Cyber Awareness Training

Cyber Awareness Training Data Breaches and their consequences Ransomware, Phishing and other Malware Security Tools

DATA BREACHES

Data breaches continue to make headlines, with corporate incidents grabbing the most attention. A prime example is the Equifax breach, where a server exploit compromised credit reports of over 140 million individuals. The breach took months to discover and resolve, ultimately resulting in Equifax settling with the FTC for a $575 million fine.

Not so long ago the Electoral Commission revealed it fell victim to a “complex cyber-attack,” potentially impacting millions of voters. Unspecified “hostile actors” accessed electoral registers from August 2021 and infiltrated emails and control systems. Alarmingly, this attack went undetected until the following October, leaving sensitive data exposed to cyber criminals for over a year. It’s astonishing that adequate protections were not in place to ensure timely detection and management of the breach.

According to the UK’s NCSC, half of businesses and about a third of charities have reported experiencing some form of cyber security breach or attack. This figure rises to approximately 70% for medium-sized businesses and 74% for large enterprises. Phishing remains a favoured attack method due to its relative simplicity, with AI now generating new variations of old scams.

Most data breaches occur unintentionally, often due to employees making mistakes because they lack awareness of proper procedures. Who bears responsibility? Is it the employee or the employer for not providing sufficient cyber awareness training? That’s open to interpretation.

Here are some notable examples from the Information Commissioner’s Office (ICO):

• A data controller inadvertently sent paperwork to a child’s birth parents without redacting the adoptive parents’ names and addresses. Upon discovering the breach, the data controller failed to inform the adoptive parents.

• A debt insolvency agent mistakenly emailed a vulnerable new client’s file to a colleague in another department. The colleague quickly deleted the email and alerted the sender about the mistake.

• An employee misplaced his briefcase containing work on an unencrypted laptop and unredacted paper files related to a sensitive court case, which included information on criminal convictions and health details. Initially, he believed both the laptop was encrypted and that the paper files were redacted. After informing his manager, who reported it to IT, the laptop was remotely wiped without initially notifying the ICO. The data controller later reported it after realising the laptop was unencrypted.

• A courier mistakenly delivered medication intended for one patient (Patient A) to another (Patient B). After Patient A complained, the pharmacist recognised the error and arranged for the unopened medication to be picked up and delivered correctly.

• A law firm employee fell victim to a phishing attack after clicking on a link in an email that led them to enter login credentials on what they thought was a legitimate site. The IT department later discovered that their email account had been compromised, leading to significant unauthorised payments being made by clients due to spoofed communications.

These cases are just a small sampling.

Now let’s discuss ransomware. There’s a common misconception among SME management that ransomware primarily targets larger companies since SMEs seem too small to be lucrative targets for cybercriminals. However, when SMEs do get attacked, ransom demands can be surprisingly low—often between £500 and £1,000—leading many SMEs to pay up without hesitation. This poses significant risks because often their data has already been stolen, and sometimes criminals fail to restore access afterward, leaving SMEs financially strained and unable to operate.

Preventing such attacks in the first place is far more advantageous. Here are several strategies you might consider implementing:

• One of the most impactful steps an SME can take is providing Cyber Awareness Training for employees. Research shows that 90% of data breaches stem from human error; it’s unlikely an employee will intentionally harm your business. However, without proper training, they may unknowingly engage in risky behaviour. Cyber security awareness training is crucial; staff need knowledge about potential threats. Cyber security is not just an IT issue; it’s a business-wide responsibility that requires everyone’s involvement. Effective strategies tend to follow the KISS principle—Keep It Simple Stupid.

• Another cost-effective measure is developing robust policies and procedures related to cyber security that are communicated throughout your organisation and regularly updated to remain relevant. Providing employees with clear guidelines on how to respond if they suspect suspicious activity supports them rather than penalising them for mistakes. Many SMEs lack adequate policies or settle for generic templates found online that seldom meet their needs.

• Review your backup strategy as well. Even if using cloud-based services, your data may not be adequately secured, despite providers’ claims. A better approach would be implementing a backup strategy where your data is backed up nightly onto magnetic media storage that’s stored securely offline. In case of an attack that locks your data, you could wipe affected workstations and restore information from backups without significant downtime.

• EMail remains one of the most common attack vectors. Numerous products claim to block malicious emails effectively; many excel at this task. For SMEs, cost is often a deciding factor when selecting these products. Unfortunately, some still opt for low-cost or free anti-malware solutions. Understanding that quality correlates with price is essential; if it’s free, you’re likely facing issues down the line.

Turning to how your systems might be monitored for security issues, we have been exploring options in the market for an affordable security managed service tailored specifically for SMEs and we believe we have found it! Our solution emphasises simplicity while utilising enterprise-grade technology to streamline daily operations effectively. Our unified platform seamlessly detects, prevents, and responds holistically to cyber threats without hassle or excessive costs.

We are offering a free trial that includes:

a. Email security.

b. Cloud data protection.

c. Automated cyber awareness training.

d. External risk assessment.

e. Endpoint security.

f. Secure browsing practices.

g. Phishing simulations.

h. Plus, as an added bonus: cyber insurance priced based on your risk score within our system—the lower your risk score, the more affordable your insurance!

This service is specifically designed for businesses with 1-250 IT users; while most SMEs typically fall between 10-15 users, we’re flexible! It’s a managed service approach with proactive risk mitigation tailored according to your preferences—all at just £12 per user per month!

We’re also introducing an intuitive cloud software solution focused on data protection that empowers organisations by securing their information while giving IT professionals an easy way to track sensitive data and manage risks effectively. The system routinely audits company data to locate sensitive information and applies necessary updates and encryption automatically.

This method ensures organisations always know what sensitive data they possess while keeping it secure through automatic encryption measures, making data security straightforward so businesses can protect private information as circumstances evolve over time, without needing complex software requiring specialised expertise.

Here are 2 very short videos explaining our solutions.

Why Your Business Needs Protective Monitoring – https://bit.ly/3Qy4u0x

Mastering GDPR Compliance: Safeguarding Your Company – https://bit.ly/4berDPa

Cyber Awareness Training General Security Issues

Cyber Awareness Training

Investing in cyber awareness training is crucial, especially for SMEs who tend not to have the expertise and resource at their fingertips, to protect themselves against cyber-attacks and scams. Cyber threats are constantly evolving, and smaller businesses are often prime targets for attackers due to perceived weaker security defences. Your staff are key, they are the first line of defence, and potentially, your biggest weakness.  This means they must know what the threats are and what simple steps they can take to protect the business. 

Here are some key reasons why an SME should be seriously considering a cyber awareness training programme for their staff:

a. Protect Against Cyber Threats

SMEs face risks from phishing, ransomware, and social engineering attacks. Training helps employees recognise and respond to these threats before they cause harm.

b. Reduce Human Error

Most cyber incidents result from human mistakes and are not malicious in nature.  Cyber awareness training can significantly reduce mistakes such as clicking on malicious links or using weak passwords. Training teaches employees what security best practice means and how to adopt it.

c. Ensure Regulatory Compliance

Many industries have data protection laws (e.g., GDPR) and other industry led regulations (PCI, FSA etc) that require businesses to safeguard customer data. Cyber awareness training helps SMEs comply with these regulations and avoid fines and reputational damage.

d. Protect Business Reputation

A data breach can damage customer trust and brand reputation, potentially leading to lost business. Proactive cybersecurity measures, including training, help maintain credibility.

e. Minimise Financial Losses

Cyber incidents can lead to financial losses from fraud, legal fees, downtime, and recovery costs. Investing in training is a cost-effective way to mitigate these risks.

f. Strengthen Overall Security Culture

When employees understand cybersecurity risks, they become an active part of the defence strategy, fostering a security-first mindset across the organisation.

g. Improve Incident Response

Trained employees can quickly identify and report security incidents, enabling faster response times and reducing potential damage.

h. Stay Competitive

Many clients and partners prefer working with businesses that prioritise cybersecurity. Demonstrating a commitment to security can be a competitive advantage.

Awareness training doesn’t need to cost that much, and it can be delivered classroom based, either on site or online, or it can be automated.  The latter is often the preferred platform for an SME. 

Let’s take a look at the pros and cons of each method of delivery.

Classroom-Based Training

Pros:

  • Interactive Learning – Employees can ask questions, engage in discussions, and get real-time feedback.
  • Customisable Content – Trainers can tailor content based on specific organisational threats or employee skill levels.
  • Higher Engagement – In-person or live virtual sessions often result in better engagement and knowledge retention.
  • Hands-on Practice – Allows for simulations, group exercises, and real-world case studies.

Cons:

  • Costly – Requires hiring trainers, scheduling sessions, and potential travel expenses.
  • Time-Consuming – Employees must take time away from work to attend sessions.
  • Scalability Issues – Difficult to train a large workforce across multiple locations.
  • Inconsistency – The effectiveness may vary depending on the instructor’s expertise and teaching style.

Automated Training (often AI-Based)

Pros:

  • Cost-Effective – No need for in-person instructors or travel costs.
  • Scalable – Easily deployed across an entire organisation, including remote employees.
  • Flexible Scheduling – Employees can complete training at their own pace.
  • Consistent Content Delivery – Ensures all employees receive the same training material.
  • Trackable Progress & Reporting – Automated platforms provide analytics on employee performance and compliance.

Cons:

  • Limited Engagement – Lack of real-time interaction may result in lower retention.
  • Generic Content – May not always address specific threats or industry-specific risks.
  • No Immediate Feedback – Employees may not have an opportunity to clarify doubts in real time.
  • Potential for Click-Through Learning – Some employees might rush through without fully absorbing the information.

Which one is better?  This is somewhat subjective and will depend very much on the type of business you are, your budget and expectations.  Generally:

  • For organisations needing high engagement and tailored content, classroom-based training is ideal.
  • For large, distributed teams or cost-conscious businesses, automated training is more practical.
  • A hybrid approach, combining both methods, often works best—using classroom sessions for deep learning and automated modules for ongoing reinforcement.

Here at H2 we can offer both classroom based, in person or on-line, as well as an automated programme which can include induction courses and continual reinforcement.  This of course if the more cost effective solution for many SMEs.

Cyber Awareness Training Data Breaches and their consequences Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security Tools Working Practices

Cyber Security Operations

Security operations is a complex subject and there is no doubt that it can be expensive and difficult, even for corporate organisations who generally have the resource, both financial and technical, to run a security operations centre (SOC), or at least can afford to outsource.  I saw an RFP from a housing society for a SOC and I would be very interested to see if that contract gets let once the organisation gets the quotes, because I would be shocked if they could afford it.

Their RFP based its premise on the introduction of a Security Information and Event Management system (SIEM), which.in itself, might suggest that they don’t really know what they are asking for, or indeed, what they want.  I base this on having designed, built and operated several such operations centres in the past.

Now before the SIEM vendors and resellers pile on, let’s be clear, SIEM systems have their place and are very useful in a SOC, although I would argue that they are most certainly not the end all and be all.  My focus these days is on SMEs and for an SME there are several reasons why a SOC and an SIEM may be over the top and a cost too far.

Whilst an SIEM system is a valuable tool for cybersecurity, it comes with several drawbacks, including:

a. High Cost

  • Expensive Implementation – SIEM systems require significant upfront costs for software, hardware, and licensing.
  • Ongoing Costs – Maintenance, updates, and skilled personnel add to long-term expenses.

b. Complex Deployment and Management

  • Difficult Configuration – Setting up a SIEM system to work effectively requires extensive tuning and integration with various security tools.
  • Frequent Fine-Tuning – To avoid false positives and negatives, organisations must continuously refine alert rules and correlation policies.

c. High Volume of Alerts and False Positives

  • Alert Fatigue – SIEM systems generate numerous alerts, many of which are false positives, overwhelming security teams.
  • Difficult Prioritisation – It can be challenging to distinguish between critical threats and routine events without proper tuning.

d. Scalability Issues

  • Performance Bottlenecks – As an organisation grows, more logs and data sources can slow down the system.
  • Expensive Scaling – Scaling a SIEM to handle increasing data volumes often requires costly upgrades.

e. Need for Skilled Personnel

  • Expertise Required – SIEM systems need cybersecurity professionals to manage, analyse, and fine-tune them effectively.
  • Shortage of Talent – Finding skilled SIEM analysts can be challenging and expensive.

f. Storage and Compliance Challenges

  • Log Retention Costs – Storing large volumes of logs for compliance can be expensive.
  • Regulatory Complexity – Ensuring compliance with data protection laws (e.g., GDPR) requires careful log management.

h. Limited Threat Detection Without AI/Automation

  • Reactive Approach – Many traditional SIEMs rely on pre-set rules, making them less effective against new or sophisticated threats.
  • Lack of Automation – Without AI-driven analytics, manual investigation can be time-consuming.

Having debunked the usefulness of an SIEM system for an SME, let’s look at what an SME could do to mitigate their cyber risks.

A good cyber security strategy has always been founded upon strength in depth.  Sound security architecture, good cyber awareness training, solid access control and identity management, and the ability to protectively monitor your estate for threats, vulnerabilities, and risks. 

If you are not monitoring the effectiveness of the protections that you have spent good money on, how do you know it’s money well spent?  Are those protections doing what you think they are?  Monitoring is central to the identification and detection of threats to your IT systems. It acts as your eyes and ears when detecting and recovering from security incidents and it enables you to ensure that devices are used in accordance with your organisational policies.

Many small to medium-sized businesses struggle with stretched resources, lean budgets, and a critical technical expertise gap. This fight against sophisticated cyber threats and outdated systems turns them into easy targets for cybercriminals. Exposed and at risk, these businesses stagger on the edge of significant disruption, financial loss, and reputational damage.  Although on the surface an SIEM system might seem to be what an SME needs, it would not fit the profile of most SMEs, being too resource intensive and costly.

We have been researching the market, looking for a way of providing a security managed service that would serve an SME, at an affordable price.  And we think we’ve found it – no, we are SURE we have found it.  Simplicity is at its core, employing enterprise-grade technology to simplify and streamline the day-to-day work. Our unified platform and onboarding process, seamlessly detects, prevents, and responds to cyber threats in the most holistic, hassle-free, and cost-effective way.

We are offering a 14 day free trial and will cover:

  1. Email security.
  2. Cloud data.
  3. Automated cyber awareness training.
  4. External risk.
  5. Endpoint security.
  6. Secure browsing.
  7. Phishing simulation.
  8. And as an added bonus we can provide cyber insurance at a price which is directly linked to your risk score within or system.  The lower your risk, the cheaper the insurance.

This system is deliberately aimed at 1-250 IT users in any business.  Most SMEs come in around 10 to 15 IT users, but we’re not precious about it.  It is a managed service, and we have our eyes on the glass and can mitigate your risks automatically, or in concert with you, depending on how you wish to tailor the service.  All this for a mere £12 per user per month.

Cyber Awareness Training General Security Issues Identity and Access Management Security Tools

IDENTITY AND ACCESS MANAGEMENT AND ZERO TRUST

Today is a typical January day, cold, wet and miserable.  I really didn’t feel like getting out of bed but hey, not a lot of choice until I become a multi-millionaire and pay someone to get out of bed for me – I wish.  I’m starting the day with a large coffee from Costa to try and kick start my creative juices and get this blog written. And no, I’m not writing it in Costa, it’s a takeaway.  I’ve written several pieces on the dangers of insecure coffee shop WIFI.

Those of you who have managed to plough your way through some of my earlier stuff, will know that I am very big on user awareness training for staff at all levels, believing as I do, that it is arguably one of the quickest wins that an SME can make, to protect themselves against cybercrime.  There is however a very close second, and that is identity and access management.

Before I get into that, let’s talk a bit about Zero Trust.  You might have heard the term but what exactly does it mean?  Zero Trust architecture is a security concept that emphasises the importance of continuous verification and strict access controls within a network environment. It operates on the principle of “trust no one” and assumes that no user or device should be inherently trusted, even if they are within the network perimeter. Instead, Zero Trust focuses on authenticating and authorising every access attempt, regardless of its source or location.

In a Zero Trust architecture, access controls are implemented based on various factors, such as user identity, device health, location, and other contextual information. This approach helps prevent lateral movement within a network, reduces the impact of potential breaches, and improves overall security posture.

Zero Trust architectures typically employ technologies such as multifactor authentication, encryption, micro-segmentation, and continuous monitoring to enforce access controls and detect anomalous behaviour. By adopting a Zero Trust mindset, organisations can enhance their security defences and better protect against modern cyber threats.

Getting back to Identity and Access Control, there is mounting evidence that the message is getting through that, although passwords are very important, they most certainly aren’t the panacea that many think they are.  We can see many organisations moving to 2 factor authentication as a norm now.  In fact, if you want to be accredited to Cyber Essentials or ISO 27001, it’s a requirement without which you won’t pass.  A charity I volunteered for has done just that and not before time, considering the amount of personal data they are holding.  But is that enough?

Compromised credentials are very high on the list of cybercrime related incidents that we see and have to deal with.  Protecting these identities can be a very technical issue and advice and guidance will be needed to ensure that you are adequately covered.  However it needn’t be overly expensive, neither need it be overly complicated.  In fact, I’m a great believer in that the simplest solution is often the best solution.  I’m an adherent of the KISS principle – Keep It Simple Stupid.

Questions to ask yourself include:

  1. Are your user accounts configured with the minimum level of privilege they need to do their job?
  2. If an employee needs additional privilege to carry out a one off job, how do you ensure that once it’s completed, the privilege is revoked?
  3. What is a privileged account?  Typically it’s someone who needs additional privileges as part of their daily tasks, such as adding/removing users, auditing actions, access to more secure areas of the network (finance, management data etc), etc etc.  Are you limiting by policy the roles within your organisation that need privileged accounts, and are you specifying explicitly what those privileges are, by role?
  4. Are your privileged accounts subject to greater levels of auditing and scrutiny?
  5. Do you have a joiners and leavers process to manage active accounts?
  6. Do you have a movers process ie employees that change roles and require different levels of access to carry out their new role, either adding or removing privilege?

Another issue that you may need to consider is any accounts that exist on your network that may be used by third party suppliers.  Many companies use ‘just in time’ supply management which can require third parties to have access to their network.  Another example is people like me who, when carrying out things like vulnerability assessments, may be given privileges to scan the network.  Is that revoked at the end of the scan?  And of course, there is the IT company you may have under contract who actively have access to your network to carry out maintenance and might actually also have a contract for controlling user privilege.  Or perhaps the company you have under contract maintaining your alarms and security cameras which you didn’t know were actually using your network to connect to each other and their control room.

What about logging?  What is logging?  Every system has a set of logs which can be switched on or off.  I often come across networks where logging has been switched off or never activated because its consider to be an overhead you can live without.  Well, I disagree with that, quite vehemently.  Logging helps you to determine what normal looks like.  For example user profiles carry out certain functions within their role.  If a user is stepping outside of that profile, you need to find out why.  Is it a user who is doing something they simply didn’t realise they shouldn’t, or is it something more serious?  Is it an identity that has been created or hi-jacked by a cybercriminal who has managed to gain access?  Examination of these logs will help you understand that.  There is of course software on the market that will be of great help with this.  And of course, what do you do if you are suspicious of an activity or action by a user?

This is a big and crucial issue that deserves attention, more attention that a short blog like this can give it.  So if you would like more information, we would be happy to oblige.

Cyber Awareness Training General Security Issues Working Practices

Policies and Processes – a topic that can quickly lead to feelings of despair

When discussing cyber security, many envision suspicious figures hunched over screens in dimly lit rooms, perhaps with the scent of Jamaican Woodbines lingering in the air. Unfortunately, this image is misleading; cyber security is often quite routine, especially for those of us focused on defence rather than offence. It fundamentally revolves around People, Process, and Technology.

I published a blog recently about how hackers hack (https://hah2.co.uk/how-do-hackers-hack/). In this article, I delve into how hackers profile individuals and organisations through various methods, frequently utilising what is known as social engineering. This technique is primarily non-technical and hinges on a cybercriminals ability to infiltrate the defences of your employees to extract information. Defending against this threat relies heavily on the first two components of cyber risk management: People and Policy.

For regular readers, it’s clear how much I value cyber awareness training. I consistently emphasise that your staff can be both your most significant asset and your greatest vulnerability. Cyber awareness training is essential and should include educating employees about your organisations structure and operations. They should know whom to contact if they have concerns regarding cyber security or suspect social engineering attempts. This information needs to be embedded in the policy, potentially accompanied by a related process that connects People with Process.

In addition to cyber security policies, we also have data protection policies, which are separate but certainly overlap. While nearly every organisation requires security policies, the necessity and comprehensiveness of data protection policies vary based on the type of business. For instance, you might not immediately think of Estate Agents as data holders, yet they manage substantial amounts of Personally Identifiable Information (PII)—data that can identify an individual. Not long ago, a London estate agent faced an £80,000 fine from the Information Commissioner’s Office (ICO) for leaving the personal data of over 18,000 customers exposed for almost two years due to a failure in their data sharing practices.

It’s astonishing how much PII estate agents possess. Consider all the information they request when buying a house! In this case, compromised details included bank statements, salary information, copies of passports, birth dates, and addresses for both tenants and landlords.

Moreover, individuals have the right to sue companies that mishandle their data. Today, law firms even promote “no win no fee” agreements for these cases. Remember that data breaches typically involve numerous individuals—often hundreds or thousands of records.

To solidify the connection between cyber security and data protection, it’s important to note that the Data Protection Act 2018—often referred to as UK GDPR—mandates that personal data must be secured by ‘default and design’. This implies that cyber security measures must be integrated into your data protection processes, potentially increasing the number of policies and procedures necessary to ensure safety and compliance with legal requirements.

Let’s explore what you might need for cyber security. First and foremost, you require a comprehensive policy approved at the board level or by company ownership if there isn’t a formal structure in place. This policy serves to demonstrate the company’s commitment to cyber security and establishes a foundation for what we term an Information Security Management System (ISMS). While you don’t need to adopt formal terminology, it essentially outlines the framework detailing necessary policies, assigns responsibility for keeping them current and relevant, and ensures dissemination among all staff. Essential policies may include but aren’t limited to:

– Top-level policy issued by the board

– Starters and Leavers Policy

– Access Control Policy

– Magnetic Media Policy

– Mobile Working Policy

– Password Policy

– Email Policy

– Acceptable Use Policy

As mentioned earlier, data protection closely aligns with cyber security. Below is a potential list of policies you may need to comply with legal standards. Again, this list is not exhaustive and may seem excessive for some businesses but provides insight into what may be required:

– Data Protection – Overarching Policy

– Data Protection Training

– Data Protection – Consent

– Consent Withdrawal

– Subject Access Request

– Data Protection Complaints

– Retention of Records

– Data Breach Notification (note there is an electronic version of this on the ICO website)

– Data Protection Impact Assessment Procedure

– Security & Control of data protection documentation

– Policy Management Review Procedure

– Internal Data Protection Breach Register

– Retention & Disposal of Records Register

– Data Protection Officer (DPO) Responsibilities

– Required records to be maintained

Most policies are readily available online; however, knowing what you truly need versus what you can do without can be challenging. Too often people download templates only to modify them superficially while hoping for satisfactory results.

Over time, our approach has evolved alongside legislative changes both here and in Europe as well as shifts in working practices. We’ve dedicated countless hours researching solutions tailored to meet requirements that adapt into systems suitable for all business types—not only affordable but also compliant with standards like Cyber Essentials if needed. Flexibility has become crucial due to new working paradigms; traditional security systems where everyone operates within secure boundaries protected by firewalls are outdated. Today’s protective systems must function seamlessly whether you’re at home, on the move, or in the office, and your policies must reflect that.

When we first engage with prospective clients, we offer a free trial to assess their needs, we frequently discover they lack clarity on what data they hold or its location. They might have a vague understanding—perhaps it’s stored on cloud servers, with laptops or desktops accessing data on the cloud. However, once we implement our software for discovery purposes, we often find numerous copies stored on laptops/desktops alongside cloud servers. How does this happen? Over time—and particularly with many adopting hybrid work models—employees log onto cloud services remotely using unstable internet connections; they download necessary files to work offline then neglect to delete them after re-uploading. Or they may share files via email without realising it leaves sensitive information attached to their email server.

Audit trails present another issue: If the ICO investigates, having clear records indicating who created/copied/deleted/forwarded data is crucial. Additionally, individuals are entitled to submit Data Subject Access Requests (DSARs), compelling you to disclose any held data regarding them—a legal obligation you cannot refuse. I know of a financial firm that took almost three weeks just to fulfil a DSAR request which diverted an employee from billing tasks during that time.

Our solution addresses today’s requirements effectively—it even includes an encryption system—all under one monthly fee. You can trial it at no cost; we’d be surprised if after seeing its capabilities along with our incredibly low managed service rates you didn’t want to keep it!

Cyber Awareness Training Working Practices

Work v Life Balance

A little change this week from my usual promotion of cyber security issues, prompted, at least in part, by the changes affecting SMEs by the budget, and also because I do tend to interact a lot with HR and recruitment company’s largely because of the amounts of personal identifiable information that they hold and their concern about those budget changes.

There are going to be different views about those changes, driven by lots of things ranging from political views to how they will impact individuals and I’m not going to pore oil on those differing views.  That’s not the focus of this piece.

My first 30 years employment, from age 15 to age 40, was spent in the public sector, 25 years in the Army and 5 years in the NHS.  I then left and spent 2 years in a UK company before moving on to a major US corporation, followed by 2 more major US corporations.  By that time I’d had enough and wanted to run my own business my own way.  A challenge which never stops but has its rewards.  The contrast between the attitudes in the UK and in the US are stark, even given that the UK has attitudes to employment and laws, which are much more onerous than they are in Western Europe.

One of the first things that hits you in a US corporation is the expectation that you will work as long as they want you to, go where they want you to, and do what they want you to, all within the same salary.  Some managers are harsher than others of course, but the stock price will win every argument, and I well remember the Chairman of my first company openly admitting that they used staffing levels to control the stock price.  That meant that they would cut staff to keep the markets happy, without a second thought and absolutely hated that they couldn’t do that in Europe because of the employment laws.  The US employees had no such protection.

There were many examples of how employees were often impacted by the attitude of the senior management across the pond.  One such sticks out when I was running a team in the middle east.  Our weekends were Friday and Saturday, we worked Sundays.  One Friday the team had hired a boat, privately between us, and we were anchored offshore with the team diving off the boat into some very warm waters and having a good time.  My mobile phone rang, and I was told that I needed to get online and produce some stats that were needed immediately.  All the European teams were doing this.  I told him we couldn’t get to the office and even sent him some photos that I took with my phone to show him where we were and reminded him it was our weekend. 

Needless to say, I was reprimanded for this and told that I wasn’t being loyal.  I was a manager who insisted on looking after my guys (and gals) but that wasn’t universally appreciated by those above.

So, what is senior management often missing when they treat staff poorly, when they are demanding and even sometimes, demeaning.  Managers are looking for productivity, of course they are, without that the company goes under, but is a happy staff more productive than an unhappy one.  If we are paying a low wage and making staff claim UC to make it up, does that demean the staff member as well as putting the burden on the taxpayer.  Going back to my time in the Army in the late seventies, I remember being a Lance Corporal and qualifying for supplementary benefit, which I found demeaning.  Mind you it got worse, I was promoted to Corporal and no longer qualified and lost about a tenner a week – a lot of dosh back then.

Let’s now look at what a good work-life balance is going to give us.  Is it essential for maintaining overall well-being and improving not just the personal aspects of life, but also does it improve those professional aspects that increase productivity?  I’m not declaring myself one way or another and would prefer others to come to their own conclusions.

a. Improved Mental Health

  • Reduces stress and anxiety.
  • Helps prevent burnout by creating time for rest and self-care.
  • Encourages a clearer mind, enhancing focus and decision-making.

b. Enhanced Physical Health

  • Allows for regular exercise and proper sleep.
  • Reduces the risk of stress-related illnesses, such as heart disease and high blood pressure, reducing time off for illness.

c. Increased Productivity

  • Balancing personal and professional priorities leads to greater focus and efficiency at work.
  • Employees who are well-rested and satisfied with their personal lives tend to be more motivated.

d. Stronger Relationships

  • Allocating time for family and friends strengthens personal bonds and social support networks.
  • Improves communication and connection with families.

e. Greater Job Satisfaction

  • Employees who maintain balance are more likely to enjoy their work, feel fulfilled, and remain engaged.
  • Reduces turnover rates by creating a supportive work environment.

f. Personal Growth and Fulfilment

  • Provides opportunities to pursue hobbies, interests, and personal goals.
  • Encourages learning and development outside of work, leading to a more well-rounded life.

g. Better Work Culture

  • Promotes a positive workplace where employees feel respected and valued.
  • Encourages teamwork and collaboration by reducing tension and conflict.

h. Increased Creativity and Innovation

  • Taking breaks and engaging in diverse activities fosters creative thinking and problem-solving.

We can argue that a poor work-life balance on the other hand, can have wide-ranging effects, impacting mental, physical, and social well-being as well as professional performance. Here’s a breakdown:

a. Physical Health Issues

  • Increased stress levels: Chronic stress can lead to headaches, fatigue, muscle tension, and weakened immunity.
  • Higher risk of chronic illnesses: Conditions such as heart disease, obesity, and diabetes can result from prolonged stress and lack of physical activity.
  • Sleep problems: Difficulty in disconnecting from work may lead to insomnia or poor-quality sleep.

b. Mental Health Challenges

  • Burnout: Persistent overwork can result in emotional exhaustion, reduced productivity, and detachment from work.
  • Anxiety and depression: Long hours and the pressure to perform can exacerbate mental health issues.
  • Reduced focus and creativity: Mental fatigue from a poor balance impairs cognitive functioning and decision-making.

c. Professional Consequences

  • Decreased productivity: Overworking may initially boost

So, what do I personally, conclude from this and why do I care?  Well firstly I’m a human being and so should care and secondly, I’m a business owner and want my staff focused, productive, great for clients to interact with, responsive and who look forward to coming in every day, or at least most days, every day is probably a stretch.  I will also readily admit that some of these points aren’t my own, I have cribbed from some research I did into this area.

What is your take?  I would expect differing views and that’s OK, we all face issues every day in business, some we have in common, and some are unique to a particular business.  I’m not looking for an argument, just some mature reflection.

Cyber Awareness Training Data Breaches and their consequences General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security Tools

HOW DO HACKERS HACK?

You’ll have to forgive me for a somewhat provocative title and allow me some poetic licence, because in fact, different hacking groups do things differently, although they have much in common.  Personally, I don’t like the term hacker, much preferring cybercriminal, because anyone who accesses a system without the owners’ permission, is by definition, a criminal.  But I suppose hacker is less of a mouthful.

So, what is hacking?  Hacking involves exploiting vulnerabilities in systems, software, or networks to gain unauthorised access or manipulate data using a variety of techniques and methods, which tend to combine technical tactics and social engineering.

One of the first things a hacker, or criminal group, will do, is to profile your organisation and your people.  Favourite open sources of information include:

  • Social media: Information about hobbies, job roles, family, and schedules shared on platforms like LinkedIn, Facebook, and Instagram.  Do you have a social media policy in your company?  Do you lay down what an employee can and cannot say about your company on their personal social media pages?  Do you have a designated person in the company who handles your company’s profile on social media?
  • Company Website:  You’ll want to give prospective clients contact information of course, but you should not give out individual email addresses and limit profiles published.  I do give my personal profile on my website but don’t give information about any other position, leaving it to a generic phone number and email address.
  • Professional Profiles: LinkedIn is a favourite for targeting businesses, as it provides details about an individual’s role, connections, and organisational structure.
  • Personal Websites or Blogs: These may reveal contact details, interests, or sensitive information inadvertently.  The same issues that appertain to social media apply here. 
  • Data Brokers: Cybercriminals can purchase detailed dossiers on individuals from data aggregator sites.

Another favourite is phishing and pretexting.

  • Phishing Emails: We all know, or at least I hope we know, what phishing is.  Attackers send emails designed to extract more information, such as login credentials, by posing as a trusted entity.  In this context, it could be as simple as the attacker wanting to verify information by perhaps sending an email to a discovered address but wanting to confirm that individuals position in the company.  That just requires a response showing a signature block, so the phishing email might seem very innocuous.
  • Fake Surveys or Job Offers: These can be used to obtain detailed personal or professional data.

There are a variety of reconnaissance tools used by attackers, including open-source intelligence (OSINT) tools, WHOIS lookups and scanning misconfigured systems using commercially available tools such as Nmap and Nessus, which identify open ports, services and weak configurations.  This is why it’s essential to regularly scan your network for these weaknesses.  Ports can be opened for a particular reason and never closed again.  It’s a common fault.

Here at H2 we scan the dark web daily looking for leaked credentials, particularly email credentials.  When we on board a new client we nearly always get hits with sometimes up to 20+ compromised email addresses including passwords.  You might ask why they’d be on the dark web – simple, they are often up for sale on dark web marketplaces.

In terms of cybercrime, who’s heard of psychological profiling?  Cybercriminals analyse:

  • Behavioural Patterns: Regularity in actions, such as times a person is online, financial habits, or common purchases.
  • Weaknesses and Triggers: Examples include a recent job loss, major life changes, or emotional vulnerabilities, which they exploit through spear-phishing or scams.

I’ve often argued on these pages, that your employees are both your first line of defence and your greatest weakness, and that a good cyber awareness programme is worth its weight in gold.  Cybercriminals often focus on employees in specific departments (like HR, finance, or IT).

  • LinkedIn and Organization Charts: Identify individuals with access to sensitive data.
  • Impersonation: Pretending to be a senior executive to trick lower-level employees (e.g., through Business Email Compromise attacks – I’ve written about the CEO scam a lot).
  • Technical Probing: Use of phishing or malware to breach a target’s employer.

In conclusion, what I’ve tried to do here is give you a flavour of what you may be up against, and I hope, I’ve shown you that for all the reasons shown above technology comes last after people and process.  All the tech in the world won’t prevent issues arising from the above and is just one part of an integrated defence in depth required to prevent disaster.

Cyber Awareness Training General Security Issues Identity and Access Management Risk Analysis and Security Strategy Uncategorized

BRING YOUR OWN DEVICE (BYOD)

This is a subject that, at one time, was pretty much confined to the larger enterprise organisations but largely because of the pandemic, it is gaining popularity within SMEs and is now getting a lot of attention from the National Cyber Security Centre.

So, what is it?  Well the idea was to allow employees to use their own devices for work purposes.  The thinking was that in this day and age, many employees have developed preferences for what they use.  So whilst many will stick to Microsoft, others may prefer an Android or Apple tablet, whilst others still may prefer a MacBook or Chromebook.  There’s a wide choice these days.

But what do we mean by work purposes?  It can mean anything from accessing your emails, which most of us do on our phones, to accessing critical services and applications.  And this makes it a potentially complex issue.

The pandemic brought with it many issues that needed swift resolutions and now, it’s not uncommon to visit companies that have allowed their staff to continue to work from home often because the cost savings in office accommodation are very beneficial, and some have allowed staff to use their own preferred devices when working, including connecting to the company network and/or cloud services, remotely. 

For just about all SMEs, this has started from a position of necessity.  But like many such events, if it seems to be working, it rapidly becomes the norm and in creeps a complacency that it’s actually all OK.

BYOD solutions need to be planned and thought through.  And pretty much the same as most things, particularly risk based assessments, what you need to do really depends on your organisation.  You need to ask some questions:

  • Is there anything that needs to be done from the office that cannot be done by home workers?
  • Are there functions which employees need to do, that requires the company to have visibility and management of, and is there anything that doesn’t?
  • What do my employees need to do?
  • How can we balance what employees do that also involves your need to protect data and their privacy (DPA2018)?  They are after all, using their own device.

Above all you need a well thought through and comprehensive strategy, which, while offering flexibility and potential cost savings, recognises and deals with several security implications that organisations must address to ensure sensitive data and systems remain secure. Below are the key concerns:

a. Data Security

  • Data Leakage: Employees’ personal devices may lack adequate protections, increasing the risk of unauthorised access or accidental data leaks.
  • Loss or Theft of Devices: Personal devices may not have encryption enabled, making sensitive corporate data vulnerable if the device is lost or stolen.
  • Uncontrolled Sharing: Employees might unknowingly share corporate data via apps or cloud services outside the organisation’s control.

b. Malware and Cyber Threats

  • Insecure Devices: Personal devices might not have up-to-date antivirus software, firewalls, or operating system patches, making them susceptible to malware or ransomware attacks.
  • Unverified Applications: Employees may install unauthorised or malicious applications that could compromise corporate networks.

c. Network Security

  • Untrusted Connections: BYOD devices may connect to public Wi-Fi networks, exposing them to man-in-the-middle (MITM) attacks that could jeopardise corporate data.
  • Device Spoofing: An attacker could mimic a BYOD device to gain unauthorised access to the network.

d. Compliance Risks

  • Regulatory Violations: BYOD policies may lead to data handling practices that violate regulations like GDPR or PCI DSS if personal devices aren’t properly managed.
  • Audit Challenges: Tracking and demonstrating compliance can become difficult with non-standardised, user-managed devices.

e. Access Control

  • Weak Authentication: Personal devices may not support strong authentication mechanisms, increasing the risk of unauthorised access.
  • Lack of Segmentation: Employees’ devices may access both corporate and personal systems, creating potential crossover risks.

f. Insufficient Visibility

  • Limited Monitoring: Organisations may lack full visibility into personal devices, making it harder to detect breaches or policy violations.
  • Shadow IT: Employees might use unauthorised apps or services that bypass official security controls.

g. Employee Turnover

  • Data Retention: When an employee leaves, ensuring the removal of corporate data from their personal devices can be challenging.
  • Device Ownership: Legal and practical issues might arise when attempting to enforce data wiping on personal devices.

Mitigation Strategies

To address these risks, organisations adopting BYOD should:

  • Implement Mobile Device Management (MDM) or Endpoint Detection and Response (EDR) solutions.
  • Enforce strong authentication, such as multi-factor authentication (MFA).
  • Require device encryption and ensure compliance through regular checks.
  • Use some form of file separation to ensure separate corporate data from personal data.
  • Deploy a zero-trust security model with conditional access controls.
  • Establish clear policies and training to educate employees on BYOD security best practices.

By proactively addressing these risks, organisations can leverage the benefits of BYOD while maintaining robust security.

Cyber Awareness Training Data Breaches and their consequences General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy

Ransomware and the risk to SMEs

There’s a lot of FUD (fear, uncertainty and doubt), going around about Ransomware, and it has to be said that a lot of it comes from cyber security companies.  But amongst the rocks there are some very real diamonds that need the publicity.  There is a very real difference between genuine information and propaganda.  I hope what I do is spread information. 

There is a prevailing feeling amongst small and medium-sized enterprises (SMEs) that they are not a desirable target for Ransomware and it’s therefore not a problem for them.  However, that’s simply not true and they are increasingly vulnerable to ransomware attacks, with recent trends showing a notable rise in these incidents among smaller businesses. Several factors influence the likelihood of SMEs being targeted:

  • Widespread Targeting: SMEs are often viewed as “soft targets” because they may lack the advanced cybersecurity defences of larger corporations. Attackers assume that smaller businesses may have fewer resources dedicated to security, making them easier to compromise.
  • Increasing Ransomware Attacks Overall: Ransomware attacks globally have been on the rise, and attackers have shifted their focus to include not only large enterprises but also smaller organisations across various sectors. This is often due to the lower cost of launching ransomware campaigns, allowing attackers to spread wide nets with mass phishing campaigns and automated attacks.
  • Financial and Operational Impact: Many SMEs are attractive to attackers because the disruption from ransomware can be financially devastating for them. SMEs may feel greater pressure to pay the ransom to restore operations quickly, fearing the loss of business or reputation if the downtime persists.
  • Underinvestment in Cybersecurity: SMEs often underinvest in cybersecurity due to budget constraints, lack of expertise, or other business priorities. This underinvestment can lead to outdated software, limited employee training on cybersecurity best practices, and weaker defences that attackers can exploit.

Likelihood and Statistics

  • High Likelihood: Studies show that more than half of SMEs have experienced a cyberattack in the last year, with ransomware being one of the most common types of attack.
  • Small Business Victimisation: According to a 2022 survey by the Cyber Readiness Institute, nearly 60% of small businesses were targeted by cyberattacks, and a significant portion of these involved ransomware.
  • Increasing Cost: For many SMEs, the average cost of a ransomware attack, including downtime, lost revenue, and recovery expenses, can be as high as £50 to a £100K, making the financial impact severe and sometimes unmanageable without external assistance.

Key Risk Factors for SMEs

  • Lack of Security Awareness and Training: Employees at SMEs may be less well trained on cybersecurity threats, increasing the risk of phishing and social engineering attacks that lead to ransomware.
  • Lack of Backup and Recovery Plans: SMEs may not have effective data backup or disaster recovery strategies, making them more susceptible to extended downtime or paying the ransom.
  • Weak Network and Endpoint Security: Limited resources often mean that SMEs may not have enterprise-grade firewalls, intrusion detection, or antivirus solutions, leaving systems exposed to exploitation. They also struggle with the distributed work practice (office, home etc) that has happened since COVID.
  • Encryption:  Data is often unencrypted on end point machines.

Reducing the Risk

While the risk is high, SMEs can take measures to reduce the likelihood and impact of a ransomware attack:

  • Implementing Regular Backups: Ensuring data backups are frequent, secured, and tested for restoration can significantly reduce the impact of an attack.
  • Employee Training: Conducting regular training to recognize phishing and social engineering can help employees avoid common attack vectors.
  • Monitoring: No or inadequate monitoring of their data and systems, including home and other remote workers.
  • Endpoint and Network Security: Investing in antivirus software, firewalls, and network monitoring can improve defences.
  • Cyber Insurance: Purchasing cyber insurance can help mitigate financial losses associated with an attack.
  • Data encryption.

In summary, while SMEs face a high likelihood of ransomware attacks, increasing awareness, preparation, and proactive defence measures can substantially reduce both the risk and the impact of an attack.

What is the impact of a Ransomware Attack?

Ransomware can have devastating effects on small and medium-sized enterprises (SMEs). Here are some of the key impacts:

Financial Losses

  • Ransom Payment: If SMEs decide to pay the ransom (which is not generally recommended), this can result in significant, sometimes crippling, costs.
  • Operational Downtime: Even if no ransom is paid, businesses often experience significant downtime as they attempt to recover systems, which can halt revenue generation and lead to lost sales.
  • Recovery Costs: In addition to the ransom, SMEs incur expenses related to data recovery, IT support, and forensic investigation. Often, additional security solutions are needed to prevent future attacks.

Loss of Data

  • Data Encryption or Destruction: Ransomware can lead to the permanent loss of critical data if files are corrupted or remain encrypted after an attack.
  • Loss of Sensitive Information: SMEs may lose access to sensitive customer or business data, leading to gaps in operational records or strategic plans.

Reputational Damage

  • Loss of Customer Trust: Ransomware attacks, especially if customer data is exposed or operations are disrupted, can damage customer confidence. Many SMEs rely on personal relationships, and a ransomware incident can harm these relationships.
  • Brand Damage: Businesses often struggle to rebuild trust, and reputation damage may deter new clients and weaken partnerships with vendors or other business partners.

Legal and Regulatory Consequences

  • Compliance Violations: If SMEs operate in regulated sectors (like finance, healthcare, or legal services), a data breach can lead to violations of regulations like GDPR, resulting in fines and other penalties.
  • Legal Liabilities: Affected customers or vendors may pursue legal action if sensitive data is compromised, adding further financial strain.

Operational Disruptions

  • Halting of Services: For many SMEs, especially those without a strong IT infrastructure, ransomware can paralyse day-to-day operations.
  • Long Recovery Times: SMEs often lack the same level of IT resources as larger enterprises, so restoring full operational capacity after an attack can take weeks or months.

Employee Productivity and Morale

  • Reduced Productivity: During and after a ransomware attack, employees may be unable to work if they lack access to necessary files, email, or software.
  • Psychological Impact: The stress and uncertainty from a cyberattack can lead to anxiety or frustration among employees, potentially impacting morale and retention.

Increased Insurance Costs

  • Higher Cyber Insurance Premiums: Cyber insurance costs tend to increase significantly for companies that have experienced ransomware attacks. Additionally, insurers may demand proof of enhanced security measures to continue providing coverage.

Pressure to Strengthen Cybersecurity Measures

  • Increased Security Costs: Post-incident, SMEs often must invest in more robust cybersecurity infrastructure, including advanced threat detection, backup solutions, and employee training.
  • Ongoing Monitoring Needs: Ransomware may prompt SMEs to adopt more rigorous monitoring and endpoint protection tools, leading to continuous IT spending.

Ransomware attacks can be particularly harmful to SMEs because they often have fewer resources for cybersecurity, and a single attack can have a prolonged impact. Many SMEs lack a full-time IT staff or robust data backup protocols, which can compound the impact. Consequently, proactive measures, such as employee training, regular data backups, and up-to-date cybersecurity defences, are critical to reducing the likelihood and impact of ransomware attacks on SMEs.

Cyber Awareness Training Data Breaches and their consequences General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security

What Do SME Owners and Directors Want From Cyber Security?

I wrote a post earlier this week exploring what SME owners and directors really care about when it comes to cyber security! Do they really care about the how the latest technological solutions work? Do they really care about the scare stories, or at least, do they really think that they apply to them. Oh, they might have a sneaky suspicion that it could be a problem but is it on their mind enough for them to do something about it.

The argument was made that this is especially true in an economic downturn when they are focused on costs, even more than they normally are. They want robust cyber security solutions that don’t cost an arm and a leg.  And what they don’t want is jargon and tech speak that they feel is aimed at bamboozling them with science in order to convince them they should buy something that they don’t actually need. 

We are believers that what is needed is simplicity. SMEs are looking for user-friendly security measures that don’t require a PhD in Cyber Science. They don’t want jargon or even industry metrics. Remember the KISS principle – Keep It Simple Stupid.

Of course they are going to have a focus, and you need to understand what is important to them and what isn’t. That will depend on the nature of their business to a great extent. Whilst there are commonalities regardless of the vertical they work in, there will always be differences, some big, some more subtle, that will impact any cyber security solutioning.

Nowadays many SMEs are increasingly aware of cybersecurity risks, but a significant number still underestimate the importance of cybersecurity risk management. SMEs often face unique challenges in this area due to limited resources, competing priorities, and often a lack of expertise not just in their organisation but also in the IT support company’s they use. Here are some insights into the current landscape:

  • Growing Awareness: SMEs have started to recognise that they are just as likely to be targeted by cyber threats as larger companies, partly due to high-profile ransomware attacks and data breaches affecting businesses of all sizes. As a result, awareness is rising, especially as more businesses transition to digital platforms and remote work, which increases exposure to cyber risks.
  • Resource Constraints: For many SMEs, the cost of robust cybersecurity measures can be prohibitive. They often lack dedicated IT and cybersecurity teams, which makes it challenging to implement and maintain comprehensive security protocols. Cybersecurity solutions can be expensive, so SMEs may prioritise short-term operational needs over what they might perceive as longer-term security investments.
  • Risk Perception and Underestimation: Some SMEs mistakenly believe they are too small to be targeted by cybercriminals, assuming that attackers primarily focus on large corporations. However, this “security by obscurity” mindset has been proven false, as attackers often view SMEs as easier targets due to their weaker defences.
  • Impact of a Breach on SMEs: Unlike larger companies, SMEs are less likely to recover from a significant cyber incident. A data breach or ransomware attack can be devastating, leading to financial losses, reputational damage, and even closure. Despite this, many SMEs may not fully understand the potential scale of these consequences.
  • Compliance and Regulatory Pressure: With increasing data protection regulations (e.g., GDPR, PCI), SMEs are under more pressure to adopt better cybersecurity practices to remain compliant. This has led to greater awareness among some SMEs, especially those handling sensitive data like healthcare, finance, or customer and payment information.
  • Cybersecurity Awareness Training and Culture: Even when SMEs implement some cybersecurity measures, they may lack the necessary employee training and risk management practices that foster a security-focused culture. Human error remains a leading cause of data breaches, so SMEs need to prioritize employee awareness and training.

In summary, while awareness of cybersecurity risk management is growing among SMEs, gaps remain, particularly around adequate investment, robust risk perception, and ongoing management of cybersecurity threats. Cybersecurity can seem overwhelming for small businesses, but as the digital landscape continues to evolve, understanding and addressing these risks is becoming essential for SME survival and growth.

Scroll to top