuity, and limit operational disruptions.

7. Mitigating Insider Threats

Not all cybersecurity risks come from outside the organisation. Insider threats, whether malicious or accidental, can cause significant damage. Protective monitoring can help detect unusual behaviour from employees or contractors, such as unauthorised access to sensitive data or suspicious data transfers.

This allows SMEs to address these issues before they lead to data leaks or other security incidents.

8. Scalability and Adaptability

As SMEs grow, their digital footprint and potential vulnerabilities expand as well. Cyber protective monitoring solutions can scale alongside the business, ensuring that security measures remain effective even as new systems, networks, and applications are added.

This adaptability makes it easier for SMEs to adjust their cybersecurity strategy as their needs change, without a complete overhaul of their security infrastructure.

9. Insights for Better Decision-Making

Beyond just identifying threats, protective monitoring can provide valuable insights into network usage and performance. SMEs can leverage this data to make better strategic decisions regarding their IT infrastructure, such as identifying redundant systems or optimising network resources.

It can also highlight areas that require further security investments, helping prioritise spending on cybersecurity.

10. Improving Overall Cybersecurity Posture

Cyber protective monitoring is a key part of a broader cybersecurity strategy. By continuously monitoring and analysing network activities, SMEs can better understand their vulnerabilities and areas for improvement.

This helps create a culture of security within the organisation, where cybersecurity is not just an afterthought but an ongoing priority.

Overall, cyber protective monitoring provides visibility, control, and peace of mind for SMEs, helping them navigate the complex and ever-changing landscape of cyber threats. By taking a proactive stance, they can protect their assets, maintain customer trust, and ensure long-term resilience against cyber-attacks.

Protective monitoring is not just for corporate organisations, but is for everyone, especially now that there are systems and services designed especially for SMEs and priced accordingly. Don’t leave it until it’s too late. Playing catch up and fixing problems after the event, is always much more expensive that taking a pro-active stance.

To learn more about the protective monitoring managed solutions we provide please click here https://www.hah2.co.uk/

Cybersecurity Awareness Month

Did you know that October is Cybersecurity Awareness Month? No – not terribly surprised after the poll we put out asking how important this subject was. The response was truly frightening. Cybersecurity Awareness month has participants in many countries and sponsored by many governments and tries to push awareness of the importance of this subject, across all industries.

Why do we think it’s so important? Why would an SME bother with it? Well, in short, it’s probably the single most cost effective and quickest win you can make. It really doesn’t have to cost a fortune, it’s not techie if done right, is educational and it beefs up your security by ensuring your staff can spot a scam when they see one, can recognise social engineering and how to counter it, won’t open a rogue email and it generally keeps the subject in the forefront of minds.

OK, but what’s the threat? Do hackers/scammers prey on SMEs? Is there sufficient financial reward there for them? Yes, yes and again yes. The UK GDP is made up of north of 90% from SMEs. Just think about that – 90% of the countries wealth is generated by SMEs, so a huge financial target. The big companies spend a fortune on cyber security protections. Most spend up to 15% of their annual IT budget on security and when you think that the IT budget often runs into millions, that’s big bucks. SMEs can’t afford that and that makes them a much easier target.

I wrote a blog recently about the findings of the 2024 cyber security breaches survey. The report tells us that among businesses, there has been a shift in the proportion saying cyber security is a “fairly” high priority (e.g. from 35% of businesses last year, to 40% this year). The proportions of businesses saying it is a very high priority is consistent with last year (36% last year and 35% this year). In 2023, as evidenced by the qualitative interviews, it was felt that cyber security had moved down the agenda among the businesses where it was already seen as a more marginal priority, and among businesses that typically have the fewest resources to deploy. The qualitative findings this year point towards an increased awareness of the risks that are faced when not prioritising cyber security, which could explain the increase in businesses this year rating it as a high priority.

It is more common for larger businesses to say that cyber security is a high priority (93% of medium businesses and 98% of large businesses, vs. 75% overall). The same is true for high-income charities (93% of those with income of £500,000 or more, vs. 63% overall). This continues the pattern seen since 2020, where larger organisations tend to treat cyber security more seriously, and consequently allocate more resources to it.

Businesses in the following sectors tend to treat cyber security as a higher priority than others:

information and communications (65% a “very” high priority)
finance and insurance (61% say it is a “very” high priority)
health, social care and social work (62% a “very” high priority).

These percentages are still very low and amongst this, if we drill down, we will find that the prevailing answer amongst SMEs remains to reach for technology for protection. Technology will help, but it isn’t the full answer. When faced with constraints such as a tight budget it’s essential that a business prioritises its spend, making sure that it is targeting what really needs protection, and making sure that the protections in place are actually doing what you think they’re doing. That is essentially what we refer to in regard to risk management. It’s a business issue, not an IT issue.

In the 2024 survey, half of businesses and around a third of charities report having experienced some kind of cyber security breach or attack in the last 12 months. As in previous years, larger businesses and charities are more likely to identify breaches or attacks than smaller ones. This latter point is worth mentioning because it’s generally only the larger businesses that have some kind of monitoring in place to identify an attack and many smaller businesses only find out when they start losing money.

Of course, good old COVID has had its effect, and I know we still bang on about it but that’s because its effect is long term. It has changed our working practices in many respects although there is more of a move towards a return to the workplace currently, but some businesses have embraced the hybrid working practice and look unlikely to change. My own client base has only seen one client move to 100% remote working, but they are all working some form of hybrid working pattern.

Many corporates have had some form of hybrid working for a long time, pre-COVID. When I was at HP and before that in Symantec, we worked the hot desk system with people working remotely a couple of days a week. It’s not new at that level but it is at the SME level, and we need more sophisticated ways of protecting ourselves at a price we can afford. And that’s been the focus for us, and we are now confident that we have solutions that fit an SMEs requirement, at a price they can afford.

Cyber Resilience – what it means and just as importantly, what it doesn’t mean

Cyber resilience can mean different things to different people, depending upon their priorities, their perception of cyber security and the business they are in. This means that there are a lot of misconceptions about what it means, and I’m sure I’ll get some disagreeing with what I write here. And that’s OK, because it really can depend on your situation as I’ve said above. Essentially though it refers to an organisation’s ability to prepare for, respond to, and recover from cyber incidents, ensuring that critical operations continue despite attacks, failures, or unexpected events. Unlike cybersecurity, which focuses mainly on preventing attacks, cyber resilience combines prevention with the capability to withstand and adapt to adverse conditions, even if breaches or disruptions occur.

It encompasses five main aspects:

Identify: Understanding what an attack or scam might look like.
Protection: Implementing strong security measures to prevent cyberattacks and minimise vulnerabilities.
Detection: Quickly identifying and recognising cyber threats or breaches when they occur.
Response: Reacting effectively to contain and mitigate the impact of a cyber incident.
Recovery: Restoring systems and data to normal functioning after an incident, while learning from the event to improve future preparedness.

A cyber-resilient organisation is not only prepared to handle potential attacks but is also structured to adapt, recover, and continue functioning in the face of disruptions. This approach ensures minimal downtime, data loss, and damage to reputation.

Now let’s look at some misconceptions around cyber resilience.

Complete Immunity from Cyber Attacks: Cyber resilience does not mean that an organisation will be entirely immune to cyber threats. Rather, it focuses on minimising the impact and ensuring continuity in the face of such events. No system can be entirely hack proof.
Just Having Strong Cybersecurity: While cybersecurity is a crucial part of cyber resilience, the latter encompasses more than just security measures like firewalls or anti-virus software. It also involves having an effective strategy encompassing sound policies and processes, incident response plans, business continuity plans, and recovery strategies. A purely preventive approach, without considering recovery, does not constitute true cyber resilience.
A One-Time Effort: Cyber resilience is not a one-time project or a static state. It requires continuous assessment, updating of policies, and adaptation to new threats. It’s an iterative process of improvement and adjustment to maintain resilience against evolving threats.
Quick and Easy Recovery: While resilience involves the ability to recover, it does not guarantee that recovery will be quick or without challenges. It means that recovery is possible, but it might still take time and effort to restore normal operations depending on the severity of the incident.
An IT Department’s Responsibility Alone: Cyber resilience is not just about technical solutions managed by the IT department. It involves a holistic approach, including organisational culture, employee training, risk management strategies, and coordination across different business functions. It’s an organisational-wide commitment. In a nutshell, it’s a business issue, not an IT issue.

Understanding what cyber resilience is not helps organisations better align their strategies towards truly being prepared for and able to recover from cyber incidents.

Don’t get bogged down in this though, don’t think it’s way too difficult and not really something that an SME for instance, can afford to do. It’s a matter of scale and there are some things that a corporate business will need to do, that an SME doesn’t need to do, or perhaps can scale down.

Help is at hand and if you want to talk this over then do please give me a call.

Can Remote Working be Dangerous?

Well frankly, yes it can be dangerous. There is a myriad of issues which have sprung out of remote working since COVID, with many SMEs, now operating a hybrid working scenario, although in my experience, certainly amongst my customer base, there are very few going 100% remote.

Businesses of all sizes have been forced to transform their operations to support remote work and by and large have done well, but not without many challenges—including video conferencing burn out, (along with wishing they’d taken out shares in Zoom!!), and a yearning to work together in person again, someday. We all realise that group working, face to face, is often necessary not just for efficiency, but because we are social animals. Experience has taught many businesses many things, but strangely, to my mind at least, many have simply not grasped the potentially dire consequences in terms of cyber security and data protection.

A distributed work environment i.e., personnel spread around various locations, office, home working, even the local coffee shop, creates critical challenges and new security threats as a result. The speed with which this has happened has meant that many simply did not take this into account and if they did, thought, well, this is temporary, and it won’t matter in the long run. Well perhaps, but as many are now finding, there have been advantages to home working, not least a lowering of costs in terms of how much office space is needed to carry out the business function. Many are now looking at Hybrid working i.e., from home with a day or two in the office during the week. There are pros and cons to this outside of the scope of this article, and businesses will have to make their own judgements, but one thing is clear and that is that businesses need to understand the risks now inherent in distributed work and need to get better at cyber security and data protection, in those environments.

Employees when remote working, are at much greater risk than those in offices. Since home connections are less secure, cybercriminals have an easier entry into the company network. Furthermore, the explosion of various online tools, solutions, and services for collaboration and productivity tend to have the bare minimum of security default setting, and updates from third-party vendors can change security preferences and be easily overlooked.

Phishing becomes an even greater threat to home workers simply because, in an office environment, they have access to colleagues and managers, who they can approach for advice and guidance. This is much harder to replicate with remote workers, especially those who may not be particularly tech savvy and who may not wish to become ‘burdensome’ to their co-workers.

Ransomware also enjoys an advantage in the remote working model. If their connection to the company is blocked, it is more difficult for workers to get assistance from the right experts and authorities. And since trust levels are lower when working from home, some workers will be concerned that they have “done something wrong” and so may be more reluctant to seek help. While this risk can be addressed by increased training, as well as messaging that vigilance and involving corporate IT will be rewarded, it can still be an uphill battle.

One of the biggest dangers I still see day to day is the dangers inherent in working from the local coffee shop. This is a subject that I tend to jump on every so often, because it’s one that people just don’t seem to get. Whenever I drop into a coffee shop for my caffeine infusion, there are usually at least a couple of people with their laptops open, working away on business issues. I could see open spreadsheets (and easy to read if you were sitting behind them), and all have their email open. They are often on a video call, and I can often hear all their side of the conversation, annoying enough for other café users but they are oblivious of the data being released into the wild.

If you are among those free Wi-Fi lovers, there’s bad news for you… your online privacy and security is at risk, if you rely on the weak to non-existent Wi-Fi security protocolsat coffee shops. This means that you could be exposed to various threats such as identity theft which has over 15 million cases each year, data theft/breaches, introducing malware to your business network and that of your customers/suppliers. This list is not exhaustive.

Free or public Wi-Fi’s are hotspots for hackers and data snoopers who want to steal your private data or financial information. It is easy for hackers to do that nowadays. You will be surprised to know the different ways hackers can compromise your device or your private information and why you shouldn’t rely on Wi-Fi security at coffee shops as they come with a lot of risk.

Unencrypted Data Exposure: If the Wi-Fi network is not encrypted, your sensitive information (e.g., passwords, emails, and financial data) can be intercepted by hackers using packet-sniffing tools.

Man-in-the-Middle Attacks: Hackers can position themselves between you and the network, intercepting and potentially altering the communication between your device and the server, leading to data theft or manipulation.

Fake Hotspots (Evil Twin Attacks): Cybercriminals may create a rogue Wi-Fi network that mimics the coffee shop’s legitimate network. If you connect to it, they can access all the data transmitted over the connection.

Malware Injection: Open networks can allow hackers to inject malware or viruses onto your device, which can lead to long-term breaches of your data or systems.

Session Hijacking: Attackers can intercept your session cookies, giving them access to your accounts, even if you’re using secure websites.

To mitigate these risks, use a VPN, avoid sensitive transactions, and ensure your firewall and antivirus software are active. Although a VPN may not save your data if it’s stored on your laptop.

We are huge supporters of Cyber Awareness training for managers and staff, arguing that this is no longer a ‘nice to have’ and is now very much a necessity. In fact, it is arguably the biggest quick win, giving the greatest potential return on investment that there is. Of course, this means that companies must understand what their threats, vulnerabilities and risks are, to assess exactly what training is going to be the most effective.

But that alone won’t save you from a dedicated hacker. We need to look at some more technical solutions to help you beat attacks. Here at H2 we have researched and developed services using Software as a Service (SaaS), which, being cloud based, work wherever you are, office, home or coffee shop, and encrypts your most sensitive data whether on your machine, or in transit.

If you feel a no obligation chat about this would be helpful, give us a call.

How are Mid-Market Businesses Faring Regarding Cyber Security

Mid-sized businesses are under as much pressure to keep the organisation secure as are the larger corporates but without the deep pockets that those larger corporates have. Because of this they are also fast becoming the easy target that we often view small businesses as being, but with a larger payload for the cyber-criminal. In fact, in 2023, 59% of medium sized businesses suffered a cyber-attack or data breach in the UK.

The biggest issue facing mid-market organisations is balancing limited resources with the growing complexity and volume of cyber threats. The lack of resources is compounded by an overall dearth of cyber-security skills in general, and a real lack of skills in mid-sized companies and the IT companies they often outsource to. Key aspects of this challenge include:

1. Resource Constraints: Mid-market organisations typically lack the budget and personnel to implement robust, enterprise-level cyber-security solutions. They may not have dedicated security teams, forcing IT departments to manage cyber-security alongside other duties. This dilutes skills and leaves them vulnerable to sophisticated attacks.

2. Rising Threat Sophistication: Cyber-criminals are increasingly using advanced tools and techniques, such as ransomware, phishing, and supply chain attacks, now enhanced with AI, which often outpace the security capabilities of mid-sized businesses. These organisations are prime targets because they are often seen as less protected than larger enterprises but more valuable than small businesses.

3. Compliance and Regulatory Challenges: As regulations like GDPR, FCA, and industry specific mandates grow, mid-market companies struggle to meet compliance requirements without the same level of support and infrastructure that larger organisations can afford.

4. Lack of Cyber security Awareness: Employees at mid-market organisations may not have adequate training on cyber-security best practices, making them vulnerable to human error, such as falling for phishing scams or weak password practices.

5. Third-Party Risks: Mid-market companies often rely on third-party vendors for various services, but they may lack the resources to thoroughly vet these vendors’ security postures, leading to vulnerabilities in their supply chain.

Addressing these issues requires mid-market organisations to prioritise cyber-security despite resource constraints, invest in scalable security solutions, and foster a strong security culture throughout the organisation.

There is a very real difficulty in breaking out of this cycle. The mind set of most board members is to focus on the core business and keep costs to an absolute minimum. Costs are important in a mid-sized business, especially one where margins may be tight. IT budgets will focus on items, both hardware and software, that are required to keep the revenue flowing and its cyber-security solutions, including data protection solutions, are often seen as nebulous because there is no obvious return on investment. CIOs/CISOs/IT Directors are often left trying to prove a negative, ie we haven’t had any security issues because we have protections in place, as opposed to we haven’t had any security issues therefore we don’t need to budget for protections. It’s a years old argument that never seems to have a resolution.

However, breaking out of this cycle, this thought process, is very important. Cyber threats, what we refer to as the threat landscape, are evolving at a frightening pace, often enhanced using AI. This will further compound any argument about budget simply because there is this need to keep pace with the cyber-criminal, and those of us in this industry know that we have always been playing catch up.

So how do we do it? Not an easy answer but one way that some mid-sized organisations are now looking at is managed security solutions. The provision of SOC (Security Operations Centre) solutions, in a shared way, as we do with cloud services for example, makes managed security more affordable. Many of the large enterprise organisations also make use of managed security solutions for the reasons of cost. On site solutions are not just expensive in terms of hardware and software, but also staffing costs, training etc, can be exorbitant. So, sharing those costs becomes very attractive.

Of course, there is no one size fits all solution and most managed service providers will have a set of services it provides, and do not tailor their services simply because it would make them too complex and expensive to provide, somewhat obviating the whole reason for doing it in the first place.

To make sure that you have the level of protection that you need, then you must do some up front work, maybe getting some consultancy that will save you money in the long run, by getting the protections and levels of service in place that you actually need.

There are several solutions around and organisations that provide them, and I do recommend that you shop around. Some are better than others and the CrowdStrike issue hasn’t done the reputation of managed services much good. Here at H2 we offer solutions for both monitoring your technical estate, your user actions, email, cloud services etc, as well as your data protection issues providing monitoring of any compliances that you may need, including UK GDPR, PCI DSS as an example.

If in doubt give us call, we’d be delighted to chat it over, offer a demo and a FREE trial lasting up to 30 days for the data protection solutions and 14 days for the more technical solution.

Another Rant about Cyber Awareness Training

I make no apologies for having another rant about this subject, because it’s so important and easy to do. Recently I put up a poll on LinkedIn asking about how important it was felt that cyber awareness training was. The poll got a lot of views but very little interaction, which is very disappointing. It tells me that either people out there have little interest in it, don’t consider it a priority, or even a necessity, or don’t understand it’s importance to the safety of their systems, data and staff.

Very simply put Cyber Awareness Training is the quickest and cheapest win you can make in the fight against the cyber-criminal.

Cyber awareness training is an essential component of modern organisational security strategies. It equips employees with the knowledge and skills necessary to recognise, respond to, and mitigate cyber threats. Let’s look at some key advantages of implementing cyber awareness training:

1. Enhanced Security Posture: Employees who are educated about cyber threats can identify potential risks and take proactive measures to protect sensitive information. This collective vigilance strengthens the overall security framework of the organisation.

2. Reduction in Human Error: Many cyber incidents stem from human mistakes, such as falling for phishing scams or mishandling sensitive data. Cyber awareness training helps mitigate these errors by teaching employees how to recognise red flags and adhere to best practices.

3. Improved Incident Response: Training empowers employees to respond effectively to security incidents. By understanding protocols and reporting procedures, they can act swiftly in the event of a breach, minimising potential damage.

4. Cultivation of a Security Culture: Regular training fosters a culture of security within the organisation. When employees prioritise cybersecurity in their daily activities, it becomes an integral part of the organisational ethos, enhancing overall resilience.

5. Compliance with Regulations: Many industries face stringent regulatory requirements regarding data protection and cybersecurity. Cyber awareness training helps organisations comply with these regulations, reducing the risk of legal penalties and reputational damage.

6. Increased Employee Confidence: Knowledgeable employees are more confident in their ability to navigate the digital landscape safely. This confidence can lead to greater engagement and a more proactive approach to cybersecurity.

7. Cost Savings: By preventing cyber incidents through effective training, organisations can save significant costs associated with data breaches, including legal fees, recovery expenses, and loss of business reputation.

8. Adaptability to Emerging Threats: The cyber threat landscape is constantly evolving. Cyber awareness training keeps employees informed about the latest threats and trends, ensuring they can adapt their behaviours accordingly.

9. Strengthened Team Collaboration: A shared understanding of cybersecurity risks encourages collaboration among teams. Employees are more likely to communicate about potential threats and share knowledge on best practices, leading to a more cohesive defence strategy.

10. Customer Trust: Organisations that prioritise cybersecurity demonstrate their commitment to protecting customer data. This commitment builds trust with clients and partners, which is crucial for maintaining long-term relationships in today’s digital economy. In summary, cyber awareness training is a vital investment for organisations looking to enhance their cybersecurity defences. By equipping employees with the knowledge and skills needed to identify and respond to threats, organisations not only protect their assets but also foster a culture of security that benefits everyone involved.

And the reality is that it doesn’t have to cost a fortune. It can in fact be done very cost effectively, in such a way that it doesn’t require staff to spend time in the classroom by automating the courses and having them delivered online, allowing staff to carry it out in their own time.

Is Cyber Security about Tech or the Business?

It’s simply a fact that many owners, managers, directors etc, believe that cyber security is a technology issue and is best left to those guys in IT who understand that stuff. Here at H2 we spend a lot of time and effort trying to educate C level people, that it really is a business issue, although it has significant input from the techies. It’s a business issue because breaches can have a significant financial and reputational impact. It’s also an IT issue because it involves implementing technical measures to protect systems and data. Effective cyber security requires a collaboration between business leaders and IT professionals to address both the strategic and technical aspects of security.

The crux of the issue though, is that it must be led by the business, and at board level. It requires a strategy to be followed, which is laid down at board level and which is focused on the goals and aspirations of the business, especially when your IT is outsourced. You can outsource your IT, but you can’t outsource your responsibility.

A valid argument is that the proliferation of security tools creates an illusion of safety. Organisations, large and small, often believe that by deploying a firewall, antivirus software and maybe some other tools, such as intrusion detection systems, they are adequately protected. This ignores the fact that such tools are controls put in place to mitigate risks identified and qualified in terms of importance, in a risk assessment and unless the benefits they bring are properly identified, and the solutions placed and configured correctly, they may well not be doing what you think they are doing. This thinking can also introduce significant third-party risks into your domain. The most recent example of this is the CrowdStrike issue which caused so much chaos throughout the globe.

To be fair to most companies in the smaller and mid-market arenas, their focus is on obtaining IT solutions as cost effectively as possible, and with the minimum of support costs. Cost control is vital to most. This means that they are extremely reluctant to spend money on what they see as not being part of their core business. Of course, if they get a cyber-attack or scam, or worse a data breach attracting the attention of the ICO, then their costs trying to fix the issue can easily outstrip any costs in prevention. Unless they have a well thought out risk managed strategy, they are wide open to slick sales pitches which push products. The rub is that in order to have that well thought out strategy, it means spending on what they see as expensive services that can seem somewhat nebulous, not something they can see and feel, and there is that vague feeling that they are being led to do something that really isn’t all that important.

The approach most take is to trust their IT provider to give them the protections they need. Most of these IT providers are what is known as re-sellers, ie they sell other people’s products and will push those products because that’s their business model. What they won’t do is take a risk managed approach which is essential in ensuring that any limited spend on security, limited because of cost constraints, is targeted where it’s needed and will be most effective. In other words, the technological approach taken by most IT support company’s will do half a job at best.

In essence then, if you don’t understand the risks you face, how can ensure that your cyber security strategy and protections are fit for purpose? Risk management is all about helping us to create plans for our future in a deliberate and responsible way. This requires us to explore what could go wrong in an organisation, on a day-to-day basis.

A quote from Bruce Schneier, Fellow at the Berkman Center for Internet & Society at Harvard Law School, goes like this:

‘If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology’.

How do we approach this then? First and foremost, you need to identify the risks that you face. How can you identify that risk and then mitigate it? Taking risks is a part of business. You assess risk every day when doing business. Do you want to do this deal? What happens if it goes not as expected? Do I want to take this person on? Whether you formally undertake a risk assessment or whether you assess that risk informally, you are working out what is appropriate to a level that is consistent with the risk that your organisation is prepared to take. Failure to do that will almost certainly be damaging to your business, perhaps fatally so.

The difference between assessing day to day business risk and assessing risk to cyber assets, is one of understanding. What is a cyber asset? In this context insert the word ‘information’ instead of cyber. It is the information contained within the IT system that is the important asset, not the piece of hardware it is sitting on. You understand your business risk, after all it is your business, but do you understand information risk? Do you have a clear idea of what information assets you have and where they are? Before you answer that think it through. Do you really know where all the data is? OK, you know that you have a server or servers probably in a cloud somewhere (cloud storage and access is a whole other subject) and that somewhere in those servers there is a bunch of data which runs your business. How much of that data has been saved onto staff workstations when they needed it to carry out some work? How much has been copied off somewhere else for what was probably a very good reason at one point? How well is your firewall functioning? Can malware work its way onto the network because the firewall does not have Universal Threat Management installed and can therefore be probing the servers and workstations. And we haven’t even thought about changes in working patterns. How many of your staff now work remotely some or all of the time. I could go on.

How can we be sure where all this information is and how important each bit is to the business? How can we assess this risk to the business, if information is lost or otherwise compromised? What about ransomware, phishing scams etc? The good news is that some of this can now be automated and managed for you at an affordable price and you can even arrange a 14 day totally free trial to assess its effectiveness.

AI and Risk Management – What’s Changed?

The answer to the question posed is, quite simply, nothing, in terms of risk management. The process of analysis of the threats posed to any particular organisation or infrastructure, the assessment of how vulnerable that organisation is to those threats, and the application of controls to bring down the risk to an acceptable level, remains pretty much the same.

Of course, the threat is changing, quite considerably, with billions being invested globally in the field of AI, which is affording huge advances in technology which brings with it great benefits but also new risks which are potentially more dangerous than those associated with current IT systems.

There is guidance coming out from several sources internationally on these risks and how to address them, but the EU has gone one step further and is producing the first comprehensive continental legislation on AI, the EU AI Act. Unlike most countries guidance, it is not voluntary but will become law and has real teeth. It wouldn’t be a shock to find other countries following suite.

The EU AI Act focuses on impacts to the rights, freedoms and safety of the public within the EU but is nevertheless a landmark legislative proposal by the European Union aimed at regulating artificial intelligence across its member states. Proposed in April 2021, the Act seeks to establish a comprehensive legal framework for AI that ensures the technology is developed and used in a way that respects fundamental rights, safety, and democratic values.

Here are the key points of the EU AI Act:

1. Risk-Based Approach

The Act adopts a risk-based classification system that categorises AI systems into four risk levels:

Unacceptable Risk: AI systems deemed harmful (e.g., social scoring by governments) are banned outright.
High Risk: AI systems with significant potential to impact safety, rights, or wellbeing (e.g., biometric identification, critical infrastructure) must meet strict requirements regarding transparency, accuracy, oversight, and documentation.
Limited Risk: Systems with moderate risk must comply with transparency obligations (e.g., AI chatbots must inform users they are interacting with AI).
Minimal Risk: Systems with negligible or no risk (e.g., spam filters, AI in video games) are largely unregulated.

2. High-Risk AI Regulation

For high-risk AI systems, the EU AI Act imposes stringent regulatory requirements. These include:

Thorough risk assessments before deployment.
Ongoing monitoring during use.
Ensuring traceability and transparency in the system’s decision making processes.
Compliance with technical documentation and human oversight standards.

3. Prohibited Practices

Certain AI uses are banned outright because they are considered to violate fundamental rights. Examples include:

Real-time remote biometric identification in public spaces for law enforcement purposes (with some exceptions).
AI systems that exploit vulnerabilities of specific groups, such as children or the elderly.

4. Governance and Enforcement

A new European Artificial Intelligence Board (EAIB) will be created to oversee the implementation of the AI Act. This body will work alongside national regulators to enforce compliance across the EU.

5. Penalties

Non-compliance with the AI Act can result in hefty fines, with penalties of up to €30 million or 6% of global annual turnover, whichever is higher, for serious violations.

6. Promoting Innovation

While the AI Act imposes strict controls on high-risk systems, it also includes provisions to encourage innovation in the AI sector. It proposes the creation of regulatory sandboxes, controlled environments where companies and public institutions can test AI systems under the supervision of regulators before full deployment.

7. Scope

The AI Act has a broad scope, applying not just to companies and institutions based in the EU, but also to non-EU organisations that place AI systems on the European market or whose AI systems affect individuals within the EU.

The EU AI Act is significant because it represents the first major attempt globally to create a legal framework that balances the benefits and risks of AI. It aims to position the EU as a global leader in AI regulation, prioritizing ethical AI development while promoting safety, transparency, and accountability.

As I said earlier, there are other sets of guidance being issued but they are not enforceable and can be adopted in whole or in part or ignored. The US Dept pf Commerce National Institute for Standards and Technology (NIST) and the UK National Cyber Security Centre (NCSC) have issued such guidance. The NIST guidance for example covers Harm to People, Harm to an Organisation and Harm to an Ecosystem. But it remains just guidance. On the upside it is all based on sound risk management and for those of us who have been steeped in that culture, almost for as long as information security has been taken into the IT sphere, that is music to our ears.

If you want to know more or to chat over the issues, drop me a message. I’d be only too pleased. If you are interested in knowing a bit more about risk management then this article might be of interest to you https://hah2.co.uk/still-on-the-subject-of-cyber-resilience/.

New Cyber Threats and Innovations

Cybersecurity is an ever-evolving field, with new threats and innovations emerging regularly. Not all these threats will apply to everyone, the trick is, and has always been, identifying the threats that apply to you, working out how vulnerable you are too those threats, and applying controls to bring those down to an acceptable level. That acceptable level will change, not just from company to company, but also asset to asset. Don’t waste valuable time and energy trying to achieve a zero-threat level. It doesn’t exist. You need to understand clearly what your appetite for risk is, ie what is an acceptable level of risk for you, and then go for it.

But what emerging threats are there that you just might have to combat in your daily business life. These trends highlight the ongoing innovation in both cyber threats and defences, driven by the growing reliance on digital infrastructure and the rapid evolution of technology.

Here are some suggestions and trends in cybersecurity as of late 2024:

1. AI-Powered Cyber Attacks and Defences

Threats: Cybercriminals are increasingly using AI to launch more sophisticated attacks, such as AI-driven phishing campaigns, automated hacking attempts, and machine learning-based malware that adapts to security measures. We’re seeing AI powered social engineering, phone calls mimicking voices of managers, and similar. Like with just about all AI usage, what it does it make things much easier by reducing human effort. So, attacks can be set up using AI and become almost fire and forget, just letting it get on with it in the background.

Defense: Organisations are countering this with AI-based threat detection systems, anomaly detection, and predictive analytics to identify potential breaches before they occur. What about your defences? Are they keeping up with these types of threat. What about mobile workforces, are your staff covered once they leave the office; do you have a hybrid or even fully remote workforce? If so, are your defences up to the job? Check out https://hah2.co.uk/

2. Ransomware Evolution

Ransomware continues to be a major threat, but it’s evolving with more advanced encryption techniques, and multi-stage attacks where attackers exfiltrate data before encrypting it. They then threaten to publish the stolen data unless a ransom is paid. I recently heard of a company that had been infiltrated through its website which was transactional, ie it sold stuff via the website and the website was connected to their database of products and sales order processing system. The web developer didn’t have sufficiently robust security in place. A good example of an SME being exploited via their supply chain.

Double extortion and Ransomware-as-a-Service (RaaS) have become more common, where hackers sell ransomware kits to other criminals.

3. Zero Trust Architecture

Zero Trust has moved from a buzzword to a mainstream security model. Organisations are adopting a “never trust, always verify” approach, assuming that every user and device, both inside and outside the network, could be compromised.

Implementing least privilege access, micro-segmentation, and continuous authentication are key features of this approach. And no, this doesn’t have to be cost prohibitive.

4. Supply Chain Attacks

Attacks targeting third-party vendors and software providers have increased. By compromising trusted suppliers, attackers can infiltrate many organisations through a single breach.

Notable Examples: The SolarWinds and Kaseya attacks were significant instances that highlighted the dangers of such supply chain vulnerabilities. The attack on the NHS via a contracted service provider, is also a good example but it doesn’t just affect the big organisations. See above for an example of how an SME was attacked via a third-party web designer.

5. Post-Quantum Cryptography

With quantum computing on the horizon, there’s increasing focus on developing encryption algorithms that can resist quantum attacks. Post-quantum cryptography is becoming a hot topic as organisations prepare for the future of computing.

Even without quantum computing, many organisations do not use encryption, even for their critical data. If you are subject to a data breach, but that data is encrypted, you could save yourself a lot of money and reputational damage.

6. Cloud Security and Misconfiguration

As cloud adoption accelerates, the security of cloud environments remains a top concern. Misconfigured cloud settings continue to expose sensitive data, while cloud-native security solutions (e.g., CSPM, CWPP) are becoming more prevalent.

Securing multi-cloud environments and addressing shared responsibility models are critical challenges.

7. Cybersecurity for IoT and OT

The Internet of Things (IoT) and Operational Technology (OT) are becoming frequent attack targets. Securing connected devices, industrial systems, and critical infrastructure from cyber threats is a growing concern, especially as they are often lacking in adequate security protocols.

This is becoming more critical as home working becomes more and more popular. Employees connecting to your company cloud and systems using home broadband and WIFI, are also de fact connecting to any IOT devices that they are using in the home, potentially opening up back doors into your system.

8. Data Privacy Regulations and Compliance

Data privacy is a key focus as more countries introduce stricter regulations like the Data Protection Act 2018, now becoming known as UK GDPR (General Data Protection Regulation). There are other compliances such as FSA regulations and other industry bodies, that many need adherence to. Data breaches can produce fines from regulatory bodies, law suites from those affected, and quite severe reputational damage.

9. Cybersecurity Automation and SOAR

Automation is becoming critical in cybersecurity due to the sheer volume of threats. Security Orchestration, Automation, and Response (SOAR) tools help streamline incident detection and response, freeing up analysts to focus on complex tasks.

Do you have anything in place to automate your defences? Do you monitor your systems for threats?

10. Identity and Access Management (IAM)

Identity theft and credential stuffing attacks are rising, making IAM solutions more important than ever. Multi-factor authentication (MFA), password less authentication, and biometrics are seeing widespread adoption to prevent unauthorised access.

Farewell to Bob – A data protection swan song

Today is somewhat of a sad day for me as tomorrow I will attend Bob Hays funeral. Bob and I started this business when we both returned from Dubai where we worked for HPE in their cyber security business, across the Middle East. We came a long way since starting up in 2017 even though COVID happened in the middle, changing the way that business was conducted by many companies and therefore how we had to adapt and change in order to compete and provide the services needed by the new normal. I think we did a pretty good job all told.

In honour of Bob, I thought I’d focus my blog this week on data protection, his pet subject. He always went to great lengths to point out that we weren’t lawyers but were providing the how to, rather than the legal requirements of data protection legislation. He always said that lawyers were great at telling us what we need to do to meet our legal obligations but were lousy at telling us how to do it.

Data Protection, a somewhat dry subject that many companies, particularly SMEs, think they can get away from by simply paying a bit of lip service. The Data Protection Act 2018, or as it has become known, UK GDPR, is far from a toothless beast and can cause businesses to find themselves in all sorts of problems if they’re not careful.

Businesses that you might not think about, like Estate Agents, hold large amounts of personally identifiable information or PII, that is information that can identify a living individual. Not so long ago a London estate agent was fined £80,000 by the Information Commissioner’s Office (ICO), after leaving the personal data of more than 18,000 customers exposed for almost two years.

The incident occurred when the estate agent passed the details from its own servers onto a partner company. An “Anonymous Authentication” function was not switched off, which meant there were no access restrictions to the data.

It’s surprising just how much PII estate agents hold. Just think about what they ask for when you’re buying a house. In this case the exposed details included bank statements, salary details, copies of passports, dates of birth and addresses of both tenants and landlords.

But in some cases that might not be the end of it. Individuals can sue companies that release data into the wild. In fact, there are now law firms advertising no win no fee when representing these cases. Remember that data breaches almost always involve multiple people, sometimes hundreds if not thousands of records.

One thing that many misunderstand is the link between cyber security and data protection. The Act requires personal data to be secured by ‘default and design’. This means that cyber security requirements must be designed into your data protection processes which could considerably increase the number of policies and processes you require to stay safe and within the law.

Data Protection is a bit of a bureaucratic nightmare I have to admit. Here at H2 we have a raft of templates we use, originally drafted up by Bob, that have been successfully introduced into a variety of organisations, often integrated with their company handbooks. These include:

Data Protection – Overarching Policy	Data Protection Training
Data Protection – Consent	Consent Withdrawal
Subject Access Request	Data Protection Complaints
Retention of Records	Data Breach Notification (note there is an electronic version of this on the ICO website)
Data Protection Impact Assessment Procedure	Security & Control of data protection documentation
Policy Management Review Procedure	Internal Data Protection Breach Register
Retention & Disposal of Records Register	Data Protection Officer (DPO) Responsibilities
Required records to be maintained

Of course these aren’t necessarily the only things needed, there are a whole list of cyber security policies required to complement these. Nearly all are available online, but the problem is knowing what you need and what you don’t and not just downloading, topping and tailing, and hoping for the best. That happens all too often.

Our approach to this has been refined over the years as not just the legislation evolves, both here and in Europe, but as working practices evolve alongside it. We have spent many hours researching solutions and crafting them into services that meet the requirements, which in turn have evolved into a system which works, is both affordable and appropriate for all types of business, and is accreditable to standards such as cyber essentials, if that is required. Flexibility is another key attribute that the new working practices demand. Long gone is the old bastion security system whereby everyone works within a secure boundary, protected by firewalls and other similar technologies. These days we need a system of protection that works regardless of where you are working, office, home, on the move, and can switch seamlessly between them.

When we are first approached by a prospective client and we begin our offer of a free trial to examine their requirements, one of the first things we find is that they don’t know what data they are holding, or where it all is. Oh, they have a general idea; it’s on the cloud server(s), it’s not on laptops or desktops, it’s just the stuff we need to process our clients’ requirements and yes, we’ve only got one copy. And then we install our software that first carries out a discovery exercise and we find that their laptops/desktops are holding lots of copies of the data that is on the cloud server(s). How does that happen? Over time, especially with many now employing the hybrid system of working, ie between the office and remote (home) locations, employees log on to the cloud, find they have a bit of shaky internet link and download the data they need, work on it and then upload it again, forgetting to delete it from their machine. Or they need to share it and attach it to an email and send it out, forgetting, or perhaps not realising, that the data is now stored, attached to an email, on their email server.

Then comes the issue with audit trails. If the ICO ever wanted to carry out an investigation, then having an audit trail of who created/copied/deleted/forwarded what to who, is essential. And let’s not forget the member of the public who is fully entitled to submit a Data Subject Access Request or DSAR, which demands that you reveal what data you are holding on that person. The law insists on it, and you can’t refuse it. I know of a financial firm that took nearly 3 weeks to satisfy a DSAR, taking an employee off billing, for that time.

Our solution meets the requirements needed today and not only that, has a built-in encryption system, all within the same monthly cost. It’ll cost you nothing to trial it and we’d be very surprised if once you’ve seen it and seen the ridiculously low monthly charge for the managed service, you don’t want to keep it.

So a final farewell to Bob, with thanks for all his work in the data protection arena, and for the friendship forged in 3 different company’s before we took the bull by the horns and went out on our own.

Author: Kevin Hawkins