Cyber Awareness Training Archives - H2 Cyber Security for SMEs

What are the questions business owners ask when considering cyber security?

I wrote a post recently about what SMEs care about regarding Cyber Security v the continued FUD (fear, uncertainty and doubt), which many sales pitches tend to rely on, which helps foster the view that it’s all a little hyped up and not as serious as it advertised. Well, I hope my post did a little to dispel this and show that there really is an issue out there that needs to be addressed by all businesses, not just the corporate big boys. Let’s leave the stats and hype behind and concentrate on what SMEs need to be thinking about.

What is the cost of ignoring cyber security?

Perhaps this is the first question that they should be asking. The financial hit of a data breach can be crippling, especially for the smaller businesses who are perhaps running on tight margins and for whom cash flow is often critical. The average clean up for a smallish business is about £27K. this relates to system restoration, hardware replacement, and the implementation of enhanced security measures. and doesn’t include financial loss from the actual data stolen, or whatever scam was perpetrated, and any fall out from compliance failures, such as fines from the ICO. And at least a third of organisations admit to losing customers post a data breach, highlighting reputational damage and a loss of customer trust.

If you take all that into account, you should be able to work out what the potential cost might be for you.

So, what questions should owners, managers and board members be asking?

I think many get bogged down in the technicalities of IT and don’t consider it in business terms. They don’t think about the business impact of cyber security, about what it is they’re trying to protect. It’s not your IT systems, it’s your data that is the crown jewels. IT systems can be replaced, that’s what your insurance is about, but once the data is stolen, then you are in very real trouble.

Risk Management

Talking of insurance, that’s perhaps how you should be viewing Cyber Security solutions. Don’t think tech, think protecting the business. First and foremost, the board members need to ask themselves if they have a good handle on their cyber risk. Have they identified their cyber assets? What is a cyber asset? Cyber assets are not just hardware and software, in fact those are the least of your worries. It’s the data, where it is and how it’s protected that is important. Have you assessed the risk to those assets? Have you assessed the training requirements for your staff, not just the techies but all staff? Think People, Process and then Technology.

Once you have done this, then you can consider what controls need to be put in place to reduce the risk to an acceptable level.

Below is some of the controls you will need to consider. This list is not exhaustive

1. User Access Control (Admin access is a whole other discussion)

This isn’t just about passwords. Yes, they remain important but on their own, they are no longer sufficient. Nonetheless weak passwords, password re-use and password sharing remain one of the leading root causes of a data breach. 123456 and, believe it or not, password, remain the most used passwords across the world!

It is imperative that you have a strong password policy, dictating not just the length of the password, but also its construction, ensuring that there is a good mix of upper and lower case characters, numbers and symbols, that together make things very difficult for password crackers.

On their own though passwords remain a potential weak spot. Multi factor authentication (MFA), sometimes referred to as 2FA, provides that extra layer of defence and can help to protect against brute-force attacks, phishing scams, key-logging and social engineering. MFA can be simply implemented on most email platforms and within various apps you are using. For those of you trying for Cyber Essentials or ISO 27K series, MFA is mandatory, so make sure it’s put in place.

2. Are you backing up your files?

This seems an obvious thing to do but you’d be surprised how often when trying to restore from a backup, it fails. This is often because the backup routine was set up back in the mists of time and has never been reviewed and even more dangerous, it’s never been tested to see if it works. Set up your backup regime, have it reviewed regularly and tested regularly to make sure it works. If you are backing up online, keep in mind that if a cyber-criminal gets access to your systems to, for example, carry out a ransomware attack, then they can probably get at your back up as well. So, belt and braces, consider having an offline backup as well as an online backup. The latter is more convenient but is vulnerable.

3. Do you train your staff in cyber awareness?

My favourite subject – cyber awareness training. Your first line of defence is your staff, but if not trained adequately, they can be your biggest weakness. It’s known in the trade as the insider threat, but it is caused mainly by human error, staff members doing something they shouldn’t, not maliciously but simply because they didn’t know they shouldn’t. It accounts for 88% of data breaches. Providing your people with training on the threats, current scams and basic cyber awareness reduces the chance of a cyber-attack. This really is the easiest and cheapest quick win any organisation can take in reducing their risk exposure.

4. Do your employees regularly travel or work remotely?

This brings us neatly to what Microsoft coined as the New Normal. Essentially this means remote working shared with in office working, known as the hybrid working model, or for some, moving to a totally remote working system. Totally remote is not as common as hybrid working but is becoming more normal with certain size businesses in certain commercial verticals. It’ll never work for everyone, but for those who have embraced it, it saves a considerable amount of expense. It does however require us to rethink our cyber strategy.

Work-from-home employees are at much greater risk than those in offices. Since home connections are less secure, cybercriminals have an easier entry into the company network. Furthermore, the explosion of various online tools, solutions, and services for collaboration and productivity tend to have the bare minimum of security default setting, and updates from third-party vendors can change security preferences and be easily overlooked.

Phishing becomes an even greater threat to home workers, often because, in an office environment, they have access to colleagues and managers, who they can approach for advice and guidance. This is much harder to replicate with remote workers, especially those who may not be particularly tech savvy and who may not wish to become ‘burdensome’ to their co-workers.

Ransomware also enjoys an advantage in the work-from-home model. If their connection to the company is blocked, it is more difficult for workers to get assistance from the right experts and authorities. And since trust levels are lower when working from home, some workers will be concerned that they have “done something wrong” and so may be more reluctant to seek help. While this risk can be addressed by increased training, as well as messaging that vigilance and involving IT support will be rewarded, it can still be an uphill battle.

We need to break out of the old ‘bastion’ security model of a network protected by firewalls and other technologies and think about solutions that are designed to protect your assets regardless of where your employees work from. They exist and aren’t hard to find.

5. Where is all your data stored and who has access to it?

Data tends to proliferate, especially when working remotely. Cyber awareness training helps here, but it also helps for management to have a handle on data storage. All organisations have this problem, but it becomes more acute for those businesses that hold large amounts of what is known as Personal Identifiable Information or PII. This is information that can identify a living individual and compromise their privacy in some way. Financial advisors, estate agents, solicitors etc, all share this issue. The data protection act, becoming referred to as UK GDPR, is not a suggestion, it is law.

One of the biggest issues we find with organisations of all sizes, is that they think they know where all their data is but get quite a surprise when they discover multiple instances of the same data set. This has become a real issue in that the new normal tempts users when working remotely, with possibly less than robust broadband, to copy data from cloud storage to their PC or laptop to ensure they can keep working on it. Then they upload it again when they’ve finished but forget to delete their copy. That’s just one instance but it is vital to understand where all this data is. What if for instance, you get what is known as a subject access request, where a client or other member of the public wants to know exactly what personal data you have on them, and why. I spoke to a financial advisor not long ago who told me that it took one of their partners off the road for 3 weeks, to discover where all the data was kept on just one person. But under the law, they had no choice but to bite the bullet.

There are several systems on the market which will help with this but what most need now is a system that works regardless of the location of the user and continues providing that cover when the user moves from one location to another. This is just a suggestion, but we’d be delighted to demo it to anyone who is interested. https://hah2.co.uk/gdpr-data-protection/

6. Disaster Recovery and Business Continuity

Business Continuity refers to the proactive strategies and plans put in place to ensure that essential business functions can continue in the event of a disruption or disaster. This could include natural disasters, cyber-attacks, power outages, or any other event that could disrupt normal business operations. Business Continuity planning typically involves identifying critical business processes, implementing redundant systems and processes, and developing communication plans to ensure that the organisation can continue to operate smoothly in the face of adversity.

Disaster Recovery, on the other hand, is focused specifically on restoring IT infrastructure and data after a disaster has occurred. This could involve recovering lost data, restoring systems and networks, and ensuring that IT operations can resume as quickly as possible. Disaster Recovery planning typically involves creating backup systems, implementing data recovery procedures, and testing these plans regularly to ensure they are effective.

Both are critical components of a comprehensive risk management strategy and should be integrated into an organisation’s overall resilience planning efforts.

Just like backups, which are a crucial part of Disaster Recovery, these plans can become very quickly out of date and useless, unless reviewed periodically and tested to see if they work.

7. Vulnerabilities and Threats

A vulnerability is a flaw or weakness in an asset’s design, implementation, or operation and management that could be exploited by a threat. A threat is a potential for a cybercriminal to exploit a vulnerability. A simple way to explain this is that a vulnerability is the inability to resist a hazard or to respond when a disaster has occurred. For instance, people who live on plains are more vulnerable to floods than people who live higher up. The threat is the flood itself.

IT risks and vulnerabilities are the potential threats and weaknesses that can affect the performance, security and reliability of your business function and processes. They can have serious consequences for your business goals, customer satisfaction, and competitive advantage.

Identifying vulnerabilities to your cyber security assets and then identifying the threat to those assets in terms of the vulnerability being exploited, informs your risk and enables you to assign a value to it. Financial value can be assigned to the risk score if you so wish. You then apply controls to bring the risk down to an acceptable level, starting with the Very High risks, and then bringing them down to whatever is acceptable to you. That acceptable level, known as the risk appetite, will vary business to business, risk to risk.

8. Supply Chain Security?

In short, a supply chain attack is a cyber-attack that seeks to damage an organisation by targeting less-secure elements in the supply chain.

An example of such an attack was published by NCSC and points out that many modern businesses outsource their data to third party companies which aggregate, store, process, and broker the information, sometimes on behalf of clients in direct competition with one another.

Such sensitive data is not necessarily just about customers, but could also cover business structure, financial health, strategy, and exposure to risk. In the past, firms dealing with high profile mergers and acquisitions have been targeted. In September 2013, several networks belonging to large data aggregators were reported as having been compromised.

A small botnet was observed exfiltrating information from the internal systems of numerous data stores, through an encrypted channel, to a botnet controller on the public Internet. The highest profile victim was a data aggregator that licenses information on businesses and corporations for use in credit decisions, business-to-business marketing, and supply chain management. While the attackers may have been after consumer and business data, fraud experts suggested that information on consumer and business habits and practices was the most valuable.

The victim was a credit bureau for numerous businesses, providing “knowledge-based authentication” for financial transaction requests. This supply chain compromise enabled attackers to access valuable information stored via a third party and potentially commit large scale fraud.

OK, it was over 10 years ago, but don’t think it won’t happen again.

NCSC also cited what is known as a watering hole attack, which works by identifying a website that’s frequented by users within a targeted organisation, or even an entire sector, such as defence, government, or healthcare. That website is then compromised to enable the distribution of malware.

The attacker identifies weaknesses in the main target’s cyber security, then manipulates the watering hole site to deliver malware that will exploit these weaknesses.

The malware may be delivered and installed without the target realising it (called a ‘drive by’ attack) but given the trust the target is likely to have in the watering hole site, it can also be a file that a user will consciously download without realising what it really contains. Typically, the malware will be a Remote Access Trojan (RAT), enabling the attacker to gain remote access to the target’s system.

If you are in someones supply chain, then you need to make doubly sure that your security protects your customer as well as yourself. And conversely, if you are connected electronically to someone who supplies you, are you sure that you are protected from any vulnerability they may have.

H2 provides affordable and flexible one-off and ongoing data protection and cyber risk protection services.

To learn more about the services we provide please click here https://www.hah2.co.uk/

Please feel free to give us a call or email.

Alternatively, you can book a slot using our Calendly link, https://bit.ly/3yoT0qi

T: 0800 4947478

M: 07702 019060

E: kevin_hawkins@hah2.co.uk

Trust H2 – Making sure your information is secure

All about H2

Introduction

All the information below is contained within the website but we thought it might be useful to summarise it in one post to make it easier for people who want to understand what we are all about.

About myself and H2

I like to start any discussion by saying that I’ve been in the cyber security game almost since before it was a game! I started in Information Security at the MOD at a time when IT and databases were in their infancy and got in on the ground floor. I subsequently went to work for the NHS, HP/HPE, CSC and Symantec, during which time I led many major cyber security projects in the public and private sectors, designing and commissioning the Security Operations Centre for the FCO, carrying out several projects for the MOD, leading the security team for the new online passport application, as well as several high street banks.

In 2013 I was asked to go to the middle east to set up a Cyber Security team covering the UAE, Bahrain, Saudi Arabia, and Qatar, growing the team from 3 people to 24.

On return my business partner and I set up H2 to serve the SME community. Sadly, my business partner did not survive the pandemic, and I am now the sole management of the company.

So why SMEs? Surely there’s more money in corporate security?

Well yes there is, but SMEs are at the heart of our ethos. During our time working in the corporate sector, it became clear that there was little to no support given to SMEs, either at the S, or the M end of the scale, and the big security companies and system integrators were content to leave that to their resellers ie those local IT support companies that resold their products.

Here at H2 we understand that the only real difference between an SME and a corporate organisation, in terms of cyber security, is that of scale. We have therefore scaled our services, the products that support them, and our pricing, to fit with an SMEs issues and

pocket. We like to say that we offer a triple A service providing solutions that are Appropriate (to you), Affordable and Accreditable (to standards such as Cyber Essentials).

Take a look at our Blog and social media posts. We try to inform and educate, placing a link between what we know, and what SMEs need to know but are rarely told.

Solutions Provided to SMEs

The first thing that we discovered is that SMEs have a very poor grasp of cyber security issues, although that is changing following the pandemic when many were forced to change their working practices almost overnight and have subsequently embraced a distributed working model. There is no doubt that the propensity for working from home, or other remote locations, since COVID has introduced some very difficult, or at least challenging, security vulnerabilities into SME networks. For instance, prior to the pandemic, when they were 100% office based (except perhaps some mobile salespeople), their local IT provider will have almost certainly set up what we called the bastion security model. Ie, like a castle, a bastion, you had a wall around you, and for belt and braces, you also had a moat. The gateway was robust, had a drawbridge and portcullis, or let’s call it a secure firewall and anti-malware system. Everything was locked up inside and nice and secure (in fact it probably wasn’t but that’s for another day).

Whilst Microsoft didn’t invent the term the ‘new normal’, they were the first, I believe, to apply it to IT, following the enforced change in working practices brought about by the pandemic. Many companies have embraced this new normal and have settled into some form of hybrid working. Of course, this is nothing new, it’s been ‘a thing’ for years now, certainly in corporate organisations. The real change came about in SMEs for whom it really was quite revolutionary. Corporate bodies will have spent a lot of money on a variety of remote access systems to keep their data secure, whilst SMEs not only had to rush unprepared because of the pandemic, but they simply didn’t have the budget to employ more secure connections.

What the pandemic has done is change that, or perhaps arguably, accelerated the change to a more distributed way of working, already underway in corporate organisations but now common amongst SMEs.

Our first challenge then was that of education. Changing the mindset of SMEs, moving them away from being simply technology focused, onto a more business oriented cyber

security focus. Cyber security is a business issue, not a technical issue and that is something that many SMEs fail to grasp. Any true cyber security professional takes a

risk managed approach, identifying the risks posed to their client, and then applying the principles of People, Process and then Technology, in that order. That risk managed

approach is equally applicable to all sizes of organisation in all sectors and has not changed since the advent of the internet.

Taking the services we provide as shown clearly on our website (where pricing is shown), www.hah2.co.uk, the first is that of Board Advisory, where we offer advice and guidance to our clients regarding their security. We often end up providing this advice for free as we are putting forward solutions to solve their issues but there is of course a limit to that. We also offer a Cyber Maturity Assessment (CMA), which is close to a full risk assessment but tries to keep the costs down to an order that an SME can afford. The CMA is fully described on the website, and we won’t reprint that here.

Another service we provide is Penetration Testing and Vulnerability assessment. Pen Testing is a point in time test ie the minute you finish it and have read the report, it’s out of date. It is however useful to do once a year or when you add a new feature to your systems, or take a new system into use. We use a fully qualified CREST team who can, if you wish, also carry out attack simulations.

Vulnerability assessments are carried out continuously via agents deployed on the network. The main difference is that as a Pen Test will find real issues, a vulnerability assessment will find things that you may be vulnerable to, but which haven’t necessarily been exploited and in fact, may not be a real issue once investigated. They are, however, continuous throughout the year and can be more effective.

We talked earlier about People, Process and then Technology. Arguably your first line of defence is your people. They can also be your weakest link. Data leaks often occur inadvertently, due to a lack of awareness rather than malicious intent. We offer cyber awareness training designed to equip your team with the knowledge and skills to safeguard sensitive information.

This training can be delivered in one of 2 ways. The first is classroom based, either on site or over a remote connection such as Zoom or Google Meet. The second is online training provided via another of our solutions which will be described below and allows

staff to pick when they will take some time to undertake the training which is delivered in a modular fashion, taking up very limited time which won’t take staff away from their desks to too long.

Another very important service which we provide online, cloud based, using a SaaS solution, is aimed at Data Protection. Clients with large amounts of sensitive data that they wish to protect, use this solution. It is essentially a data loss prevention system

that is designed and priced for SMEs, using state of the art file level encryption. This system comes with a 30-day free trial so that clients can see it for themselves.

Based on Actifile it is tailored to the unique needs of the modern business which often sees its staff work remotely as well as in the office. It protects the valuable data you hold and reduces your risk, without breaking the bank. It covers:

Insider Threat Detection: Protect your business from internal threats posed by employees
Ransomware Protection: Safeguard your data from ransomware attacks that can cripple your operations
Data Leakage Prevention (DLP): Prevent confidential information from falling into the wrong hands
Data Privacy and Compliance: Ensure you meet GDPR requirements and avoid costly fines
Automated Encryption: Protect sensitive data with encryption that’s easy to manage.

In the dynamic world of cybersecurity, staying ahead of evolving threats requires a comprehensive approach that adapts to the ever-changing landscape. At H2, we recognise that one-size-fits-all solutions often fall short, which is why we’ve developed a flexible and scalable cybersecurity solution powered by Guardz, to address the needs of our clients.

Our approach is grounded in sound risk management principles, ensuring that our solutions are aligned with your specific cybersecurity requirements. Whether you need one or more of our products woven into a solution, we can tailor that solution to meet your exact needs and budget.

This complements the data protection solution whilst remaining capable of standing alone. Especially devised and priced for SMEs, it maintains our commitment to affordability and accessibility which is reflected in our incredibly competitive price of

£12 per seat, which includes no hidden charges, add-ons, or expensive infrastructure costs. The solution comes with a 14-day trial to give you hands-on experience with our solutions and assess their impact on your business.

This solution comes with a fully loaded Cyber Security Awareness training course, and a Phishing simulation capability.

You should note that we have bundled the 2 managed services together and offer them at a price reduced by £3 per seat per month.

Finally, we offer certification in Cyber Essentials and Cyber Essentials Plus which provide robust defences, endorsed by UK government to guard against common cyber-attacks. They are required certifications to work with public sector entities, and achieving certification signals a commitment to securing client data.

We now offer different pricing options to our clients. For Cyber Essentials we offer:

Our Supported Package whereby we guide you during yourself assessment ensuring that you achieve certification first time, can be purchased at a one-off price which we are happy to quote for or a monthly subscription from £61 per month.

If you are short on time or not too sure what to do, try our Turnkey Package whereby we carry out the assessment for you in total, once again ensuring that you achieve certification first time. This can also be purchased as a one off at a price which we are happy to quote for or there is a subscription price which starts at £120 per month.

We can offer consultancy around ISO 2700X if it is considered desirable or appropriate. We can advise on that.

Policies and Processes – a topic that can quickly lead to feelings of despair

When discussing cyber security, many envision suspicious figures hunched over screens in dimly lit rooms, perhaps with the scent of Jamaican Woodbines lingering in the air. Unfortunately, this image is misleading; cyber security is often quite routine, especially for those of us focused on defence rather than offence. It fundamentally revolves around People, Process, and Technology.

I published a blog recently about how hackers hack (https://hah2.co.uk/how-do-hackers-hack/). In this article, I delve into how hackers profile individuals and organisations through various methods, frequently utilising what is known as social engineering. This technique is primarily non-technical and hinges on a cybercriminals ability to infiltrate the defences of your employees to extract information. Defending against this threat relies heavily on the first two components of cyber risk management: People and Policy.

For regular readers, it’s clear how much I value cyber awareness training. I consistently emphasise that your staff can be both your most significant asset and your greatest vulnerability. Cyber awareness training is essential and should include educating employees about your organisations structure and operations. They should know whom to contact if they have concerns regarding cyber security or suspect social engineering attempts. This information needs to be embedded in the policy, potentially accompanied by a related process that connects People with Process.

In addition to cyber security policies, we also have data protection policies, which are separate but certainly overlap. While nearly every organisation requires security policies, the necessity and comprehensiveness of data protection policies vary based on the type of business. For instance, you might not immediately think of Estate Agents as data holders, yet they manage substantial amounts of Personally Identifiable Information (PII)—data that can identify an individual. Not long ago, a London estate agent faced an £80,000 fine from the Information Commissioner’s Office (ICO) for leaving the personal data of over 18,000 customers exposed for almost two years due to a failure in their data sharing practices.

It’s astonishing how much PII estate agents possess. Consider all the information they request when buying a house! In this case, compromised details included bank statements, salary information, copies of passports, birth dates, and addresses for both tenants and landlords.

Moreover, individuals have the right to sue companies that mishandle their data. Today, law firms even promote “no win no fee” agreements for these cases. Remember that data breaches typically involve numerous individuals—often hundreds or thousands of records.

To solidify the connection between cyber security and data protection, it’s important to note that the Data Protection Act 2018—often referred to as UK GDPR—mandates that personal data must be secured by ‘default and design’. This implies that cyber security measures must be integrated into your data protection processes, potentially increasing the number of policies and procedures necessary to ensure safety and compliance with legal requirements.

Let’s explore what you might need for cyber security. First and foremost, you require a comprehensive policy approved at the board level or by company ownership if there isn’t a formal structure in place. This policy serves to demonstrate the company’s commitment to cyber security and establishes a foundation for what we term an Information Security Management System (ISMS). While you don’t need to adopt formal terminology, it essentially outlines the framework detailing necessary policies, assigns responsibility for keeping them current and relevant, and ensures dissemination among all staff. Essential policies may include but aren’t limited to:

– Top-level policy issued by the board

– Starters and Leavers Policy

– Access Control Policy

– Magnetic Media Policy

– Mobile Working Policy

– Password Policy

– Email Policy

– Acceptable Use Policy

As mentioned earlier, data protection closely aligns with cyber security. Below is a potential list of policies you may need to comply with legal standards. Again, this list is not exhaustive and may seem excessive for some businesses but provides insight into what may be required:

– Data Protection – Overarching Policy

– Data Protection Training

– Data Protection – Consent

– Consent Withdrawal

– Subject Access Request

– Data Protection Complaints

– Retention of Records

– Data Breach Notification (note there is an electronic version of this on the ICO website)

– Data Protection Impact Assessment Procedure

– Security & Control of data protection documentation

– Policy Management Review Procedure

– Internal Data Protection Breach Register

– Retention & Disposal of Records Register

– Data Protection Officer (DPO) Responsibilities

– Required records to be maintained

Most policies are readily available online; however, knowing what you truly need versus what you can do without can be challenging. Too often people download templates only to modify them superficially while hoping for satisfactory results.

Over time, our approach has evolved alongside legislative changes both here and in Europe as well as shifts in working practices. We’ve dedicated countless hours researching solutions tailored to meet requirements that adapt into systems suitable for all business types—not only affordable but also compliant with standards like Cyber Essentials if needed. Flexibility has become crucial due to new working paradigms; traditional security systems where everyone operates within secure boundaries protected by firewalls are outdated. Today’s protective systems must function seamlessly whether you’re at home, on the move, or in the office, and your policies must reflect that.

When we first engage with prospective clients, we offer a free trial to assess their needs, we frequently discover they lack clarity on what data they hold or its location. They might have a vague understanding—perhaps it’s stored on cloud servers, with laptops or desktops accessing data on the cloud. However, once we implement our software for discovery purposes, we often find numerous copies stored on laptops/desktops alongside cloud servers. How does this happen? Over time—and particularly with many adopting hybrid work models—employees log onto cloud services remotely using unstable internet connections; they download necessary files to work offline then neglect to delete them after re-uploading. Or they may share files via email without realising it leaves sensitive information attached to their email server.

Audit trails present another issue: If the ICO investigates, having clear records indicating who created/copied/deleted/forwarded data is crucial. Additionally, individuals are entitled to submit Data Subject Access Requests (DSARs), compelling you to disclose any held data regarding them—a legal obligation you cannot refuse. I know of a financial firm that took almost three weeks just to fulfil a DSAR request which diverted an employee from billing tasks during that time.

Our solution addresses today’s requirements effectively—it even includes an encryption system—all under one monthly fee. You can trial it at no cost; we’d be surprised if after seeing its capabilities along with our incredibly low managed service rates you didn’t want to keep it!

Work v Life Balance

A little change this week from my usual promotion of cyber security issues, prompted, at least in part, by the changes affecting SMEs by the budget, and also because I do tend to interact a lot with HR and recruitment company’s largely because of the amounts of personal identifiable information that they hold and their concern about those budget changes.

There are going to be different views about those changes, driven by lots of things ranging from political views to how they will impact individuals and I’m not going to pore oil on those differing views. That’s not the focus of this piece.

My first 30 years employment, from age 15 to age 40, was spent in the public sector, 25 years in the Army and 5 years in the NHS. I then left and spent 2 years in a UK company before moving on to a major US corporation, followed by 2 more major US corporations. By that time I’d had enough and wanted to run my own business my own way. A challenge which never stops but has its rewards. The contrast between the attitudes in the UK and in the US are stark, even given that the UK has attitudes to employment and laws, which are much more onerous than they are in Western Europe.

One of the first things that hits you in a US corporation is the expectation that you will work as long as they want you to, go where they want you to, and do what they want you to, all within the same salary. Some managers are harsher than others of course, but the stock price will win every argument, and I well remember the Chairman of my first company openly admitting that they used staffing levels to control the stock price. That meant that they would cut staff to keep the markets happy, without a second thought and absolutely hated that they couldn’t do that in Europe because of the employment laws. The US employees had no such protection.

There were many examples of how employees were often impacted by the attitude of the senior management across the pond. One such sticks out when I was running a team in the middle east. Our weekends were Friday and Saturday, we worked Sundays. One Friday the team had hired a boat, privately between us, and we were anchored offshore with the team diving off the boat into some very warm waters and having a good time. My mobile phone rang, and I was told that I needed to get online and produce some stats that were needed immediately. All the European teams were doing this. I told him we couldn’t get to the office and even sent him some photos that I took with my phone to show him where we were and reminded him it was our weekend.

Needless to say, I was reprimanded for this and told that I wasn’t being loyal. I was a manager who insisted on looking after my guys (and gals) but that wasn’t universally appreciated by those above.

So, what is senior management often missing when they treat staff poorly, when they are demanding and even sometimes, demeaning. Managers are looking for productivity, of course they are, without that the company goes under, but is a happy staff more productive than an unhappy one. If we are paying a low wage and making staff claim UC to make it up, does that demean the staff member as well as putting the burden on the taxpayer. Going back to my time in the Army in the late seventies, I remember being a Lance Corporal and qualifying for supplementary benefit, which I found demeaning. Mind you it got worse, I was promoted to Corporal and no longer qualified and lost about a tenner a week – a lot of dosh back then.

Let’s now look at what a good work-life balance is going to give us. Is it essential for maintaining overall well-being and improving not just the personal aspects of life, but also does it improve those professional aspects that increase productivity? I’m not declaring myself one way or another and would prefer others to come to their own conclusions.

a. Improved Mental Health

Reduces stress and anxiety.
Helps prevent burnout by creating time for rest and self-care.
Encourages a clearer mind, enhancing focus and decision-making.

b. Enhanced Physical Health

Allows for regular exercise and proper sleep.
Reduces the risk of stress-related illnesses, such as heart disease and high blood pressure, reducing time off for illness.

c. Increased Productivity

Balancing personal and professional priorities leads to greater focus and efficiency at work.
Employees who are well-rested and satisfied with their personal lives tend to be more motivated.

d. Stronger Relationships

Allocating time for family and friends strengthens personal bonds and social support networks.
Improves communication and connection with families.

e. Greater Job Satisfaction

Employees who maintain balance are more likely to enjoy their work, feel fulfilled, and remain engaged.
Reduces turnover rates by creating a supportive work environment.

f. Personal Growth and Fulfilment

Provides opportunities to pursue hobbies, interests, and personal goals.
Encourages learning and development outside of work, leading to a more well-rounded life.

g. Better Work Culture

Promotes a positive workplace where employees feel respected and valued.
Encourages teamwork and collaboration by reducing tension and conflict.

h. Increased Creativity and Innovation

Taking breaks and engaging in diverse activities fosters creative thinking and problem-solving.

We can argue that a poor work-life balance on the other hand, can have wide-ranging effects, impacting mental, physical, and social well-being as well as professional performance. Here’s a breakdown:

a. Physical Health Issues

Increased stress levels: Chronic stress can lead to headaches, fatigue, muscle tension, and weakened immunity.
Higher risk of chronic illnesses: Conditions such as heart disease, obesity, and diabetes can result from prolonged stress and lack of physical activity.
Sleep problems: Difficulty in disconnecting from work may lead to insomnia or poor-quality sleep.

b. Mental Health Challenges

Burnout: Persistent overwork can result in emotional exhaustion, reduced productivity, and detachment from work.
Anxiety and depression: Long hours and the pressure to perform can exacerbate mental health issues.
Reduced focus and creativity: Mental fatigue from a poor balance impairs cognitive functioning and decision-making.

c. Professional Consequences

Decreased productivity: Overworking may initially boost

So, what do I personally, conclude from this and why do I care? Well firstly I’m a human being and so should care and secondly, I’m a business owner and want my staff focused, productive, great for clients to interact with, responsive and who look forward to coming in every day, or at least most days, every day is probably a stretch. I will also readily admit that some of these points aren’t my own, I have cribbed from some research I did into this area.

What is your take? I would expect differing views and that’s OK, we all face issues every day in business, some we have in common, and some are unique to a particular business. I’m not looking for an argument, just some mature reflection.

HOW DO HACKERS HACK?

You’ll have to forgive me for a somewhat provocative title and allow me some poetic licence, because in fact, different hacking groups do things differently, although they have much in common. Personally, I don’t like the term hacker, much preferring cybercriminal, because anyone who accesses a system without the owners’ permission, is by definition, a criminal. But I suppose hacker is less of a mouthful.

So, what is hacking? Hacking involves exploiting vulnerabilities in systems, software, or networks to gain unauthorised access or manipulate data using a variety of techniques and methods, which tend to combine technical tactics and social engineering.

One of the first things a hacker, or criminal group, will do, is to profile your organisation and your people. Favourite open sources of information include:

Social media: Information about hobbies, job roles, family, and schedules shared on platforms like LinkedIn, Facebook, and Instagram. Do you have a social media policy in your company? Do you lay down what an employee can and cannot say about your company on their personal social media pages? Do you have a designated person in the company who handles your company’s profile on social media?

Company Website: You’ll want to give prospective clients contact information of course, but you should not give out individual email addresses and limit profiles published. I do give my personal profile on my website but don’t give information about any other position, leaving it to a generic phone number and email address.

Professional Profiles: LinkedIn is a favourite for targeting businesses, as it provides details about an individual’s role, connections, and organisational structure.

Personal Websites or Blogs: These may reveal contact details, interests, or sensitive information inadvertently. The same issues that appertain to social media apply here.

Data Brokers: Cybercriminals can purchase detailed dossiers on individuals from data aggregator sites.

Another favourite is phishing and pretexting.

Phishing Emails: We all know, or at least I hope we know, what phishing is. Attackers send emails designed to extract more information, such as login credentials, by posing as a trusted entity. In this context, it could be as simple as the attacker wanting to verify information by perhaps sending an email to a discovered address but wanting to confirm that individuals position in the company. That just requires a response showing a signature block, so the phishing email might seem very innocuous.

Fake Surveys or Job Offers: These can be used to obtain detailed personal or professional data.

There are a variety of reconnaissance tools used by attackers, including open-source intelligence (OSINT) tools, WHOIS lookups and scanning misconfigured systems using commercially available tools such as Nmap and Nessus, which identify open ports, services and weak configurations. This is why it’s essential to regularly scan your network for these weaknesses. Ports can be opened for a particular reason and never closed again. It’s a common fault.

Here at H2 we scan the dark web daily looking for leaked credentials, particularly email credentials. When we on board a new client we nearly always get hits with sometimes up to 20+ compromised email addresses including passwords. You might ask why they’d be on the dark web – simple, they are often up for sale on dark web marketplaces.

In terms of cybercrime, who’s heard of psychological profiling? Cybercriminals analyse:

Behavioural Patterns: Regularity in actions, such as times a person is online, financial habits, or common purchases.

Weaknesses and Triggers: Examples include a recent job loss, major life changes, or emotional vulnerabilities, which they exploit through spear-phishing or scams.

I’ve often argued on these pages, that your employees are both your first line of defence and your greatest weakness, and that a good cyber awareness programme is worth its weight in gold. Cybercriminals often focus on employees in specific departments (like HR, finance, or IT).

LinkedIn and Organization Charts: Identify individuals with access to sensitive data.

Impersonation: Pretending to be a senior executive to trick lower-level employees (e.g., through Business Email Compromise attacks – I’ve written about the CEO scam a lot).

Technical Probing: Use of phishing or malware to breach a target’s employer.

In conclusion, what I’ve tried to do here is give you a flavour of what you may be up against, and I hope, I’ve shown you that for all the reasons shown above technology comes last after people and process. All the tech in the world won’t prevent issues arising from the above and is just one part of an integrated defence in depth required to prevent disaster.

BRING YOUR OWN DEVICE (BYOD)

This is a subject that, at one time, was pretty much confined to the larger enterprise organisations but largely because of the pandemic, it is gaining popularity within SMEs and is now getting a lot of attention from the National Cyber Security Centre.

So, what is it? Well the idea was to allow employees to use their own devices for work purposes. The thinking was that in this day and age, many employees have developed preferences for what they use. So whilst many will stick to Microsoft, others may prefer an Android or Apple tablet, whilst others still may prefer a MacBook or Chromebook. There’s a wide choice these days.

But what do we mean by work purposes? It can mean anything from accessing your emails, which most of us do on our phones, to accessing critical services and applications. And this makes it a potentially complex issue.

The pandemic brought with it many issues that needed swift resolutions and now, it’s not uncommon to visit companies that have allowed their staff to continue to work from home often because the cost savings in office accommodation are very beneficial, and some have allowed staff to use their own preferred devices when working, including connecting to the company network and/or cloud services, remotely.

For just about all SMEs, this has started from a position of necessity. But like many such events, if it seems to be working, it rapidly becomes the norm and in creeps a complacency that it’s actually all OK.

BYOD solutions need to be planned and thought through. And pretty much the same as most things, particularly risk based assessments, what you need to do really depends on your organisation. You need to ask some questions:

Is there anything that needs to be done from the office that cannot be done by home workers?
Are there functions which employees need to do, that requires the company to have visibility and management of, and is there anything that doesn’t?
What do my employees need to do?
How can we balance what employees do that also involves your need to protect data and their privacy (DPA2018)? They are after all, using their own device.

Above all you need a well thought through and comprehensive strategy, which, while offering flexibility and potential cost savings, recognises and deals with several security implications that organisations must address to ensure sensitive data and systems remain secure. Below are the key concerns:

a. Data Security

Data Leakage: Employees’ personal devices may lack adequate protections, increasing the risk of unauthorised access or accidental data leaks.
Loss or Theft of Devices: Personal devices may not have encryption enabled, making sensitive corporate data vulnerable if the device is lost or stolen.
Uncontrolled Sharing: Employees might unknowingly share corporate data via apps or cloud services outside the organisation’s control.

b. Malware and Cyber Threats

Insecure Devices: Personal devices might not have up-to-date antivirus software, firewalls, or operating system patches, making them susceptible to malware or ransomware attacks.
Unverified Applications: Employees may install unauthorised or malicious applications that could compromise corporate networks.

c. Network Security

Untrusted Connections: BYOD devices may connect to public Wi-Fi networks, exposing them to man-in-the-middle (MITM) attacks that could jeopardise corporate data.
Device Spoofing: An attacker could mimic a BYOD device to gain unauthorised access to the network.

d. Compliance Risks

Regulatory Violations: BYOD policies may lead to data handling practices that violate regulations like GDPR or PCI DSS if personal devices aren’t properly managed.
Audit Challenges: Tracking and demonstrating compliance can become difficult with non-standardised, user-managed devices.

e. Access Control

Weak Authentication: Personal devices may not support strong authentication mechanisms, increasing the risk of unauthorised access.
Lack of Segmentation: Employees’ devices may access both corporate and personal systems, creating potential crossover risks.

f. Insufficient Visibility

Limited Monitoring: Organisations may lack full visibility into personal devices, making it harder to detect breaches or policy violations.
Shadow IT: Employees might use unauthorised apps or services that bypass official security controls.

g. Employee Turnover

Data Retention: When an employee leaves, ensuring the removal of corporate data from their personal devices can be challenging.
Device Ownership: Legal and practical issues might arise when attempting to enforce data wiping on personal devices.

Mitigation Strategies

To address these risks, organisations adopting BYOD should:

Implement Mobile Device Management (MDM) or Endpoint Detection and Response (EDR) solutions.
Enforce strong authentication, such as multi-factor authentication (MFA).
Require device encryption and ensure compliance through regular checks.
Use some form of file separation to ensure separate corporate data from personal data.
Deploy a zero-trust security model with conditional access controls.
Establish clear policies and training to educate employees on BYOD security best practices.

By proactively addressing these risks, organisations can leverage the benefits of BYOD while maintaining robust security.

Ransomware and the risk to SMEs

There’s a lot of FUD (fear, uncertainty and doubt), going around about Ransomware, and it has to be said that a lot of it comes from cyber security companies. But amongst the rocks there are some very real diamonds that need the publicity. There is a very real difference between genuine information and propaganda. I hope what I do is spread information.

There is a prevailing feeling amongst small and medium-sized enterprises (SMEs) that they are not a desirable target for Ransomware and it’s therefore not a problem for them. However, that’s simply not true and they are increasingly vulnerable to ransomware attacks, with recent trends showing a notable rise in these incidents among smaller businesses. Several factors influence the likelihood of SMEs being targeted:

Widespread Targeting: SMEs are often viewed as “soft targets” because they may lack the advanced cybersecurity defences of larger corporations. Attackers assume that smaller businesses may have fewer resources dedicated to security, making them easier to compromise.
Increasing Ransomware Attacks Overall: Ransomware attacks globally have been on the rise, and attackers have shifted their focus to include not only large enterprises but also smaller organisations across various sectors. This is often due to the lower cost of launching ransomware campaigns, allowing attackers to spread wide nets with mass phishing campaigns and automated attacks.
Financial and Operational Impact: Many SMEs are attractive to attackers because the disruption from ransomware can be financially devastating for them. SMEs may feel greater pressure to pay the ransom to restore operations quickly, fearing the loss of business or reputation if the downtime persists.
Underinvestment in Cybersecurity: SMEs often underinvest in cybersecurity due to budget constraints, lack of expertise, or other business priorities. This underinvestment can lead to outdated software, limited employee training on cybersecurity best practices, and weaker defences that attackers can exploit.

Likelihood and Statistics

High Likelihood: Studies show that more than half of SMEs have experienced a cyberattack in the last year, with ransomware being one of the most common types of attack.
Small Business Victimisation: According to a 2022 survey by the Cyber Readiness Institute, nearly 60% of small businesses were targeted by cyberattacks, and a significant portion of these involved ransomware.
Increasing Cost: For many SMEs, the average cost of a ransomware attack, including downtime, lost revenue, and recovery expenses, can be as high as £50 to a £100K, making the financial impact severe and sometimes unmanageable without external assistance.

Key Risk Factors for SMEs

Lack of Security Awareness and Training: Employees at SMEs may be less well trained on cybersecurity threats, increasing the risk of phishing and social engineering attacks that lead to ransomware.
Lack of Backup and Recovery Plans: SMEs may not have effective data backup or disaster recovery strategies, making them more susceptible to extended downtime or paying the ransom.
Weak Network and Endpoint Security: Limited resources often mean that SMEs may not have enterprise-grade firewalls, intrusion detection, or antivirus solutions, leaving systems exposed to exploitation. They also struggle with the distributed work practice (office, home etc) that has happened since COVID.
Encryption: Data is often unencrypted on end point machines.

Reducing the Risk

While the risk is high, SMEs can take measures to reduce the likelihood and impact of a ransomware attack:

Implementing Regular Backups: Ensuring data backups are frequent, secured, and tested for restoration can significantly reduce the impact of an attack.
Employee Training: Conducting regular training to recognize phishing and social engineering can help employees avoid common attack vectors.
Monitoring: No or inadequate monitoring of their data and systems, including home and other remote workers.
Endpoint and Network Security: Investing in antivirus software, firewalls, and network monitoring can improve defences.
Cyber Insurance: Purchasing cyber insurance can help mitigate financial losses associated with an attack.
Data encryption.

In summary, while SMEs face a high likelihood of ransomware attacks, increasing awareness, preparation, and proactive defence measures can substantially reduce both the risk and the impact of an attack.

What is the impact of a Ransomware Attack?

Ransomware can have devastating effects on small and medium-sized enterprises (SMEs). Here are some of the key impacts:

Financial Losses

Ransom Payment: If SMEs decide to pay the ransom (which is not generally recommended), this can result in significant, sometimes crippling, costs.
Operational Downtime: Even if no ransom is paid, businesses often experience significant downtime as they attempt to recover systems, which can halt revenue generation and lead to lost sales.
Recovery Costs: In addition to the ransom, SMEs incur expenses related to data recovery, IT support, and forensic investigation. Often, additional security solutions are needed to prevent future attacks.

Loss of Data

Data Encryption or Destruction: Ransomware can lead to the permanent loss of critical data if files are corrupted or remain encrypted after an attack.
Loss of Sensitive Information: SMEs may lose access to sensitive customer or business data, leading to gaps in operational records or strategic plans.

Reputational Damage

Loss of Customer Trust: Ransomware attacks, especially if customer data is exposed or operations are disrupted, can damage customer confidence. Many SMEs rely on personal relationships, and a ransomware incident can harm these relationships.
Brand Damage: Businesses often struggle to rebuild trust, and reputation damage may deter new clients and weaken partnerships with vendors or other business partners.

Legal and Regulatory Consequences

Compliance Violations: If SMEs operate in regulated sectors (like finance, healthcare, or legal services), a data breach can lead to violations of regulations like GDPR, resulting in fines and other penalties.
Legal Liabilities: Affected customers or vendors may pursue legal action if sensitive data is compromised, adding further financial strain.

Operational Disruptions

Halting of Services: For many SMEs, especially those without a strong IT infrastructure, ransomware can paralyse day-to-day operations.
Long Recovery Times: SMEs often lack the same level of IT resources as larger enterprises, so restoring full operational capacity after an attack can take weeks or months.

Employee Productivity and Morale

Reduced Productivity: During and after a ransomware attack, employees may be unable to work if they lack access to necessary files, email, or software.
Psychological Impact: The stress and uncertainty from a cyberattack can lead to anxiety or frustration among employees, potentially impacting morale and retention.

Increased Insurance Costs

Higher Cyber Insurance Premiums: Cyber insurance costs tend to increase significantly for companies that have experienced ransomware attacks. Additionally, insurers may demand proof of enhanced security measures to continue providing coverage.

Pressure to Strengthen Cybersecurity Measures

Increased Security Costs: Post-incident, SMEs often must invest in more robust cybersecurity infrastructure, including advanced threat detection, backup solutions, and employee training.
Ongoing Monitoring Needs: Ransomware may prompt SMEs to adopt more rigorous monitoring and endpoint protection tools, leading to continuous IT spending.

Ransomware attacks can be particularly harmful to SMEs because they often have fewer resources for cybersecurity, and a single attack can have a prolonged impact. Many SMEs lack a full-time IT staff or robust data backup protocols, which can compound the impact. Consequently, proactive measures, such as employee training, regular data backups, and up-to-date cybersecurity defences, are critical to reducing the likelihood and impact of ransomware attacks on SMEs.

What Do SME Owners and Directors Want From Cyber Security?

I wrote a post earlier this week exploring what SME owners and directors really care about when it comes to cyber security! Do they really care about the how the latest technological solutions work? Do they really care about the scare stories, or at least, do they really think that they apply to them. Oh, they might have a sneaky suspicion that it could be a problem but is it on their mind enough for them to do something about it.

The argument was made that this is especially true in an economic downturn when they are focused on costs, even more than they normally are. They want robust cyber security solutions that don’t cost an arm and a leg. And what they don’t want is jargon and tech speak that they feel is aimed at bamboozling them with science in order to convince them they should buy something that they don’t actually need.

We are believers that what is needed is simplicity. SMEs are looking for user-friendly security measures that don’t require a PhD in Cyber Science. They don’t want jargon or even industry metrics. Remember the KISS principle – Keep It Simple Stupid.

Of course they are going to have a focus, and you need to understand what is important to them and what isn’t. That will depend on the nature of their business to a great extent. Whilst there are commonalities regardless of the vertical they work in, there will always be differences, some big, some more subtle, that will impact any cyber security solutioning.

Nowadays many SMEs are increasingly aware of cybersecurity risks, but a significant number still underestimate the importance of cybersecurity risk management. SMEs often face unique challenges in this area due to limited resources, competing priorities, and often a lack of expertise not just in their organisation but also in the IT support company’s they use. Here are some insights into the current landscape:

Growing Awareness: SMEs have started to recognise that they are just as likely to be targeted by cyber threats as larger companies, partly due to high-profile ransomware attacks and data breaches affecting businesses of all sizes. As a result, awareness is rising, especially as more businesses transition to digital platforms and remote work, which increases exposure to cyber risks.

Resource Constraints: For many SMEs, the cost of robust cybersecurity measures can be prohibitive. They often lack dedicated IT and cybersecurity teams, which makes it challenging to implement and maintain comprehensive security protocols. Cybersecurity solutions can be expensive, so SMEs may prioritise short-term operational needs over what they might perceive as longer-term security investments.

Risk Perception and Underestimation: Some SMEs mistakenly believe they are too small to be targeted by cybercriminals, assuming that attackers primarily focus on large corporations. However, this “security by obscurity” mindset has been proven false, as attackers often view SMEs as easier targets due to their weaker defences.

Impact of a Breach on SMEs: Unlike larger companies, SMEs are less likely to recover from a significant cyber incident. A data breach or ransomware attack can be devastating, leading to financial losses, reputational damage, and even closure. Despite this, many SMEs may not fully understand the potential scale of these consequences.

Compliance and Regulatory Pressure: With increasing data protection regulations (e.g., GDPR, PCI), SMEs are under more pressure to adopt better cybersecurity practices to remain compliant. This has led to greater awareness among some SMEs, especially those handling sensitive data like healthcare, finance, or customer and payment information.

Cybersecurity Awareness Training and Culture: Even when SMEs implement some cybersecurity measures, they may lack the necessary employee training and risk management practices that foster a security-focused culture. Human error remains a leading cause of data breaches, so SMEs need to prioritize employee awareness and training.

In summary, while awareness of cybersecurity risk management is growing among SMEs, gaps remain, particularly around adequate investment, robust risk perception, and ongoing management of cybersecurity threats. Cybersecurity can seem overwhelming for small businesses, but as the digital landscape continues to evolve, understanding and addressing these risks is becoming essential for SME survival and growth.

Cybersecurity Awareness Month

Did you know that October is Cybersecurity Awareness Month? No – not terribly surprised after the poll we put out asking how important this subject was. The response was truly frightening. Cybersecurity Awareness month has participants in many countries and sponsored by many governments and tries to push awareness of the importance of this subject, across all industries.

Why do we think it’s so important? Why would an SME bother with it? Well, in short, it’s probably the single most cost effective and quickest win you can make. It really doesn’t have to cost a fortune, it’s not techie if done right, is educational and it beefs up your security by ensuring your staff can spot a scam when they see one, can recognise social engineering and how to counter it, won’t open a rogue email and it generally keeps the subject in the forefront of minds.

OK, but what’s the threat? Do hackers/scammers prey on SMEs? Is there sufficient financial reward there for them? Yes, yes and again yes. The UK GDP is made up of north of 90% from SMEs. Just think about that – 90% of the countries wealth is generated by SMEs, so a huge financial target. The big companies spend a fortune on cyber security protections. Most spend up to 15% of their annual IT budget on security and when you think that the IT budget often runs into millions, that’s big bucks. SMEs can’t afford that and that makes them a much easier target.

I wrote a blog recently about the findings of the 2024 cyber security breaches survey. The report tells us that among businesses, there has been a shift in the proportion saying cyber security is a “fairly” high priority (e.g. from 35% of businesses last year, to 40% this year). The proportions of businesses saying it is a very high priority is consistent with last year (36% last year and 35% this year). In 2023, as evidenced by the qualitative interviews, it was felt that cyber security had moved down the agenda among the businesses where it was already seen as a more marginal priority, and among businesses that typically have the fewest resources to deploy. The qualitative findings this year point towards an increased awareness of the risks that are faced when not prioritising cyber security, which could explain the increase in businesses this year rating it as a high priority.

It is more common for larger businesses to say that cyber security is a high priority (93% of medium businesses and 98% of large businesses, vs. 75% overall). The same is true for high-income charities (93% of those with income of £500,000 or more, vs. 63% overall). This continues the pattern seen since 2020, where larger organisations tend to treat cyber security more seriously, and consequently allocate more resources to it.

Businesses in the following sectors tend to treat cyber security as a higher priority than others:

information and communications (65% a “very” high priority)
finance and insurance (61% say it is a “very” high priority)
health, social care and social work (62% a “very” high priority).

These percentages are still very low and amongst this, if we drill down, we will find that the prevailing answer amongst SMEs remains to reach for technology for protection. Technology will help, but it isn’t the full answer. When faced with constraints such as a tight budget it’s essential that a business prioritises its spend, making sure that it is targeting what really needs protection, and making sure that the protections in place are actually doing what you think they’re doing. That is essentially what we refer to in regard to risk management. It’s a business issue, not an IT issue.

In the 2024 survey, half of businesses and around a third of charities report having experienced some kind of cyber security breach or attack in the last 12 months. As in previous years, larger businesses and charities are more likely to identify breaches or attacks than smaller ones. This latter point is worth mentioning because it’s generally only the larger businesses that have some kind of monitoring in place to identify an attack and many smaller businesses only find out when they start losing money.

Of course, good old COVID has had its effect, and I know we still bang on about it but that’s because its effect is long term. It has changed our working practices in many respects although there is more of a move towards a return to the workplace currently, but some businesses have embraced the hybrid working practice and look unlikely to change. My own client base has only seen one client move to 100% remote working, but they are all working some form of hybrid working pattern.

Many corporates have had some form of hybrid working for a long time, pre-COVID. When I was at HP and before that in Symantec, we worked the hot desk system with people working remotely a couple of days a week. It’s not new at that level but it is at the SME level, and we need more sophisticated ways of protecting ourselves at a price we can afford. And that’s been the focus for us, and we are now confident that we have solutions that fit an SMEs requirement, at a price they can afford.

Cyber Resilience – what it means and just as importantly, what it doesn’t mean

Cyber resilience can mean different things to different people, depending upon their priorities, their perception of cyber security and the business they are in. This means that there are a lot of misconceptions about what it means, and I’m sure I’ll get some disagreeing with what I write here. And that’s OK, because it really can depend on your situation as I’ve said above. Essentially though it refers to an organisation’s ability to prepare for, respond to, and recover from cyber incidents, ensuring that critical operations continue despite attacks, failures, or unexpected events. Unlike cybersecurity, which focuses mainly on preventing attacks, cyber resilience combines prevention with the capability to withstand and adapt to adverse conditions, even if breaches or disruptions occur.

It encompasses five main aspects:

Identify: Understanding what an attack or scam might look like.
Protection: Implementing strong security measures to prevent cyberattacks and minimise vulnerabilities.
Detection: Quickly identifying and recognising cyber threats or breaches when they occur.
Response: Reacting effectively to contain and mitigate the impact of a cyber incident.
Recovery: Restoring systems and data to normal functioning after an incident, while learning from the event to improve future preparedness.

A cyber-resilient organisation is not only prepared to handle potential attacks but is also structured to adapt, recover, and continue functioning in the face of disruptions. This approach ensures minimal downtime, data loss, and damage to reputation.

Now let’s look at some misconceptions around cyber resilience.

Complete Immunity from Cyber Attacks: Cyber resilience does not mean that an organisation will be entirely immune to cyber threats. Rather, it focuses on minimising the impact and ensuring continuity in the face of such events. No system can be entirely hack proof.
Just Having Strong Cybersecurity: While cybersecurity is a crucial part of cyber resilience, the latter encompasses more than just security measures like firewalls or anti-virus software. It also involves having an effective strategy encompassing sound policies and processes, incident response plans, business continuity plans, and recovery strategies. A purely preventive approach, without considering recovery, does not constitute true cyber resilience.
A One-Time Effort: Cyber resilience is not a one-time project or a static state. It requires continuous assessment, updating of policies, and adaptation to new threats. It’s an iterative process of improvement and adjustment to maintain resilience against evolving threats.
Quick and Easy Recovery: While resilience involves the ability to recover, it does not guarantee that recovery will be quick or without challenges. It means that recovery is possible, but it might still take time and effort to restore normal operations depending on the severity of the incident.
An IT Department’s Responsibility Alone: Cyber resilience is not just about technical solutions managed by the IT department. It involves a holistic approach, including organisational culture, employee training, risk management strategies, and coordination across different business functions. It’s an organisational-wide commitment. In a nutshell, it’s a business issue, not an IT issue.

Understanding what cyber resilience is not helps organisations better align their strategies towards truly being prepared for and able to recover from cyber incidents.

Don’t get bogged down in this though, don’t think it’s way too difficult and not really something that an SME for instance, can afford to do. It’s a matter of scale and there are some things that a corporate business will need to do, that an SME doesn’t need to do, or perhaps can scale down.

Help is at hand and if you want to talk this over then do please give me a call.

Cyber Awareness Training