Over the years I’ve had some very interesting conversations with several people from multiple different verticals, many fitting comfortably within the SME bracket, around Cyber Security. The conversations tend to take a very familiar turn. The cry of, ‘I’m covered, my IT support company has put in a firewall and some anti-virus. They tell me all is good’. Slightly depressing but hardly surprising.
So why surprising? A lot of IT Support Companies providing managed services do a very good job of supplying and implementing networks and providing hardware and software. The Cyber Security field is one where resources are scarce and expensive. Cyber Security professionals take a very different view than IT support companies and come at security from the risk managed view and recognise that it is not just about technology and in fact, it’s about people, process and then technology. More about this below.
As we travel around and visit clients or potential clients, it is common to find that they have the view that adequate security is provided by technology. They rely on their IT provider to provide the guidance they need which tends to involve firewalls, anti-malware software and perhaps a backup regime. All well and dandy. I use a quote from Bruce Schneier, Fellow at the Berkman Center for Internet & Society at Harvard Law School, quite a bit, it goes like this:
‘If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology’.
A common misperception is that IT Security is the same as Cyber Security. That surprises a lot of people, so let’s explore it a bit. There is clearly a close symbiotic relationship between the two disciplines. I would argue, and I know this might meet with some disagreement, that IT security refers to traditional IT security methods which are technology based. Such as firewalls, anti-malware, end point protection etc. Whilst Cyber security is based very much on risk management which combines controls which are both non-technical and technical, following the principles of People, Process and Technology. A good cyber security professional will have a good handle on both approaches.
Even though cyber security and data protection have leapt to the top of many people’s agenda in recent years it is still common amongst many SMEs to believe that it is an IT problem, a technical problem rather than a business issue, even when recognising that the risk of a cyber intrusion or a data breach, impacts the business, the bottom line.
Since I first wrote about this, we now have the changing landscape of working practices. Many SMEs have adopted a more flexible approach to work and are utilising a more hybrid working pattern with some working from the office, some from home and other places. This does have financial advantages for an SME but brings with it a lot more security issues which many are either parking or outright ignoring.
The National Cyber Security Centre (NCSC), a department of GCHQ Cheltenham, estimated, before the hybrid working pattern starting to bed in, that if you are an SME then you have around a 1 in 2 chance of experiencing a cyber security breach. For the small business this could result in costs of around £1400, for the medium business, considerably more. One has just been hit for around £30000, which I am sure you will agree, can be extremely damaging to the bottom line of businesses operating under tight margins. And of course, it’s not just financial penalties but the reputational damage should your customers data and assets be affected as well.
Within the SME world there is an almost total reliance on third party IT providers. Is that a good thing, after all that’s in the IT providers area of expertise and responsibility, isn’t it? And here comes the controversial bit. Third party IT providers, particularly in the SME space, are pretty much exclusively value added resellers or VARs, i.e., companies that sell other company’s products. Now I’ve no problem with that per se, but it comes with issues. Notable amongst them is that these companies will have skill sets that are very much limited to the products they sell. Ie they are proficient in the installation and configuration of those products and their clients are offered those products whether they are best in class, or more importantly, whether they are the most appropriate for the task. Before I get a social media pile on, I know that some of the bigger VARs do sell multiple vendors products, but they are in a minority.
Before we go any further, let’s briefly explore some issues that are common amongst SMEs. Some common myths first:
Small to medium size businesses are not worth attacking.
Cyber Security is an IT Issue.
Technology will keep me safe.
My policies and procedures are up to the job.
My staff are young and have been brought up with IT. They know the score.
Now let’s look at some of the more common issues that we see often amongst SMEs:
Lack of awareness around the current real-world cybersecurity risks
False sense of security, with a heavy reliance and dependence on an external IT third-party provider
Lack of cybersecurity knowledge and understanding
Poor cybersecurity maturity and posture within their businesses
Lack of staff training (at all levels) – just like Health & Safety, cybersecurity is everyone’s responsibility.
Here at H2 we offer a cyber maturity assessment that is designed specifically for SMEs. It is a comprehensive evaluation of an organisation’s cybersecurity capabilities and readiness to effectively mitigate and respond to cyber threats. It involves a detailed analysis of the organisation’s cybersecurity policies, procedures, technologies, and practices. The assessment aims to identify potential vulnerabilities, weaknesses, and areas for improvement in the organisation’s cybersecurity posture.
During the assessment, cybersecurity experts typically examine various aspects, such as:
Governance and Management: Reviewing the organisation’s cybersecurity policies, risk management frameworks, and leadership’s commitment to cybersecurity.
Security Awareness and Training: Evaluating the level of cybersecurity awareness among employees and the effectiveness of training programs.
Technical Controls: Assessing the implementation and effectiveness of security technologies, such as firewalls, intrusion detection systems, antivirus software, and encryption mechanisms.
Incident Response and Recovery: Analysing the organisation’s incident response plan, including procedures for detecting, reporting, and responding to cyber incidents.
Security Risk Management: Evaluating how the organisation identifies, assesses, and manages cybersecurity risks.
Third-Party Risk Management: Assessing the organisation’s approach to managing cybersecurity risks associated with third-party vendors and partners.
Compliance and Regulations: Verifying the organization’s compliance with relevant cybersecurity regulations and industry standards.
The results of the Cyber Maturity Assessment provide valuable insights to the organisation, enabling them to enhance their cybersecurity defences and establish a more robust and resilient security posture. It helps organisations prioritise their investments in cybersecurity, address vulnerabilities, and strengthen their overall cyber resilience and provides a road map to reach a standard agreed with the management, taking full account of that managements risk appetite.
Maybe I should have titled this ‘What do SMEs WANT to know’ rather than need to know. That’s because all too often they want a very cut down version of what they need, because simply put, they don’t have the budget or expertise to get into too much detail and will often look for the easy way out. That’s becoming more and more of a problem given the concerted effort by cyber criminals to attack all sizes and types of business, here in the UK. I posted a bit about this earlier, you can read it here. Do SMEs really need a cyber strategy and if so, what exactly does that entail.
What is a Cyber Security Strategy?
A cyber security strategy is a plan that outlines an organisation’s approach to protecting its information systems and data from cyber threats. This strategy typically includes measures such as implementing security controls, conducting regular risk assessments, training employees on security best practices, monitoring network activity for suspicious behaviour, and responding to security incidents in a timely manner. The goal of a cyber security strategy is to minimise the risk of cyber-attacks and protect the confidentiality, integrity, and availability of an organisation’s sensitive information.
Do I really need that – I’m an SME and not really a target, am I?
Well yes, you are a target and there are a ton of statistics available which shows that SMEs globally are a very real target for cyber-attacks and can in fact, be very profitable for cyber criminals. There are a lot of reasons for that but one of the top reasons is that typically, SMEs spend very little on cyber defence and generally have very weak defences. Add to this that they don’t tend to carry out cyber awareness training for their staff, have limited resources and generally don’t have a good grasp of the issues.
Not their fault. Most are focused on their core business, trying make a quid or two and are pressed for time. They tend to rely on whatever company, usually local, that supplied their network, hardware and software, generally on a retainer. The problem is that those companies don’t really have a good grasp of the issues either, concentrating on technology, and then, not necessarily the right technology.
The real trick here is in devising a strategy that works whilst staying within budget and having the resources to make it work. Not an easy path to tread but one that is very definitely a must.
Secure by default and design
Now that’s an interesting title, but what does it mean? Secure by default and design means that a system or product is inherently built with security measures in place from the start. This ensures that security is a priority throughout the development process and that users can trust that their data and information will be protected. It also means that security features are enabled by default, reducing the risk of vulnerabilities or breaches. This approach helps to create a more robust and resilient system that is better equipped to withstand potential threats.
It applies as much to your network and systems as it does to software development and possibly more importantly to you, it is a legal requirement under the Data Protection Act 2018, or as it is becoming known, UK GDPR.
The first problem many people come up against is that they already have a network, probably connected to the cloud of some sort, very possibly for SMEs, MS365, but when the design was done, there wasn’t a full risk assessment undertaken which is a requirement to underpin that design. In other words what we in the cyber security industry refer to as Security Architecture Design (SAD), wasn’t a prominent consideration.
Not unusual and the common technologies were probably set up, firewalls and anti-virus, but not much else. And that is where a well thought out strategy comes into play.
What should I be considering in my Cyber Security Strategy
We’ve already said you are an SME, so do you need the sort of comprehensive cyber security strategy that we would see in a major corporate? No, but it should still cover off the major points and should continue to be reviewed alongside things like your Health and Safety policy and other industry standards that are required to be reviewed for you to stay in business, usually annually. I know, it’s a pain and you’ve got enough to do without increased paperwork. But this isn’t red tape, this is designed to keep your business protected and can save you a lot of money, time and trouble.
You need to be thinking about the key components needed to effectively protect an organisation’s digital assets and data. These components may include:
Risk assessment: Assessing potential cybersecurity risks and vulnerabilities to identify areas of weakness and prioritise areas for improvement.
Security policies and procedures: Establishing clear and enforceable policies and procedures for data protection, access control, incident response, and other security-related activities.
Employee training: Providing ongoing training and education to employees on cyber security best practices, such as password management, phishing awareness, and safe browsing habits.
Incident response plan: Developing a detailed incident response plan that outlines the steps to be taken in the event of a security breach or cyber-attack, including communication protocols, containment measures, and recovery strategies.
Regular audits and testing: Conducting regular security audits and penetration testing to assess the effectiveness of existing security measures and identify any vulnerabilities that need to be addressed.
Collaboration with external partners: Establishing a partnership with cyber security company that understands the issues that affect SMEs and who themselves can establish a solid working relationship with the IT provider that is providing and administering your network and IT resources, will enhance your protections, significantly improve your employee and managerial awareness of the issues, and provide you with the peace of mind you need, allowing you to concentrate on your core business.
So, to wind this up, everyone needs a strategy that is tailored to them and covers off their needs. In order to make sure that your cyber, or if you prefer, your information assets, are secured, you need to understand what they are and how vulnerable they are to attack. Only then can you start to put in place protections that are appropriate to you, and affordable, making sure that your budget is spent wisely. Don’t be put off by all the stuff above, some of it, or perhaps much of it, won’t apply to you, but some of it definitely will. Don’t be afraid to take advice from those who know what they are talking about.
Data Protection is a somewhat dry subject that many companies, particularly SMEs, and many think they can get away from by simply paying a bit of lip service. The Data Protection Act 2018, or as it has become known, UK GDPR, is far from a toothless beast and can cause businesses to find themselves in all sorts of problems if they’re not careful.
As M&S has discovered and now, the Ministry of Justice. The cyber-attack was on the Legal Aid Agency and appears to have accessed a ‘significant amount’ of applicants’ personal data, to which the government admitted. ‘This data may have included contact details and addresses of applicants, their dates of birth, national ID numbers [national insurance], criminal history, employment status and financial data such as contribution amounts, debts and payments,’ the MoJ said.
…….. ‘it has become clear that to safeguard the service and its users, we needed to take radical action. That is why we’ve taken the decision to take the online service down. We have put in place the necessary contingency plans to ensure those most in need of legal support and advice can continue to access the help they need during this time’. Serious indeed.
Initial findings suggest that this is the result of systemic issues within the organisation which they have failed to correct, over many years.
What are the possible fall outs from this?
That very much depends on how the Information Commissioner views it. If this is seen as negligence, then the potential fine could be very significant indeed. If, on the other hand, it is deemed that the MOJ took all reasonable precautions that they could to protect the data, then that is a good mitigation which will reduce the potential punishment.
But that’s not the end of it. The reputational damage that this does is incalculable and the cost of fixing the issues will be high. Then there is the potential for legal action by anyone whose data was compromised, that could easily be the biggest issues that the MOJ faces.
Only time and a thorough investigation will determine the outcome.
Data Protection and the SME
My subscribers wi8ll know that my focus is the SME, large and small. So how does data protection impact them. Not so long ago a London estate agent was fined £80,000 by the Information Commissioner’s Office (ICO), after leaving the personal data of more than 18,000 customers exposed for almost two years.
The incident occurred when the estate agent passed the details from its own servers onto a partner company. An “Anonymous Authentication” function was not switched off, which meant there were no access restrictions to the data.
It’s surprising just how much PII estate agents hold. Just think about what they ask for when you’re buying a house. In this case the exposed details included bank statements, salary details, copies of passports, dates of birth and addresses of both tenants and landlords.
Then, as above, that might not be the end of it. Individuals can sue companies that release data into the wild. In fact, there are now law firms advertising no win no fee when representing these cases. Remember that data breaches almost always involve multiple people, sometimes hundreds if not thousands of records.
What size does a business need to be for the regulations to apply?
The regulations apply to all businesses large and small, although some exceptions exist for SMEs. Companies with fewer than 250 employees are not required to keep records of their processing activities unless it’s a regular activity, concerns sensitive information or the data could threaten an individuals’ rights. Just exposing PII can threaten an individual’s right to privacy.
Just about everyone processes personal data of some sort. Data that can identify a living individual. HR data will have bank account information, home addresses, NOK, phone numbers, maybe references from previous employers. The exposure of some or all of that could be judged as prejudicial to an individual’s rights. Some companies may have bigger problems, for example Solicitors, Estate Agents, Financial Advisors and Recruiters (the list is not exhaustive), which hold an abundance of personal data about their clients, much of which, under other legislation they are required to retain for up to 7 years.
Do I need written policies and processes?
Yes – What this means is that a significant number of policies and processes will need to be written and taken into use by the organisation. It is not unusual for many to visit the web and download templates to cover their requirements. However, whilst these templates in themselves maybe adequate when used by someone who knows what the requirement is, they may be less than effective in the hands of someone who is just looking for a quick tick in the box.
How is UK GDPR effected by cyber security?
The Act requires personal data to be secured by ‘default and design’. This means that cyber security requirements must be designed into your protections. This could mean at least another 6 or 7 policies and procedures.
How can I keep track of all my PII holdings and keep it secure?
When we are first approached by a prospective client and we begin our offer of a 30 day free trial to examine their requirements, one of the first things we find is that they don’t know what data they are holding, or where it all is. Oh, they have a general idea; it’s on the cloud server(s), it’s not on laptops or desktops, it’s just the stuff we need to process our clients’ requirements and yes, we’ve only got one copy. And then we install our software that first carries out a discovery exercise and we find that their laptops/desktops are holding lots of copies of the data that is on the cloud server(s). How does that happen? Over time, especially with many now employing the hybrid system of working, ie between the office and remote (home) locations, employees log on to the cloud, find they have a bit of shaky internet link and download the data they need, work on it and then upload it again, forgetting to delete it from their machine. Or they need to share it and attach it to an email and send it out, forgetting, or perhaps not realising, that the data is now stored, attached to an email, on their email server.
Then comes the issue with audit trails. If the ICO ever wanted to carry out an investigation, then having an audit trail of who created/copied/deleted/forwarded what to who, is essential. And let’s not forget the member of the public who is fully entitled to submit a Data Subject Access Request or DSAR, which demands that you reveal what data you are holding on that person. The law insists on it, and you can’t refuse it. I know of a financial firm that took nearly 3 weeks to satisfy a DSAR, taking an employee off billing, for that time.
Are there solutions suitable and affordable for SMEs?
We have a solution that meets the requirements and not only that, has a built in encryption system, all within the same monthly cost. It’ll cost you nothing to trial it and we’d be very surprised if once you’ve seen it and seen the ridiculously low monthly charge for the managed service, you don’t want to keep it.
We’ve posted a few pieces recently on why setting a realistic budget for cyber security is so important and we thought we’d follow that up with some real-life examples.
Small and medium-sized enterprises (SMEs) are increasingly being targeted by cybercriminals in 2025 and are facing a range of sophisticated threats that exploit limited resources and evolving technologies. Here’s a quick look at some of the most pressing cybersecurity incidents and trends that have affected SMEs so far this year:
Major Cybersecurity Incidents Impacting SMEs
Co-op Supermarket Chain Cyberattack (UK)
A “highly sophisticated” cyberattack disrupted Co-op’s IT systems, leading to customer data theft, contactless payment failures, and empty shelves in Scottish stores. The breach also affected other major retailers like Marks & Spencer and Harrods, with investigations pointing towards hacker groups such as Scattered Spider and Lapsus$.
Lockbit Ransomware Group Breach
The notorious ransomware gang Lockbit was itself hacked, resulting in leaked communications that revealed aggressive targeting of small businesses for extortion. This breach has temporarily disrupted Lockbits operations and exposed their tactics.
Berkeley Research Group (BRG) Data Breach
A cyberattack on BRG compromised sensitive data related to Catholic Church sex-abuse cases. The attacker used impersonation tactics via Microsoft Teams to deploy Chaos ransomware, leading to concerns over the exposure of victims’ identities.
Emerging Cyber Threat Trends for SMEs
AI-Powered Phishing and Deepfake Attacks
Cybercriminals are leveraging AI to craft convincing phishing emails and deepfake audio impersonations of executives, deceiving employees into authorising fraudulent transactions.
Ransomware-as-a-Service (RaaS)
The availability of RaaS platforms has lowered the barrier for launching ransomware attacks, making SMEs prime targets due to their valuable data and often limited security infrastructure.
Supply Chain Vulnerabilities
Attackers exploit weaknesses in third-party vendors to infiltrate SMEs’ systems, as seen in incidents involving compromised software packages on platforms like NPM.
Business Email Compromise (BEC)
Scammers use AI to mimic emails from corporate partners and managers, leading to fraudulent financial transactions. In Australia, BEC attacks have increased by 7% year-on-year, with SMEs being particularly vulnerable.
Proactive Measures for SMEs
To mitigate these threats, SMEs should consider the following actions:
Implement Multi-Factor Authentication (MFA)
Enhance account security by requiring multiple verification methods.
Regular Employee Training
Your staff are your first line of defence and need to be educated on recognising phishing attempts and social engineering tactics.
Secure Supply Chains
Vet third-party vendors for cybersecurity compliance and monitor for unusual activities. Are you in a supply chain for a major company? Are you facilitating a back door into their systems?
Invest in AI powered security tools
Utilise advanced solutions capable of detecting and responding to sophisticated threats. H2 has a couple of suggestion here that are affordable to SMEs.
Protective Monitoring
How do you know that your expensive solutions are protecting you? Do you know if you’ve suffered a stealth attack where the attacker has built a back door into your systems? Do you know if you’re hard-earned cash is being siphoned off? How vulnerable are you to an attack? A monitoring solution for SMEs is now available at an affordable price.
Data Loss Prevention
Are you sure you know exactly where all your data is? Are you sure that documents attached to emails aren’t still sitting on your email server? Do you know if other documents have been downloaded from your cloud storage whilst your staff work from home, and then uploaded but a copy is still sitting on their laptop? Data proliferation over time is almost a given. Can you encrypt your sensitive data so that even if it’s stolen, it’s useless to the thief? An affordable solution now exists.
Develop an Incident response and business continuity plan
No matter how well you protect yourself, you still need to prepare for potential breaches with a clear strategy to minimise impact and recover operations swiftly.
The world is in somewhat of a flux at the moment and SMEs are being battered from all sides it seems. First, we have the increase in the minimum wage, which impacts SMEs, generally, more than the corporate sized businesses, and then the increase in NI. What we didn’t need was tariffs, although how much of an impact that will have on SMEs won’t be known for some time yet. The EU is the world’s largest single market area and is the largest economy in the world, whether some people agree or not. Many may attribute that market size to large organisations and multi-national companies. While these are important contributors to the overall EU economy, the Small Medium Enterprise (SME) businesses form the backbone of that economy. This is also true of the UK where the DTI estimates that SMEs make up nearly 95% of the UKs GDP. A huge percentage and one that might surprise you.
According to the Cyber Security Breaches Survey (gov.uk), half of SMEs in the UK had experienced some form of cyber-attack in 2024, with email phishing, spear-phishing, and social engineering continue to trend as the most common and reliable means of illegally accessing a network.
NinjaOne produced are report which says that there were 7.78 million Cyber Attacks on UK Businesses in 2024. More than 400,000 cases of fraud and computer misuse were recorded. 50% of UK businesses experienced a cyber-attack.
The economic effects of the measures hitting SMEs discussed above, are already having an effect in that many SMEs are putting enhancing their protections against cyber-attacks, on the back burner. Those we speak to acknowledge the problem but are reluctant to spend money on anything that isn’t their core business. And we get that, we really do. After all we are an SME ourselves.
What are the potential impacts of a cyber-attack on your business?
A successful cyber-attack can wreak havoc on your business. Damaging your financial stability, customer trust, and reputation while inviting legal issues. The fallout includes:
Loss of corporate, financial, and personal data
Disruption to trading and potential fines from ICO
Repair costs for affected systems
Imagine building customer trust and an impeccable reputation over years, only to see it shatter in hours due to a cyber-attack.
The consequences, loss of customers and decreased sales and profits
The fear of legal repercussions is real too. Deploying inadequate security measures can lead to fines, regulatory sanctions and even legal action.
So, what can you do to better protect your business?
Despite today’s digital landscape, cyber security remains a non-negotiable aspect of business success. The threats are real, and SMEs are not immune. In fact, they’re often the most vulnerable to cyber-attacks.
Solutions need not be complicated or expensive, yet many SME owners still act reactively, not proactively, to cyber threats. The result? Huge costs to put things right and a massive hit on the company’s reputation and trust with their customers.
An underlying issue common to all SMEs is management awareness and commitment, which in turn drives budget, allocation of resources and effective implementation of the cybersecurity practices. Six categories of major challenges for SMEs have been identified:
Low cybersecurity awareness of the personnel.
Inadequate protection of critical and sensitive information.
Lack of budget.
Lack of ICT cybersecurity specialists.
Lack of suitable cybersecurity guidelines specific to SMEs.
Low management support.
Risk Management
Now I know that many will say that this is a technical matter and that we have a company under contract that looks after our IT infrastructure and therefore we can safely leave it to them. Wrong. Ask them some simple questions:
Have they fully identified your security assets? Security assets are not just hardware and software, in fact those are often the least of your worries. It’s the data, where it is and how it’s protected that is important.
Have they done a risk assessment on those assets.
Have they recommended or implemented controls to manage the risk down to your acceptable residual risk level. That is assuming they have spoken to you about what that acceptable risk is.
It’s very important that business owners grasp the difference between the technical requirements of their networks, and the business requirement.
You carry out risk management on a daily basis as you go about your business. Cyber security is no different and a simple risk management process can save you money by targeting your limited spend where it really needs to go, not where you may think it needs to go. Here is a link to a short video on that risk management process, which should help you see that it’s not onerous and need not be costly.
https://bit.ly/3FdZ6x0
Cyber Awareness Training
Some of you who are amongst my regular readers, will be quite aware of my mantra in regard to Cyber Awareness Training for staff and managers. A big misconception is that because cyber security can be an issue connected to technical measures, it lies squarely within the realm of IT. Wrong. Cyber security needs to be part of the culture of the organisation, second nature to all. Staff need a basic awareness and how their attitude and actions can have a damaging effect on the business. A report for ENISA, the EU security agency, suggests that 84% of Cyber attacks rely on some form of social engineering, and that the number of phishing attacks within the EU continues to grow. This is echoed in the UK.
Budgets
Budgets remain a problem. Many SMEs are low margin organisations, heavily reliant on cash flow, and therefore reluctant to spend on things that are not connected to their core business. But they must get used to asking themselves, ‘Is IT part of my core business?’, and ‘how long could I continue to operate my business if I lost my IT systems?’. Cyber security needs to be factored into budgets. Cyber security is an iterative process, it isn’t something that needs to be done once and then forgotten about. The criminals are constantly evolving, and defences must evolve with them.
Cyber Expertise
Cyber security expertise is something that isn’t cheap and easy to obtain. Many IT companies will talk about their expertise in this area but if you delve into that, it is generally focused on products, mainly firewalls and anti-malware. Cyber security expertise goes much much deeper than that and is as much procedural as it is technical. It starts with risk management, understanding the risks you face, which in turn is derived from threat and vulnerability analysis, matched to your cyber security assets. Those latter are not necessarily hardware and software but can be much wider ranging than that. Typically, the type of person who can legitimately call themselves experts in this field, can command salaries north of £80K. I doubt there are many SMEs prepared to pay that, or indeed, many of the smaller IT companies.
Security Standards
It can also be advantageous to follow a standard. By far the most comprehensive is the International Standard for Cyber Security, ISO27000 series. However, this might be seen as a little heavy for many SMEs, although at the higher end, they may want to follow it, rather than seek certification. At the lower end the UK Cyber Essentials scheme, mandated for anyone wishing to do business with the public sector, is very suitable, inexpensive, and obtainable.
Cloud Services
More and more SMEs are now moving to a cloud environment. Be it MS365, Amazon Web Services, Digital Ocean, amongst others. I usually recommend that SMEs take this approach as it can solve a lot of problems, particular with home working still very much in vogue. However, it is not the panacea that most think it is and still has some security issues, usually but not always at the user end, that need to be addressed.
About H2
Here at H2 we use our long experience of providing cyber security solutions to the large enterprises, to craft solutions for the SME community, having first identified the issues that the business faces. We take an approach that looks at things from the business point of view, managing risk and coming up with cost effective solutions which can be brought in in a phased way, for a subscription price. No large bills to damage that all important cash flow.
Barely a week goes by without the remote working v office-based argument surfaces somewhere, usually it must be said, at the corporate level, although many SME owners remain nervous of it, with others downright against it. My client base appears to be largely OK with a hybrid model of working and only one is 100% remote based, having given up their office.
The COVID pandemic was the catalyst for this with businesses of all sizes being forced to transform their operations to support remote work and by and large have done well, but not without many challenges, including video conferencing burn out, (along with wishing they’d taken out shares in Zoom!!), and a yearning to work together in person again, someday. We all realise that group working, face to face, is often necessary not just for efficiency, but because we are social animals. Experience has taught many businesses many things but are often still struggling with the potentially dire consequences in terms of cyber security and data protection.
I should perhaps mention that in the corporate IT world, where I worked for many years for major system integrators like HP, hot desking and remote working was introduced in the early 2000s and therefore this was no problem for us.
A distributed work environment i.e., personnel spread around various locations, office, home working, even the local coffee shop, creates critical challenges and new security threats as a result. The speed with which this has happened has meant that many simply did not take cyber security issues into account and if they did, thought, well, this is temporary, and it won’t matter in the long run. Well perhaps, but as many are now finding, there have been advantages to home working, not least a lowering of costs in terms of how much office space is needed to carry out the business function. Many are now looking at Hybrid working i.e., from home with a day or two in the office during the week. There are pros and cons to this outside of the scope of this article, and businesses will have to make their own judgements, but one thing is clear and that is that businesses need to understand the risks now inherent in distributed work and need to get better at cyber security and data protection, in those environments.
Employees when remote working, are at much greater risk than those in offices. Since home connections are less secure, cybercriminals have an easier entry into the company network. Furthermore, the explosion of various online tools, solutions, and services for collaboration and productivity tend to have the bare minimum of security default setting, and updates from third-party vendors can change security preferences and be easily overlooked.
Phishing becomes an even greater threat to home workers simply because, in an office environment, they have access to colleagues and managers, who they can approach for advice and guidance. This is much harder to replicate with remote workers, especially those who may not be particularly tech savvy and who may not wish to become ‘burdensome’ to their co-workers.
Ransomware also enjoys an advantage in the remote working model. If their connection to the company is blocked, it is more difficult for workers to get assistance from the right experts and authorities. And since trust levels are lower when working from home, some workers will be concerned that they have “done something wrong” and so may be more reluctant to seek help. While this risk can be addressed by increased training, as well as messaging that vigilance and involving IT support will be rewarded, it can still be an uphill battle.
In a study carried out by Entrust it was clear that many organisations are grasping the concept of cyber awareness training, although there are still too few amongst SMEs that take this on board. Of those who responded to Entrust:
94% said employee training has a positive impact on data security.
95% agreed that they trust remote employees to comply with data security best practices and training.
93% said they felt positive about the impact data security training had on them.
Of course, this was a sampling and only 61% of employees said that their company offered training.
Whatever system of hybrid you are proposing to use, or are using, it is clear that you will need to go beyond baseline security measures. In this case we are almost certainly dealing with baseline protections such as multi-factor authentication, known as MFA or sometimes 2FA, and virtual private networks (VPNs). Both have their place and will be needed.
The Entrust report cites a contradiction here, and it’s one I have also noted. Many company owners/directors say they believe company data is protected with these baseline solutions, yet they also say that home internet connections, leaked sensitive company information and cyber-attacks are their top concerns.
If organisations are going to use hybrid work models successfully over the long term, then they will need to further invest in their security strategy. MFA and VPNs, while important, should be seen as part of a larger strategy for data security in a hybrid work model. Throughout and beyond the pandemic, bad actors have exploited security deficiencies of remote environments such as insecure home tech hardware, poor password hygiene and employee use of unapproved tools.
If you are going to adopt this new normal, or already have adopted it, then the process must start with understanding your risk posture which will inform you of what measures you need to take to secure your data. Below is a link to a short video explaining cyber risk management, at least at a high level.
Once you have a clear understanding of what your risks are, then you might like to consider a zero-trust approach to data security.
With employees having the ability to work anywhere in a hybrid environment, the office perimeter is no longer relevant to digital security. Zero Trust frameworks are designed to apply the concept of least privileged access to people, systems and devices, giving these entities only the access they need to fulfil their role and nothing more. Additionally, a Zero Trust approach continually monitors user and device behaviour to identify suspicious patterns and take preventive action, including a step-up authentication challenge.
You may need to consider other protections such as:
Passwordless single sign on involving Privileged Access Management (PAM) to facilitate a Zero Trust approach.
Data Loss Prevention. Whilst a VPN will protect your data in transit, file level encryption ensures that it is protected at rest, at both ends of the tunnel, so that if it does get stolen or otherwise compromised, the impact is severely lessened. There is more information in the short video below.
Protective Monitoring. This has long been considered too expensive for an SME. Well, no longer, there is now a system which is effective and affordable and is explained in the video below.
Data breaches continue to make headlines, with corporate incidents grabbing the most attention. A prime example is the Equifax breach, where a server exploit compromised credit reports of over 140 million individuals. The breach took months to discover and resolve, ultimately resulting in Equifax settling with the FTC for a $575 million fine.
Not so long ago the Electoral Commission revealed it fell victim to a “complex cyber-attack,” potentially impacting millions of voters. Unspecified “hostile actors” accessed electoral registers from August 2021 and infiltrated emails and control systems. Alarmingly, this attack went undetected until the following October, leaving sensitive data exposed to cyber criminals for over a year. It’s astonishing that adequate protections were not in place to ensure timely detection and management of the breach.
According to the UK’s NCSC, half of businesses and about a third of charities have reported experiencing some form of cyber security breach or attack. This figure rises to approximately 70% for medium-sized businesses and 74% for large enterprises. Phishing remains a favoured attack method due to its relative simplicity, with AI now generating new variations of old scams.
Most data breaches occur unintentionally, often due to employees making mistakes because they lack awareness of proper procedures. Who bears responsibility? Is it the employee or the employer for not providing sufficient cyber awareness training? That’s open to interpretation.
Here are some notable examples from the Information Commissioner’s Office (ICO):
• A data controller inadvertently sent paperwork to a child’s birth parents without redacting the adoptive parents’ names and addresses. Upon discovering the breach, the data controller failed to inform the adoptive parents.
• A debt insolvency agent mistakenly emailed a vulnerable new client’s file to a colleague in another department. The colleague quickly deleted the email and alerted the sender about the mistake.
• An employee misplaced his briefcase containing work on an unencrypted laptop and unredacted paper files related to a sensitive court case, which included information on criminal convictions and health details. Initially, he believed both the laptop was encrypted and that the paper files were redacted. After informing his manager, who reported it to IT, the laptop was remotely wiped without initially notifying the ICO. The data controller later reported it after realising the laptop was unencrypted.
• A courier mistakenly delivered medication intended for one patient (Patient A) to another (Patient B). After Patient A complained, the pharmacist recognised the error and arranged for the unopened medication to be picked up and delivered correctly.
• A law firm employee fell victim to a phishing attack after clicking on a link in an email that led them to enter login credentials on what they thought was a legitimate site. The IT department later discovered that their email account had been compromised, leading to significant unauthorised payments being made by clients due to spoofed communications.
These cases are just a small sampling.
Now let’s discuss ransomware. There’s a common misconception among SME management that ransomware primarily targets larger companies since SMEs seem too small to be lucrative targets for cybercriminals. However, when SMEs do get attacked, ransom demands can be surprisingly low—often between £500 and £1,000—leading many SMEs to pay up without hesitation. This poses significant risks because often their data has already been stolen, and sometimes criminals fail to restore access afterward, leaving SMEs financially strained and unable to operate.
Preventing such attacks in the first place is far more advantageous. Here are several strategies you might consider implementing:
• One of the most impactful steps an SME can take is providing Cyber Awareness Training for employees. Research shows that 90% of data breaches stem from human error; it’s unlikely an employee will intentionally harm your business. However, without proper training, they may unknowingly engage in risky behaviour. Cyber security awareness training is crucial; staff need knowledge about potential threats. Cyber security is not just an IT issue; it’s a business-wide responsibility that requires everyone’s involvement. Effective strategies tend to follow the KISS principle—Keep It Simple Stupid.
• Another cost-effective measure is developing robust policies and procedures related to cyber security that are communicated throughout your organisation and regularly updated to remain relevant. Providing employees with clear guidelines on how to respond if they suspect suspicious activity supports them rather than penalising them for mistakes. Many SMEs lack adequate policies or settle for generic templates found online that seldom meet their needs.
• Review your backup strategy as well. Even if using cloud-based services, your data may not be adequately secured, despite providers’ claims. A better approach would be implementing a backup strategy where your data is backed up nightly onto magnetic media storage that’s stored securely offline. In case of an attack that locks your data, you could wipe affected workstations and restore information from backups without significant downtime.
• EMail remains one of the most common attack vectors. Numerous products claim to block malicious emails effectively; many excel at this task. For SMEs, cost is often a deciding factor when selecting these products. Unfortunately, some still opt for low-cost or free anti-malware solutions. Understanding that quality correlates with price is essential; if it’s free, you’re likely facing issues down the line.
Turning to how your systems might be monitored for security issues, we have been exploring options in the market for an affordable security managed service tailored specifically for SMEs and we believe we have found it! Our solution emphasises simplicity while utilising enterprise-grade technology to streamline daily operations effectively. Our unified platform seamlessly detects, prevents, and responds holistically to cyber threats without hassle or excessive costs.
We are offering a free trial that includes:
a. Email security.
b. Cloud data protection.
c. Automated cyber awareness training.
d. External risk assessment.
e. Endpoint security.
f. Secure browsing practices.
g. Phishing simulations.
h. Plus, as an added bonus: cyber insurance priced based on your risk score within our system—the lower your risk score, the more affordable your insurance!
This service is specifically designed for businesses with 1-250 IT users; while most SMEs typically fall between 10-15 users, we’re flexible! It’s a managed service approach with proactive risk mitigation tailored according to your preferences—all at just £12 per user per month!
We’re also introducing an intuitive cloud software solution focused on data protection that empowers organisations by securing their information while giving IT professionals an easy way to track sensitive data and manage risks effectively. The system routinely audits company data to locate sensitive information and applies necessary updates and encryption automatically.
This method ensures organisations always know what sensitive data they possess while keeping it secure through automatic encryption measures, making data security straightforward so businesses can protect private information as circumstances evolve over time, without needing complex software requiring specialised expertise.
Here are 2 very short videos explaining our solutions.
Security operations is a complex subject and there is no doubt that it can be expensive and difficult, even for corporate organisations who generally have the resource, both financial and technical, to run a security operations centre (SOC), or at least can afford to outsource. I saw an RFP from a housing society for a SOC and I would be very interested to see if that contract gets let once the organisation gets the quotes, because I would be shocked if they could afford it.
Their RFP based its premise on the introduction of a Security Information and Event Management system (SIEM), which.in itself, might suggest that they don’t really know what they are asking for, or indeed, what they want. I base this on having designed, built and operated several such operations centres in the past.
Now before the SIEM vendors and resellers pile on, let’s be clear, SIEM systems have their place and are very useful in a SOC, although I would argue that they are most certainly not the end all and be all. My focus these days is on SMEs and for an SME there are several reasons why a SOC and an SIEM may be over the top and a cost too far.
Whilst an SIEM system is a valuable tool for cybersecurity, it comes with several drawbacks, including:
a. High Cost
Expensive Implementation – SIEM systems require significant upfront costs for software, hardware, and licensing.
Ongoing Costs – Maintenance, updates, and skilled personnel add to long-term expenses.
b. Complex Deployment and Management
Difficult Configuration – Setting up a SIEM system to work effectively requires extensive tuning and integration with various security tools.
Frequent Fine-Tuning – To avoid false positives and negatives, organisations must continuously refine alert rules and correlation policies.
c. High Volume of Alerts and False Positives
Alert Fatigue – SIEM systems generate numerous alerts, many of which are false positives, overwhelming security teams.
Difficult Prioritisation – It can be challenging to distinguish between critical threats and routine events without proper tuning.
d. Scalability Issues
Performance Bottlenecks – As an organisation grows, more logs and data sources can slow down the system.
Expensive Scaling – Scaling a SIEM to handle increasing data volumes often requires costly upgrades.
e. Need for Skilled Personnel
Expertise Required – SIEM systems need cybersecurity professionals to manage, analyse, and fine-tune them effectively.
Shortage of Talent – Finding skilled SIEM analysts can be challenging and expensive.
f. Storage and Compliance Challenges
Log Retention Costs – Storing large volumes of logs for compliance can be expensive.
Regulatory Complexity – Ensuring compliance with data protection laws (e.g., GDPR) requires careful log management.
h. Limited Threat Detection Without AI/Automation
Reactive Approach – Many traditional SIEMs rely on pre-set rules, making them less effective against new or sophisticated threats.
Lack of Automation – Without AI-driven analytics, manual investigation can be time-consuming.
Having debunked the usefulness of an SIEM system for an SME, let’s look at what an SME could do to mitigate their cyber risks.
A good cyber security strategy has always been founded upon strength in depth. Sound security architecture, good cyber awareness training, solid access control and identity management, and the ability to protectively monitor your estate for threats, vulnerabilities, and risks.
If you are not monitoring the effectiveness of the protections that you have spent good money on, how do you know it’s money well spent? Are those protections doing what you think they are? Monitoring is central to the identification and detection of threats to your IT systems. It acts as your eyes and ears when detecting and recovering from security incidents and it enables you to ensure that devices are used in accordance with your organisational policies.
Many small to medium-sized businesses struggle with stretched resources, lean budgets, and a critical technical expertise gap. This fight against sophisticated cyber threats and outdated systems turns them into easy targets for cybercriminals. Exposed and at risk, these businesses stagger on the edge of significant disruption, financial loss, and reputational damage. Although on the surface an SIEM system might seem to be what an SME needs, it would not fit the profile of most SMEs, being too resource intensive and costly.
We have been researching the market, looking for a way of providing a security managed service that would serve an SME, at an affordable price. And we think we’ve found it – no, we are SURE we have found it. Simplicity is at its core, employing enterprise-grade technology to simplify and streamline the day-to-day work. Our unified platform and onboarding process, seamlessly detects, prevents, and responds to cyber threats in the most holistic, hassle-free, and cost-effective way.
We are offering a 14 day free trial and will cover:
Email security.
Cloud data.
Automated cyber awareness training.
External risk.
Endpoint security.
Secure browsing.
Phishing simulation.
And as an added bonus we can provide cyber insurance at a price which is directly linked to your risk score within or system. The lower your risk, the cheaper the insurance.
This system is deliberately aimed at 1-250 IT users in any business. Most SMEs come in around 10 to 15 IT users, but we’re not precious about it. It is a managed service, and we have our eyes on the glass and can mitigate your risks automatically, or in concert with you, depending on how you wish to tailor the service. All this for a mere £12 per user per month.
I’ve been talking recently about the relationship between IT and cyber security budgets for SMEs and I mentioned that at one time, the recommendation was that 5% of IT budgets be put aside for security. Well, that figure has gone up year on year and is now about 15%. Of course, these percentages work well in the corporate market where IT budgets can run into the millions, but in the SME world, where budgets are tiny in comparison, the percentages don’t work quite as well. After 15% of very little, is very little.
So where does that leave us? We still have to budget, failing to plan is planning to fail – how’s that for a nice bit colloquialism. Budgets are necessary. IT whether hardware or software, doesn’t stand still, it moves forward rapidly and the hardware you bought two years ago will often struggle to run some of the software upgrades, and those upgrades themselves come thick and fast.
Cyber security is no different. We have to contend not only with those software implementations, many with vulnerabilities already present, but with cyber criminals who are always pushing the boundaries. We play catch up. We always have and probably always will.
So what are we budgeting for? SMEs face several challenges in implementing adequate cybersecurity defences. These challenges arise due to resource constraints, lack of expertise, and evolving threats. Some of the biggest issues are:
Cybersecurity tools, training, and infrastructure
Inadequate funding for the above. SMEs will naturally prioritise business growth and operations over cybersecurity investments.
Lack of Expertise
SMEs often lack dedicated cybersecurity personnel or in-house IT teams. Limited access to experienced professionals makes it difficult to implement and maintain robust security measures.
In adequate or lack of cyber awareness and training
Employees may lack awareness of cybersecurity risks and become easy targets for phishing or social engineering attacks.
Insufficient training on best practices, like identifying suspicious emails or handling sensitive data securely.
Underestimation of Risks
Many SMEs believe they are too small to be targeted, making them complacent.
Attackers often target SMEs precisely because they assume SMEs are less secure than larger companies.
Rapidly Evolving Threat Landscape
Cyber threats like ransomware, phishing, and zero-day exploits are constantly evolving.
SMEs struggle to stay updated with new technologies and threats.
Outdated Technology
Reliance on legacy systems or software that lacks regular updates or patches.
Limited investment in modern security tools, such as firewalls, endpoint protection, or intrusion detection systems.
Third-Party Risks
SMEs often rely on third-party vendors or service providers, which can introduce vulnerabilities. Don’t assume that your IT vendor has a grip on security – they are often as ill-informed as you are.
A breach in one partner’s system can cascade down to the SME.
Compliance Challenges
SMEs may not have the resources to understand or comply with cybersecurity regulations (e.g., GDPR, CCPA, PCI DSS).
Non-compliance can result in fines or penalties, exacerbating financial pressures.
Insufficient Incident Response Plans
SMEs often lack a formal incident response plan to handle breaches or attacks.
Without predefined protocols, responses to incidents are slower and less effective.
Shadow IT
Employees may use unauthorised software or devices without IT approval, creating vulnerabilities.
Shadow IT can bypass existing security measures.
Supply Chain Attacks
Cybercriminals target SMEs as an entry point to larger companies in their supply chain.
SMEs often lack robust controls to mitigate supply chain risks.
Difficulty in Accessing Cyber Insurance
Obtaining cybersecurity insurance can be difficult or expensive for SMEs, especially if they lack basic protections.
Insurers often require proof of a certain level of security maturity.
These days addressing these challenges requires SMEs to adopt a combination of cost-effective solutions, such as managed security services, regular training, and leveraging cloud-based security tools. Effective cyber security is a business issue, not an IT issue and requires a thorough understanding of the risks, vulnerabilities and threats, that a business faces. It requires a professional approach from a security professional that most SMEs can’t afford to employ, so the next best thing is to partner up with such an organisation.
H2 provides affordable and flexible one-off and ongoing data protection and cyber risk protection services designed specifically for SMEs; at a price they can afford. Our advice and guidance takes a unique look at the problems facing SMEs whilst calling on our vast experience working for the larger organisations and government departments.
I wrote a post recently about what SMEs care about regarding Cyber Security v the continued FUD (fear, uncertainty and doubt), which many sales pitches tend to rely on, which helps foster the view that it’s all a little hyped up and not as serious as it advertised. Well, I hope my post did a little to dispel this and show that there really is an issue out there that needs to be addressed by all businesses, not just the corporate big boys. Let’s leave the stats and hype behind and concentrate on what SMEs need to be thinking about.
What is the cost of ignoring cyber security?
Perhaps this is the first question that they should be asking. The financial hit of a data breach can be crippling, especially for the smaller businesses who are perhaps running on tight margins and for whom cash flow is often critical. The average clean up for a smallish business is about £27K. this relates to system restoration, hardware replacement, and the implementation of enhanced security measures. and doesn’t include financial loss from the actual data stolen, or whatever scam was perpetrated, and any fall out from compliance failures, such as fines from the ICO. And at least a third of organisations admit to losing customers post a data breach, highlighting reputational damage and a loss of customer trust.
If you take all that into account, you should be able to work out what the potential cost might be for you.
So, what questions should owners, managers and board members be asking?
I think many get bogged down in the technicalities of IT and don’t consider it in business terms. They don’t think about the business impact of cyber security, about what it is they’re trying to protect. It’s not your IT systems, it’s your data that is the crown jewels. IT systems can be replaced, that’s what your insurance is about, but once the data is stolen, then you are in very real trouble.
Risk Management
Talking of insurance, that’s perhaps how you should be viewing Cyber Security solutions. Don’t think tech, think protecting the business. First and foremost, the board members need to ask themselves if they have a good handle on their cyber risk. Have they identified their cyber assets? What is a cyber asset? Cyber assets are not just hardware and software, in fact those are the least of your worries. It’s the data, where it is and how it’s protected that is important. Have you assessed the risk to those assets? Have you assessed the training requirements for your staff, not just the techies but all staff? Think People, Process and then Technology.
Once you have done this, then you can consider what controls need to be put in place to reduce the risk to an acceptable level.
Below is some of the controls you will need to consider. This list is not exhaustive
1. User Access Control (Admin access is a whole other discussion)
This isn’t just about passwords. Yes, they remain important but on their own, they are no longer sufficient. Nonetheless weak passwords, password re-use and password sharing remain one of the leading root causes of a data breach. 123456 and, believe it or not, password, remain the most used passwords across the world!
It is imperative that you have a strong password policy, dictating not just the length of the password, but also its construction, ensuring that there is a good mix of upper and lower case characters, numbers and symbols, that together make things very difficult for password crackers.
On their own though passwords remain a potential weak spot. Multi factor authentication (MFA), sometimes referred to as 2FA, provides that extra layer of defence and can help to protect against brute-force attacks, phishing scams, key-logging and social engineering. MFA can be simply implemented on most email platforms and within various apps you are using. For those of you trying for Cyber Essentials or ISO 27K series, MFA is mandatory, so make sure it’s put in place.
2. Are you backing up your files?
This seems an obvious thing to do but you’d be surprised how often when trying to restore from a backup, it fails. This is often because the backup routine was set up back in the mists of time and has never been reviewed and even more dangerous, it’s never been tested to see if it works. Set up your backup regime, have it reviewed regularly and tested regularly to make sure it works. If you are backing up online, keep in mind that if a cyber-criminal gets access to your systems to, for example, carry out a ransomware attack, then they can probably get at your back up as well. So, belt and braces, consider having an offline backup as well as an online backup. The latter is more convenient but is vulnerable.
3. Do you train your staff in cyber awareness?
My favourite subject – cyber awareness training. Your first line of defence is your staff, but if not trained adequately, they can be your biggest weakness. It’s known in the trade as the insider threat, but it is caused mainly by human error, staff members doing something they shouldn’t, not maliciously but simply because they didn’t know they shouldn’t. It accounts for 88% of data breaches. Providing your people with training on the threats, current scams and basic cyber awareness reduces the chance of a cyber-attack. This really is the easiest and cheapest quick win any organisation can take in reducing their risk exposure.
4. Do your employees regularly travel or work remotely?
This brings us neatly to what Microsoft coined as the New Normal. Essentially this means remote working shared with in office working, known as the hybrid working model, or for some, moving to a totally remote working system. Totally remote is not as common as hybrid working but is becoming more normal with certain size businesses in certain commercial verticals. It’ll never work for everyone, but for those who have embraced it, it saves a considerable amount of expense. It does however require us to rethink our cyber strategy.
Work-from-home employees are at much greater risk than those in offices. Since home connections are less secure, cybercriminals have an easier entry into the company network. Furthermore, the explosion of various online tools, solutions, and services for collaboration and productivity tend to have the bare minimum of security default setting, and updates from third-party vendors can change security preferences and be easily overlooked.
Phishing becomes an even greater threat to home workers, often because, in an office environment, they have access to colleagues and managers, who they can approach for advice and guidance. This is much harder to replicate with remote workers, especially those who may not be particularly tech savvy and who may not wish to become ‘burdensome’ to their co-workers.
Ransomware also enjoys an advantage in the work-from-home model. If their connection to the company is blocked, it is more difficult for workers to get assistance from the right experts and authorities. And since trust levels are lower when working from home, some workers will be concerned that they have “done something wrong” and so may be more reluctant to seek help. While this risk can be addressed by increased training, as well as messaging that vigilance and involving IT support will be rewarded, it can still be an uphill battle.
We need to break out of the old ‘bastion’ security model of a network protected by firewalls and other technologies and think about solutions that are designed to protect your assets regardless of where your employees work from. They exist and aren’t hard to find.
5. Where is all your data stored and who has access to it?
Data tends to proliferate, especially when working remotely. Cyber awareness training helps here, but it also helps for management to have a handle on data storage. All organisations have this problem, but it becomes more acute for those businesses that hold large amounts of what is known as Personal Identifiable Information or PII. This is information that can identify a living individual and compromise their privacy in some way. Financial advisors, estate agents, solicitors etc, all share this issue. The data protection act, becoming referred to as UK GDPR, is not a suggestion, it is law.
One of the biggest issues we find with organisations of all sizes, is that they think they know where all their data is but get quite a surprise when they discover multiple instances of the same data set. This has become a real issue in that the new normal tempts users when working remotely, with possibly less than robust broadband, to copy data from cloud storage to their PC or laptop to ensure they can keep working on it. Then they upload it again when they’ve finished but forget to delete their copy. That’s just one instance but it is vital to understand where all this data is. What if for instance, you get what is known as a subject access request, where a client or other member of the public wants to know exactly what personal data you have on them, and why. I spoke to a financial advisor not long ago who told me that it took one of their partners off the road for 3 weeks, to discover where all the data was kept on just one person. But under the law, they had no choice but to bite the bullet.
There are several systems on the market which will help with this but what most need now is a system that works regardless of the location of the user and continues providing that cover when the user moves from one location to another. This is just a suggestion, but we’d be delighted to demo it to anyone who is interested. https://hah2.co.uk/gdpr-data-protection/
6. Disaster Recovery and Business Continuity
Business Continuity refers to the proactive strategies and plans put in place to ensure that essential business functions can continue in the event of a disruption or disaster. This could include natural disasters, cyber-attacks, power outages, or any other event that could disrupt normal business operations. Business Continuity planning typically involves identifying critical business processes, implementing redundant systems and processes, and developing communication plans to ensure that the organisation can continue to operate smoothly in the face of adversity.
Disaster Recovery, on the other hand, is focused specifically on restoring IT infrastructure and data after a disaster has occurred. This could involve recovering lost data, restoring systems and networks, and ensuring that IT operations can resume as quickly as possible. Disaster Recovery planning typically involves creating backup systems, implementing data recovery procedures, and testing these plans regularly to ensure they are effective.
Both are critical components of a comprehensive risk management strategy and should be integrated into an organisation’s overall resilience planning efforts.
Just like backups, which are a crucial part of Disaster Recovery, these plans can become very quickly out of date and useless, unless reviewed periodically and tested to see if they work.
7. Vulnerabilities and Threats
A vulnerability is a flaw or weakness in an asset’s design, implementation, or operation and management that could be exploited by a threat. A threat is a potential for a cybercriminal to exploit a vulnerability. A simple way to explain this is that a vulnerability is the inability to resist a hazard or to respond when a disaster has occurred. For instance, people who live on plains are more vulnerable to floods than people who live higher up. The threat is the flood itself.
IT risks and vulnerabilities are the potential threats and weaknesses that can affect the performance, security and reliability of your business function and processes. They can have serious consequences for your business goals, customer satisfaction, and competitive advantage.
Identifying vulnerabilities to your cyber security assets and then identifying the threat to those assets in terms of the vulnerability being exploited, informs your risk and enables you to assign a value to it. Financial value can be assigned to the risk score if you so wish. You then apply controls to bring the risk down to an acceptable level, starting with the Very High risks, and then bringing them down to whatever is acceptable to you. That acceptable level, known as the risk appetite, will vary business to business, risk to risk.
8. Supply Chain Security?
In short, a supply chain attack is a cyber-attack that seeks to damage an organisation by targeting less-secure elements in the supply chain.
An example of such an attack was published by NCSC and points out that many modern businesses outsource their data to third party companies which aggregate, store, process, and broker the information, sometimes on behalf of clients in direct competition with one another.
Such sensitive data is not necessarily just about customers, but could also cover business structure, financial health, strategy, and exposure to risk. In the past, firms dealing with high profile mergers and acquisitions have been targeted. In September 2013, several networks belonging to large data aggregators were reported as having been compromised.
A small botnet was observed exfiltrating information from the internal systems of numerous data stores, through an encrypted channel, to a botnet controller on the public Internet. The highest profile victim was a data aggregator that licenses information on businesses and corporations for use in credit decisions, business-to-business marketing, and supply chain management. While the attackers may have been after consumer and business data, fraud experts suggested that information on consumer and business habits and practices was the most valuable.
The victim was a credit bureau for numerous businesses, providing “knowledge-based authentication” for financial transaction requests. This supply chain compromise enabled attackers to access valuable information stored via a third party and potentially commit large scale fraud.
OK, it was over 10 years ago, but don’t think it won’t happen again.
NCSC also cited what is known as a watering hole attack, which works by identifying a website that’s frequented by users within a targeted organisation, or even an entire sector, such as defence, government, or healthcare. That website is then compromised to enable the distribution of malware.
The attacker identifies weaknesses in the main target’s cyber security, then manipulates the watering hole site to deliver malware that will exploit these weaknesses.
The malware may be delivered and installed without the target realising it (called a ‘drive by’ attack) but given the trust the target is likely to have in the watering hole site, it can also be a file that a user will consciously download without realising what it really contains. Typically, the malware will be a Remote Access Trojan (RAT), enabling the attacker to gain remote access to the target’s system.
If you are in someones supply chain, then you need to make doubly sure that your security protects your customer as well as yourself. And conversely, if you are connected electronically to someone who supplies you, are you sure that you are protected from any vulnerability they may have.
H2 provides affordable and flexible one-off and ongoing data protection and cyber risk protection services.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
Recent Comments