I frequently share insights on the significance of Cyber Awareness Training and its critical role in helping organisations defend against cybercrime. Cyber awareness training is a vital aspect of contemporary security strategies for everyone. It provides employees with the essential knowledge and skills needed to identify, respond to, and reduce cyber threats. This training is particularly effective in combating social engineering.
While many people are now familiar with the term social engineering, they may not fully understand its meaning. In the context of cybersecurity, social engineering involves manipulating, influencing, or deceiving individuals to gain unauthorised access to IT systems or to steal personal and financial information. It employs psychological tricks to lead users into making security errors or divulging sensitive data. The most prevalent form of social engineering is phishing.
Social engineering heavily relies on the six Principles of Influence identified by Robert Cialdini, a behavioral psychologist and author of “Influence: The Psychology of Persuasion.” These six principles are: Reciprocity, Commitment and Consistency, Social Proof, Authority, Liking, and Scarcity. Simply put, what these criminals seek is information, login credentials, passwords, names, phone numbers, and more. They are profiling your organisation to identify vulnerabilities, such as who manages accounts payable or whether you have an IT support company under contract that they could impersonate. In addition to phishing, they utilise various forms including vishing (voice phishing), smishing (SMS phishing), and simply calling to ask questions.
A rising threat that criminals are increasingly adopting is help desk social engineering tactics. In these schemes, attackers call an organisation’s IT help desk while posing as a legitimate employee, trying to convince the help desk agent to reset passwords or multi-factor authentication (MFA) for a specific account.
In recent years, this technique has been used to access single sign-on (SSO) accounts and cloud-based application suites. Multiple criminals adopted this approach in 2024, targeting academic and healthcare institutions; in these cases, attackers utilised compromised identities to extract data from cloud-based software as a service (SaaS) applications or alter employee payroll information.
IT help desks typically require employees requesting password and MFA resets to provide their full name, date of birth, employee ID, and manager’s name or answer a pre-set security question. However, cybercriminals attempting to socially engineer help desk personnel often answer these questions accurately. Much of this information is not confidential and can be found in public resources and social media sites. The dark web frequently harbours data that should remain private. At H2, we continuously scan the dark web for our clients to uncover any exposed information.
Often, help desk social engineering calls occur outside of regular working hours. This tactic allows criminals to maintain access to compromised accounts for longer periods before the legitimate account owner detects any suspicious activity. Attackers using this method may register their own devices for MFA to secure ongoing access to compromised accounts. They also frequently delete emails from compromised mailboxes related to suspicious account activities or configure mail transport rules to redirect relevant emails away from the main inbox.
Over the past year, several criminals have openly sought callers on popular forums. Advertisements typically call for English-speaking individuals familiar with RMM tools and experienced in conducting remote sessions. Some criminals are also exploring effective ways to spoof phone numbers or encrypt calls, ensuring caller IDs appear more credible. This trend suggests that phone-related social engineering will pose a significant threat in 2025 as demand for these capabilities increases.
So how can we combat this? I began with cyber awareness training, and I’ll conclude with it as well. When your staff, regardless of their technical expertise, understand what social engineering is and its intentions, they are much more likely to recognise it when it occurs. Simple practices such as asking unknown callers to call back using a verified number instead of one provided by the caller can make a difference. If you receive an email from a senior manager or board member that seems suspicious, open a new email thread for confirmation rather than replying directly, this helps avoid potential spoofing by scammers masquerading as legitimate sources. And of course, never click on links!
Cyber awareness training doesn’t need to be costly; it can be delivered face-to-face, online, or through automated means. At H2, we offer all these options! Regardless of your choice, please consider this training an essential component of your strategy.
There’s a lot being said in various quarters about the Internet of Things (IOT) but whenever it comes up in conversation with senior people in the SME world, even those businesses that are in the medium bracket, with significant numbers of employees, it raises a titter or two.
So, what is it and why would that be? According to Wikipedia IOT describes devices with sensors, processing ability, software and other technologies that connect and exchange data with other devices and systems over the Internet or other communication networks. The IOT encompasses electronics, communication, and computer science engineering and encompasses a vast array of devices — from household appliances to industrial equipment — all connected online. These devices often lack robust security features, making them susceptible to attacks. Common vulnerabilities include insecure firmware, weak authentication protocols and unsecured network services. For example, IOT devices can be compromised to create botnets that launch massive Distributed Denial of Service (DDoS) attacks. As the IOT continues to grow, securing these devices becomes increasingly critical, necessitating the development of new security strategies that encompass IOT.
IOT in a nutshell then, does not just refer to everyday household items that have a processor and remote capability, but also systems within your business. For instance, if you can turn on your lights, start a cooker going, turn on the kettle etc, all from your phone on your way home, you can do the same on your way into work. And of course, we have Siri, and Alexa amongst other systems, all interconnected in some way in your home, and increasingly, in your office, and to the internet.
Whenever it’s discussed all the usual lighthearted comments about being hacked by your kettle, or held to ransom by your toaster, come out in the conversation. And there is some amusement to be had. But there is a serious side to this.
Increasingly now we are seeing smart appliances in the workplace, that could be used to jump onto the more serious elements of a network, we are already at a place where some functions, perceived as routine, even mundane, can already be used to jump onto other network devices. For instance, most have security cameras and alarm systems. Many of these are IP based and are connected via the LAN. OK, but many also are remotely maintained by a variety of suppliers. I have found it not uncommon for these suppliers to arrange for their own backdoor into the system to maintain these systems, often without the client knowing how that is done. This provides a very neat circuit around the router and firewall and, when most SME networks are flat, access onward to all parts of the network. A flat network refers to a network that is unsegmented ie all devices are attached to a single WIFI or wired network with no further network protection once through the gateway.
This of course is not the only example, but it shows how poor security architecture, often times by local network providers, can have a quite seriously detrimental effect. So, what I am saying is that as many more devices become ‘smart’ and interconnected via the LAN, security architecture becomes just as important for the SME as it does for the larger enterprise. The problem is that the awareness and support within the SME community and their suppliers, tends to be lacking.
These days we have to add in the move towards remote working, either full or part time, and the increasing use of AI, which adds many other threats to your systems, and I have explored these in other blogs, which you can view on my website, https://hah2.co.uk/news/. How many of your staff, using their home WIFI to connect to your company systems, also have IOT devices connected to the same WIFI router that they are using to connect to you? How are you managing that risk? Or are you?
Cyber Security continues to be, all too often, treated as an IT issue. Now this is a drum that cyber security professionals have been banging for a long long time. Cybersecurity is NOT and IT issue, it is very much a business issue. But we do struggle to get that across, particularly in the SME market who continue to view it as purely technical in nature.
Now, whilst I’m not always enthusiastic about the stats and reports that are published, simply because they tend to be industry publications with the authors often having an axe to grind but they can make some very good points. Let’s look at some key challenges being encountered:
Cybersecurity spending appears to be slowing (although that depends on who you speak to), while boards are starting to push back and ask what they have achieved after years of heavy cybersecurity spend.
Boards and senior executives are asking the wrong questions about cybersecurity, leading to poor investment decisions.
Many current approaches to improve cybersecurity are falling short of providing appropriate and defensible levels of protection.
SMEs are invariably focused on cost, which means optimising their spend to ensure that they get the biggest bang for their buck, to coin a phrase. However, time and again we see that they have spent, sometimes considerable, sums on technology without actually understanding what risks that technology is there to mitigate, therefore having no real idea if it is doing what they have been told its doing. The amount of money they are spending is of course relative. To a small business the sum invested might be a minor consideration to a much larger business. So, it becomes crucial that the mitigations put in place are appropriate to the risks they are there to mitigate.
This comes down to another drum we like to beat, that of risk management. Below is a link to a short video which explains the risk management process as it appertains to cyber security. Look at it with the view that it can be a matter of scale, and the smaller businesses may not need to go through the whole process but will need to go through much of it.
Note the I use the term mitigate rather than prevent. That’s simply because eradication of risk is simply not possible if you are going to continue to do business. The best you are going to achieve is to mitigate that risk to the lowest level achievable without getting in the way of business.
Let’s consider the following challenges and impacts:
Challenge
Impact
Societal perception of cybersecurity is that it is a technical problem, best handled by technical people, although that tends to be amongst the SME community. There is evidence though that that is changing slowly.
Societal perception is dominated by fear, uncertainty and doubt. It results in poor engagement with between management and suppliers, unproductive exchanges and unrealistic expectations. Ultimately, it leads to bad decisions and bad investments in cybersecurity.
Organisations are focused on the wrong questions about cybersecurity. The question of what do I need to buy to secure my data is asked rather than what do I need to secure and what is the priority.
Unproductive questions are indicative of poor understanding, and drive attention away from an improving that understanding and therefore drive better investments.
Current investments and approaches designed to address known limitations are not productive.
Many SMEs focused on technology and have a poor understanding of cyber risk management. This is often compounded by an equally poor understanding within the IT management company’s they often outsource to. This leads to a combination of poorly scoped solutions and all too often failed execution and unrealistic expectations.
Real failures are not getting enough attention to productively change behaviour.
Compliance with any regulation does not equal appropriate levels of protection.
Now, whilst some of these impacts may not be a 100% fit for many SMEs, particularly at the smaller end of the bracket, they are close enough to be taken very seriously indeed. Poor decisions are being taken every day in regard to the purchase of hardware and software to protect against cyber threats, without having carried out any kind of risk assessment to actually understand what risks they are trying to mitigate. End result, an investment in technology that on its own, will not prevent many of the cyber threats that abound today, coupled with a false sense of security.
A competent cyber security professional will approach the problem from the point of view of People, Process and Technology, understanding that many mitigations require a combination of 2 or 3 of those to provide an adequate response to the threat. For many SMEs, one of the biggest and quickest wins they can achieve is cyber awareness training for their staff. If their staff are aware of the issues, they have a much greater chance of recognising a scam, a phishing attack, an attempt at social engineering etc. And oftentimes such things can be mitigated by sound policies and processes. All of this prior to even considering spending money on technology. However, the very first thing that should be considered is to undertake a risk management process to identify the threats and vulnerabilities inherent in the business, thus enabling the risks to be identified and working out what mitigations are needed to drive the risks down to an acceptable level. SMEs almost never do this and it is a fundamental mistake.
Barely a week goes by without the remote working v office-based argument surfaces somewhere, usually it must be said, at the corporate level, although many SME owners remain nervous of it, with others downright against it. My client base appears to be largely OK with a hybrid model of working and only one is 100% remote based, having given up their office.
The COVID pandemic was the catalyst for this with businesses of all sizes being forced to transform their operations to support remote work and by and large have done well, but not without many challenges, including video conferencing burn out, (along with wishing they’d taken out shares in Zoom!!), and a yearning to work together in person again, someday. We all realise that group working, face to face, is often necessary not just for efficiency, but because we are social animals. Experience has taught many businesses many things but are often still struggling with the potentially dire consequences in terms of cyber security and data protection.
I should perhaps mention that in the corporate IT world, where I worked for many years for major system integrators like HP, hot desking and remote working was introduced in the early 2000s and therefore this was no problem for us.
A distributed work environment i.e., personnel spread around various locations, office, home working, even the local coffee shop, creates critical challenges and new security threats as a result. The speed with which this has happened has meant that many simply did not take cyber security issues into account and if they did, thought, well, this is temporary, and it won’t matter in the long run. Well perhaps, but as many are now finding, there have been advantages to home working, not least a lowering of costs in terms of how much office space is needed to carry out the business function. Many are now looking at Hybrid working i.e., from home with a day or two in the office during the week. There are pros and cons to this outside of the scope of this article, and businesses will have to make their own judgements, but one thing is clear and that is that businesses need to understand the risks now inherent in distributed work and need to get better at cyber security and data protection, in those environments.
Employees when remote working, are at much greater risk than those in offices. Since home connections are less secure, cybercriminals have an easier entry into the company network. Furthermore, the explosion of various online tools, solutions, and services for collaboration and productivity tend to have the bare minimum of security default setting, and updates from third-party vendors can change security preferences and be easily overlooked.
Phishing becomes an even greater threat to home workers simply because, in an office environment, they have access to colleagues and managers, who they can approach for advice and guidance. This is much harder to replicate with remote workers, especially those who may not be particularly tech savvy and who may not wish to become ‘burdensome’ to their co-workers.
Ransomware also enjoys an advantage in the remote working model. If their connection to the company is blocked, it is more difficult for workers to get assistance from the right experts and authorities. And since trust levels are lower when working from home, some workers will be concerned that they have “done something wrong” and so may be more reluctant to seek help. While this risk can be addressed by increased training, as well as messaging that vigilance and involving IT support will be rewarded, it can still be an uphill battle.
In a study carried out by Entrust it was clear that many organisations are grasping the concept of cyber awareness training, although there are still too few amongst SMEs that take this on board. Of those who responded to Entrust:
94% said employee training has a positive impact on data security.
95% agreed that they trust remote employees to comply with data security best practices and training.
93% said they felt positive about the impact data security training had on them.
Of course, this was a sampling and only 61% of employees said that their company offered training.
Whatever system of hybrid you are proposing to use, or are using, it is clear that you will need to go beyond baseline security measures. In this case we are almost certainly dealing with baseline protections such as multi-factor authentication, known as MFA or sometimes 2FA, and virtual private networks (VPNs). Both have their place and will be needed.
The Entrust report cites a contradiction here, and it’s one I have also noted. Many company owners/directors say they believe company data is protected with these baseline solutions, yet they also say that home internet connections, leaked sensitive company information and cyber-attacks are their top concerns.
If organisations are going to use hybrid work models successfully over the long term, then they will need to further invest in their security strategy. MFA and VPNs, while important, should be seen as part of a larger strategy for data security in a hybrid work model. Throughout and beyond the pandemic, bad actors have exploited security deficiencies of remote environments such as insecure home tech hardware, poor password hygiene and employee use of unapproved tools.
If you are going to adopt this new normal, or already have adopted it, then the process must start with understanding your risk posture which will inform you of what measures you need to take to secure your data. Below is a link to a short video explaining cyber risk management, at least at a high level.
Once you have a clear understanding of what your risks are, then you might like to consider a zero-trust approach to data security.
With employees having the ability to work anywhere in a hybrid environment, the office perimeter is no longer relevant to digital security. Zero Trust frameworks are designed to apply the concept of least privileged access to people, systems and devices, giving these entities only the access they need to fulfil their role and nothing more. Additionally, a Zero Trust approach continually monitors user and device behaviour to identify suspicious patterns and take preventive action, including a step-up authentication challenge.
You may need to consider other protections such as:
Passwordless single sign on involving Privileged Access Management (PAM) to facilitate a Zero Trust approach.
Data Loss Prevention. Whilst a VPN will protect your data in transit, file level encryption ensures that it is protected at rest, at both ends of the tunnel, so that if it does get stolen or otherwise compromised, the impact is severely lessened. There is more information in the short video below.
Protective Monitoring. This has long been considered too expensive for an SME. Well, no longer, there is now a system which is effective and affordable and is explained in the video below.
Investing in cyber awareness training is crucial, especially for SMEs who tend not to have the expertise and resource at their fingertips, to protect themselves against cyber-attacks and scams. Cyber threats are constantly evolving, and smaller businesses are often prime targets for attackers due to perceived weaker security defences. Your staff are key, they are the first line of defence, and potentially, your biggest weakness. This means they must know what the threats are and what simple steps they can take to protect the business.
Here are some key reasons why an SME should be seriously considering a cyber awareness training programme for their staff:
a. Protect Against Cyber Threats
SMEs face risks from phishing, ransomware, and social engineering attacks. Training helps employees recognise and respond to these threats before they cause harm.
b. Reduce Human Error
Most cyber incidents result from human mistakes and are not malicious in nature. Cyber awareness training can significantly reduce mistakes such as clicking on malicious links or using weak passwords. Training teaches employees what security best practice means and how to adopt it.
c. Ensure Regulatory Compliance
Many industries have data protection laws (e.g., GDPR) and other industry led regulations (PCI, FSA etc) that require businesses to safeguard customer data. Cyber awareness training helps SMEs comply with these regulations and avoid fines and reputational damage.
d. Protect Business Reputation
A data breach can damage customer trust and brand reputation, potentially leading to lost business. Proactive cybersecurity measures, including training, help maintain credibility.
e. Minimise Financial Losses
Cyber incidents can lead to financial losses from fraud, legal fees, downtime, and recovery costs. Investing in training is a cost-effective way to mitigate these risks.
f. Strengthen Overall Security Culture
When employees understand cybersecurity risks, they become an active part of the defence strategy, fostering a security-first mindset across the organisation.
g. Improve Incident Response
Trained employees can quickly identify and report security incidents, enabling faster response times and reducing potential damage.
h. Stay Competitive
Many clients and partners prefer working with businesses that prioritise cybersecurity. Demonstrating a commitment to security can be a competitive advantage.
Awareness training doesn’t need to cost that much, and it can be delivered classroom based, either on site or online, or it can be automated. The latter is often the preferred platform for an SME.
Let’s take a look at the pros and cons of each method of delivery.
Classroom-Based Training
Pros:
Interactive Learning – Employees can ask questions, engage in discussions, and get real-time feedback.
Customisable Content – Trainers can tailor content based on specific organisational threats or employee skill levels.
Higher Engagement – In-person or live virtual sessions often result in better engagement and knowledge retention.
Hands-on Practice – Allows for simulations, group exercises, and real-world case studies.
Time-Consuming – Employees must take time away from work to attend sessions.
Scalability Issues – Difficult to train a large workforce across multiple locations.
Inconsistency – The effectiveness may vary depending on the instructor’s expertise and teaching style.
Automated Training (often AI-Based)
Pros:
Cost-Effective – No need for in-person instructors or travel costs.
Scalable – Easily deployed across an entire organisation, including remote employees.
Flexible Scheduling – Employees can complete training at their own pace.
Consistent Content Delivery – Ensures all employees receive the same training material.
Trackable Progress & Reporting – Automated platforms provide analytics on employee performance and compliance.
Cons:
Limited Engagement – Lack of real-time interaction may result in lower retention.
Generic Content – May not always address specific threats or industry-specific risks.
No Immediate Feedback – Employees may not have an opportunity to clarify doubts in real time.
Potential for Click-Through Learning – Some employees might rush through without fully absorbing the information.
Which one is better? This is somewhat subjective and will depend very much on the type of business you are, your budget and expectations. Generally:
For organisations needing high engagement and tailored content, classroom-based training is ideal.
For large, distributed teams or cost-conscious businesses, automated training is more practical.
A hybrid approach, combining both methods, often works best—using classroom sessions for deep learning and automated modules for ongoing reinforcement.
Here at H2 we can offer both classroom based, in person or on-line, as well as an automated programme which can include induction courses and continual reinforcement. This of course if the more cost effective solution for many SMEs.
…. or let’s call it GRC because it is a bit of a mouthful. Two questions arise, firstly what does it mean, and secondly, does it really apply to SMEs?
To answer the first question GRC is a program that comprises those elements which, governed by the cyber-security strategy, provide cyber-security risk assessment, generate appropriate cyber-risk management policies and controls, and enable measurement of compliance with those policies and controls. Let’s not forget those controls required by regulatory compliance which are required by legal and regulatory bodies.
Governance is the process which dictates policy in line with the cyber-security strategy. Governance ensures that the organisation’s cyber-security policies are generated, adopted and amended within an organisation. Governance may be derived from both internal requirements (e.g. audit, board direction, information security) and external sources (e.g. statutory and regulatory requirements).
Risk management is the process by which risks are evaluated in light of business requirements – and the organisation’s risk tolerance or appetite. Risk management and mitigation policies and controls are then designed to achieve an acceptable level of risk to the organisation’s finances, data, reputation etc. The policies and intensity and number of the controls must be balanced against their cost and budgetary considerations, as well as the acceptable level of residual risk remaining once all controls have been implemented. Risk management is also the means by which new risks from emerging threats and new business opportunities are assessed and reduced to an acceptable level.
Compliance is the process by which adherence to risk management policies and controls are measured and gaps are identified. This function is performed by various individuals and teams, including internal audit, risk assessment teams, external regulatory agencies and third-party organizations.
OK, so far so good, but isn’t this all a little over the top for SMEs. Well yes and no. Firstly, every business must comply with the statutory regulations laid down by government and the requirements for governance laid down by various industry standards. PCI is a good example of the latter. If you don’t comply to PCI DSS standards, you simply won’t be allowed to take credit card payments. Maybe not important to all businesses, but it is to many.
Secondly, it is a matter of scale. Everyone in business does some form of risk assessment during the working day – is it safe to take this person on? Is this a good bit of business to acquire or is it too risky? Do we need to diversify? Etc. Even if your risk assessments aren’t formal and you are doing them on the fly, they are still relevant to your business. Cyber Security is no different. Your cyber assets, and in this case, we often mean your data, need to be risk assessed, ie assessing the risk to the business if it all goes pear shaped, and then the right controls applied. This falls under GRC.
So, what kills GRC in business? It’s often a lack of communication and understanding. The lack of understanding comes from not having the relevant expertise to talk to, and I’m not referring to IT techies. They are great at keeping your systems working, be they an in-house resource or a managed service IT company under contract. But they are not cyber security professionals. The latter is a skill set recognised in the industry with its own qualifications and career path.
The lack of communication comes in when you have the relevant expertise to hand, usually outsourced, but the board is simply not listening to what they are being told. So why is that? Well, a big mistake made by some cyber security people is being too technical and speaking in jargon. It doesn’t work and turns people off. When putting across an argument it must be in plain English and be business focused. Management has to see some form of ROI, even it that ROI difficult to measure, based as it probably will be on proving a negative, ie the controls are working because we haven’t been hacked, as opposed to, we haven’t been hacked so we don’t need to budget for this. Another example is talking about phishing, ransomware, hacking etc, when the business wants to hear about insider fraud and intellectual property theft.
My regular readers will be aware of my adherence to the KISS principle – Keep It Simple Stupid. So overly complex GRC tools and solutions won’t work with SMEs regardless of where they sit on the totem pole, either at the lower end of Small up to the higher end of Medium. All GRC principles must be scaled accordingly, and any practitioner used to evaluate your GRC issues must have a firm grasp of the business and apply GRC principles to support that business in a way that the management can immediately see its value. Not easy but very much doable.
When working for HP I had 2 teams, one was techie and the other, focused on GRC, was not so techie and I kept that separation as it was very important.
I am always happy to have a conversation around this subject.
Today is a typical January day, cold, wet and miserable. I really didn’t feel like getting out of bed but hey, not a lot of choice until I become a multi-millionaire and pay someone to get out of bed for me – I wish. I’m starting the day with a large coffee from Costa to try and kick start my creative juices and get this blog written. And no, I’m not writing it in Costa, it’s a takeaway. I’ve written several pieces on the dangers of insecure coffee shop WIFI.
Those of you who have managed to plough your way through some of my earlier stuff, will know that I am very big on user awareness training for staff at all levels, believing as I do, that it is arguably one of the quickest wins that an SME can make, to protect themselves against cybercrime. There is however a very close second, and that is identity and access management.
Before I get into that, let’s talk a bit about Zero Trust. You might have heard the term but what exactly does it mean? Zero Trust architecture is a security concept that emphasises the importance of continuous verification and strict access controls within a network environment. It operates on the principle of “trust no one” and assumes that no user or device should be inherently trusted, even if they are within the network perimeter. Instead, Zero Trust focuses on authenticating and authorising every access attempt, regardless of its source or location.
In a Zero Trust architecture, access controls are implemented based on various factors, such as user identity, device health, location, and other contextual information. This approach helps prevent lateral movement within a network, reduces the impact of potential breaches, and improves overall security posture.
Zero Trust architectures typically employ technologies such as multifactor authentication, encryption, micro-segmentation, and continuous monitoring to enforce access controls and detect anomalous behaviour. By adopting a Zero Trust mindset, organisations can enhance their security defences and better protect against modern cyber threats.
Getting back to Identity and Access Control, there is mounting evidence that the message is getting through that, although passwords are very important, they most certainly aren’t the panacea that many think they are. We can see many organisations moving to 2 factor authentication as a norm now. In fact, if you want to be accredited to Cyber Essentials or ISO 27001, it’s a requirement without which you won’t pass. A charity I volunteered for has done just that and not before time, considering the amount of personal data they are holding. But is that enough?
Compromised credentials are very high on the list of cybercrime related incidents that we see and have to deal with. Protecting these identities can be a very technical issue and advice and guidance will be needed to ensure that you are adequately covered. However it needn’t be overly expensive, neither need it be overly complicated. In fact, I’m a great believer in that the simplest solution is often the best solution. I’m an adherent of the KISS principle – Keep It Simple Stupid.
Questions to ask yourself include:
Are your user accounts configured with the minimum level of privilege they need to do their job?
If an employee needs additional privilege to carry out a one off job, how do you ensure that once it’s completed, the privilege is revoked?
What is a privileged account? Typically it’s someone who needs additional privileges as part of their daily tasks, such as adding/removing users, auditing actions, access to more secure areas of the network (finance, management data etc), etc etc. Are you limiting by policy the roles within your organisation that need privileged accounts, and are you specifying explicitly what those privileges are, by role?
Are your privileged accounts subject to greater levels of auditing and scrutiny?
Do you have a joiners and leavers process to manage active accounts?
Do you have a movers process ie employees that change roles and require different levels of access to carry out their new role, either adding or removing privilege?
Another issue that you may need to consider is any accounts that exist on your network that may be used by third party suppliers. Many companies use ‘just in time’ supply management which can require third parties to have access to their network. Another example is people like me who, when carrying out things like vulnerability assessments, may be given privileges to scan the network. Is that revoked at the end of the scan? And of course, there is the IT company you may have under contract who actively have access to your network to carry out maintenance and might actually also have a contract for controlling user privilege. Or perhaps the company you have under contract maintaining your alarms and security cameras which you didn’t know were actually using your network to connect to each other and their control room.
What about logging? What is logging? Every system has a set of logs which can be switched on or off. I often come across networks where logging has been switched off or never activated because its consider to be an overhead you can live without. Well, I disagree with that, quite vehemently. Logging helps you to determine what normal looks like. For example user profiles carry out certain functions within their role. If a user is stepping outside of that profile, you need to find out why. Is it a user who is doing something they simply didn’t realise they shouldn’t, or is it something more serious? Is it an identity that has been created or hi-jacked by a cybercriminal who has managed to gain access? Examination of these logs will help you understand that. There is of course software on the market that will be of great help with this. And of course, what do you do if you are suspicious of an activity or action by a user?
This is a big and crucial issue that deserves attention, more attention that a short blog like this can give it. So if you would like more information, we would be happy to oblige.
I’ve been talking recently about the relationship between IT and cyber security budgets for SMEs and I mentioned that at one time, the recommendation was that 5% of IT budgets be put aside for security. Well, that figure has gone up year on year and is now about 15%. Of course, these percentages work well in the corporate market where IT budgets can run into the millions, but in the SME world, where budgets are tiny in comparison, the percentages don’t work quite as well. After 15% of very little, is very little.
So where does that leave us? We still have to budget, failing to plan is planning to fail – how’s that for a nice bit colloquialism. Budgets are necessary. IT whether hardware or software, doesn’t stand still, it moves forward rapidly and the hardware you bought two years ago will often struggle to run some of the software upgrades, and those upgrades themselves come thick and fast.
Cyber security is no different. We have to contend not only with those software implementations, many with vulnerabilities already present, but with cyber criminals who are always pushing the boundaries. We play catch up. We always have and probably always will.
So what are we budgeting for? SMEs face several challenges in implementing adequate cybersecurity defences. These challenges arise due to resource constraints, lack of expertise, and evolving threats. Some of the biggest issues are:
Cybersecurity tools, training, and infrastructure
Inadequate funding for the above. SMEs will naturally prioritise business growth and operations over cybersecurity investments.
Lack of Expertise
SMEs often lack dedicated cybersecurity personnel or in-house IT teams. Limited access to experienced professionals makes it difficult to implement and maintain robust security measures.
In adequate or lack of cyber awareness and training
Employees may lack awareness of cybersecurity risks and become easy targets for phishing or social engineering attacks.
Insufficient training on best practices, like identifying suspicious emails or handling sensitive data securely.
Underestimation of Risks
Many SMEs believe they are too small to be targeted, making them complacent.
Attackers often target SMEs precisely because they assume SMEs are less secure than larger companies.
Rapidly Evolving Threat Landscape
Cyber threats like ransomware, phishing, and zero-day exploits are constantly evolving.
SMEs struggle to stay updated with new technologies and threats.
Outdated Technology
Reliance on legacy systems or software that lacks regular updates or patches.
Limited investment in modern security tools, such as firewalls, endpoint protection, or intrusion detection systems.
Third-Party Risks
SMEs often rely on third-party vendors or service providers, which can introduce vulnerabilities. Don’t assume that your IT vendor has a grip on security – they are often as ill-informed as you are.
A breach in one partner’s system can cascade down to the SME.
Compliance Challenges
SMEs may not have the resources to understand or comply with cybersecurity regulations (e.g., GDPR, CCPA, PCI DSS).
Non-compliance can result in fines or penalties, exacerbating financial pressures.
Insufficient Incident Response Plans
SMEs often lack a formal incident response plan to handle breaches or attacks.
Without predefined protocols, responses to incidents are slower and less effective.
Shadow IT
Employees may use unauthorised software or devices without IT approval, creating vulnerabilities.
Shadow IT can bypass existing security measures.
Supply Chain Attacks
Cybercriminals target SMEs as an entry point to larger companies in their supply chain.
SMEs often lack robust controls to mitigate supply chain risks.
Difficulty in Accessing Cyber Insurance
Obtaining cybersecurity insurance can be difficult or expensive for SMEs, especially if they lack basic protections.
Insurers often require proof of a certain level of security maturity.
These days addressing these challenges requires SMEs to adopt a combination of cost-effective solutions, such as managed security services, regular training, and leveraging cloud-based security tools. Effective cyber security is a business issue, not an IT issue and requires a thorough understanding of the risks, vulnerabilities and threats, that a business faces. It requires a professional approach from a security professional that most SMEs can’t afford to employ, so the next best thing is to partner up with such an organisation.
H2 provides affordable and flexible one-off and ongoing data protection and cyber risk protection services designed specifically for SMEs; at a price they can afford. Our advice and guidance takes a unique look at the problems facing SMEs whilst calling on our vast experience working for the larger organisations and government departments.
I wrote a post recently about what SMEs care about regarding Cyber Security v the continued FUD (fear, uncertainty and doubt), which many sales pitches tend to rely on, which helps foster the view that it’s all a little hyped up and not as serious as it advertised. Well, I hope my post did a little to dispel this and show that there really is an issue out there that needs to be addressed by all businesses, not just the corporate big boys. Let’s leave the stats and hype behind and concentrate on what SMEs need to be thinking about.
What is the cost of ignoring cyber security?
Perhaps this is the first question that they should be asking. The financial hit of a data breach can be crippling, especially for the smaller businesses who are perhaps running on tight margins and for whom cash flow is often critical. The average clean up for a smallish business is about £27K. this relates to system restoration, hardware replacement, and the implementation of enhanced security measures. and doesn’t include financial loss from the actual data stolen, or whatever scam was perpetrated, and any fall out from compliance failures, such as fines from the ICO. And at least a third of organisations admit to losing customers post a data breach, highlighting reputational damage and a loss of customer trust.
If you take all that into account, you should be able to work out what the potential cost might be for you.
So, what questions should owners, managers and board members be asking?
I think many get bogged down in the technicalities of IT and don’t consider it in business terms. They don’t think about the business impact of cyber security, about what it is they’re trying to protect. It’s not your IT systems, it’s your data that is the crown jewels. IT systems can be replaced, that’s what your insurance is about, but once the data is stolen, then you are in very real trouble.
Risk Management
Talking of insurance, that’s perhaps how you should be viewing Cyber Security solutions. Don’t think tech, think protecting the business. First and foremost, the board members need to ask themselves if they have a good handle on their cyber risk. Have they identified their cyber assets? What is a cyber asset? Cyber assets are not just hardware and software, in fact those are the least of your worries. It’s the data, where it is and how it’s protected that is important. Have you assessed the risk to those assets? Have you assessed the training requirements for your staff, not just the techies but all staff? Think People, Process and then Technology.
Once you have done this, then you can consider what controls need to be put in place to reduce the risk to an acceptable level.
Below is some of the controls you will need to consider. This list is not exhaustive
1. User Access Control (Admin access is a whole other discussion)
This isn’t just about passwords. Yes, they remain important but on their own, they are no longer sufficient. Nonetheless weak passwords, password re-use and password sharing remain one of the leading root causes of a data breach. 123456 and, believe it or not, password, remain the most used passwords across the world!
It is imperative that you have a strong password policy, dictating not just the length of the password, but also its construction, ensuring that there is a good mix of upper and lower case characters, numbers and symbols, that together make things very difficult for password crackers.
On their own though passwords remain a potential weak spot. Multi factor authentication (MFA), sometimes referred to as 2FA, provides that extra layer of defence and can help to protect against brute-force attacks, phishing scams, key-logging and social engineering. MFA can be simply implemented on most email platforms and within various apps you are using. For those of you trying for Cyber Essentials or ISO 27K series, MFA is mandatory, so make sure it’s put in place.
2. Are you backing up your files?
This seems an obvious thing to do but you’d be surprised how often when trying to restore from a backup, it fails. This is often because the backup routine was set up back in the mists of time and has never been reviewed and even more dangerous, it’s never been tested to see if it works. Set up your backup regime, have it reviewed regularly and tested regularly to make sure it works. If you are backing up online, keep in mind that if a cyber-criminal gets access to your systems to, for example, carry out a ransomware attack, then they can probably get at your back up as well. So, belt and braces, consider having an offline backup as well as an online backup. The latter is more convenient but is vulnerable.
3. Do you train your staff in cyber awareness?
My favourite subject – cyber awareness training. Your first line of defence is your staff, but if not trained adequately, they can be your biggest weakness. It’s known in the trade as the insider threat, but it is caused mainly by human error, staff members doing something they shouldn’t, not maliciously but simply because they didn’t know they shouldn’t. It accounts for 88% of data breaches. Providing your people with training on the threats, current scams and basic cyber awareness reduces the chance of a cyber-attack. This really is the easiest and cheapest quick win any organisation can take in reducing their risk exposure.
4. Do your employees regularly travel or work remotely?
This brings us neatly to what Microsoft coined as the New Normal. Essentially this means remote working shared with in office working, known as the hybrid working model, or for some, moving to a totally remote working system. Totally remote is not as common as hybrid working but is becoming more normal with certain size businesses in certain commercial verticals. It’ll never work for everyone, but for those who have embraced it, it saves a considerable amount of expense. It does however require us to rethink our cyber strategy.
Work-from-home employees are at much greater risk than those in offices. Since home connections are less secure, cybercriminals have an easier entry into the company network. Furthermore, the explosion of various online tools, solutions, and services for collaboration and productivity tend to have the bare minimum of security default setting, and updates from third-party vendors can change security preferences and be easily overlooked.
Phishing becomes an even greater threat to home workers, often because, in an office environment, they have access to colleagues and managers, who they can approach for advice and guidance. This is much harder to replicate with remote workers, especially those who may not be particularly tech savvy and who may not wish to become ‘burdensome’ to their co-workers.
Ransomware also enjoys an advantage in the work-from-home model. If their connection to the company is blocked, it is more difficult for workers to get assistance from the right experts and authorities. And since trust levels are lower when working from home, some workers will be concerned that they have “done something wrong” and so may be more reluctant to seek help. While this risk can be addressed by increased training, as well as messaging that vigilance and involving IT support will be rewarded, it can still be an uphill battle.
We need to break out of the old ‘bastion’ security model of a network protected by firewalls and other technologies and think about solutions that are designed to protect your assets regardless of where your employees work from. They exist and aren’t hard to find.
5. Where is all your data stored and who has access to it?
Data tends to proliferate, especially when working remotely. Cyber awareness training helps here, but it also helps for management to have a handle on data storage. All organisations have this problem, but it becomes more acute for those businesses that hold large amounts of what is known as Personal Identifiable Information or PII. This is information that can identify a living individual and compromise their privacy in some way. Financial advisors, estate agents, solicitors etc, all share this issue. The data protection act, becoming referred to as UK GDPR, is not a suggestion, it is law.
One of the biggest issues we find with organisations of all sizes, is that they think they know where all their data is but get quite a surprise when they discover multiple instances of the same data set. This has become a real issue in that the new normal tempts users when working remotely, with possibly less than robust broadband, to copy data from cloud storage to their PC or laptop to ensure they can keep working on it. Then they upload it again when they’ve finished but forget to delete their copy. That’s just one instance but it is vital to understand where all this data is. What if for instance, you get what is known as a subject access request, where a client or other member of the public wants to know exactly what personal data you have on them, and why. I spoke to a financial advisor not long ago who told me that it took one of their partners off the road for 3 weeks, to discover where all the data was kept on just one person. But under the law, they had no choice but to bite the bullet.
There are several systems on the market which will help with this but what most need now is a system that works regardless of the location of the user and continues providing that cover when the user moves from one location to another. This is just a suggestion, but we’d be delighted to demo it to anyone who is interested. https://hah2.co.uk/gdpr-data-protection/
6. Disaster Recovery and Business Continuity
Business Continuity refers to the proactive strategies and plans put in place to ensure that essential business functions can continue in the event of a disruption or disaster. This could include natural disasters, cyber-attacks, power outages, or any other event that could disrupt normal business operations. Business Continuity planning typically involves identifying critical business processes, implementing redundant systems and processes, and developing communication plans to ensure that the organisation can continue to operate smoothly in the face of adversity.
Disaster Recovery, on the other hand, is focused specifically on restoring IT infrastructure and data after a disaster has occurred. This could involve recovering lost data, restoring systems and networks, and ensuring that IT operations can resume as quickly as possible. Disaster Recovery planning typically involves creating backup systems, implementing data recovery procedures, and testing these plans regularly to ensure they are effective.
Both are critical components of a comprehensive risk management strategy and should be integrated into an organisation’s overall resilience planning efforts.
Just like backups, which are a crucial part of Disaster Recovery, these plans can become very quickly out of date and useless, unless reviewed periodically and tested to see if they work.
7. Vulnerabilities and Threats
A vulnerability is a flaw or weakness in an asset’s design, implementation, or operation and management that could be exploited by a threat. A threat is a potential for a cybercriminal to exploit a vulnerability. A simple way to explain this is that a vulnerability is the inability to resist a hazard or to respond when a disaster has occurred. For instance, people who live on plains are more vulnerable to floods than people who live higher up. The threat is the flood itself.
IT risks and vulnerabilities are the potential threats and weaknesses that can affect the performance, security and reliability of your business function and processes. They can have serious consequences for your business goals, customer satisfaction, and competitive advantage.
Identifying vulnerabilities to your cyber security assets and then identifying the threat to those assets in terms of the vulnerability being exploited, informs your risk and enables you to assign a value to it. Financial value can be assigned to the risk score if you so wish. You then apply controls to bring the risk down to an acceptable level, starting with the Very High risks, and then bringing them down to whatever is acceptable to you. That acceptable level, known as the risk appetite, will vary business to business, risk to risk.
8. Supply Chain Security?
In short, a supply chain attack is a cyber-attack that seeks to damage an organisation by targeting less-secure elements in the supply chain.
An example of such an attack was published by NCSC and points out that many modern businesses outsource their data to third party companies which aggregate, store, process, and broker the information, sometimes on behalf of clients in direct competition with one another.
Such sensitive data is not necessarily just about customers, but could also cover business structure, financial health, strategy, and exposure to risk. In the past, firms dealing with high profile mergers and acquisitions have been targeted. In September 2013, several networks belonging to large data aggregators were reported as having been compromised.
A small botnet was observed exfiltrating information from the internal systems of numerous data stores, through an encrypted channel, to a botnet controller on the public Internet. The highest profile victim was a data aggregator that licenses information on businesses and corporations for use in credit decisions, business-to-business marketing, and supply chain management. While the attackers may have been after consumer and business data, fraud experts suggested that information on consumer and business habits and practices was the most valuable.
The victim was a credit bureau for numerous businesses, providing “knowledge-based authentication” for financial transaction requests. This supply chain compromise enabled attackers to access valuable information stored via a third party and potentially commit large scale fraud.
OK, it was over 10 years ago, but don’t think it won’t happen again.
NCSC also cited what is known as a watering hole attack, which works by identifying a website that’s frequented by users within a targeted organisation, or even an entire sector, such as defence, government, or healthcare. That website is then compromised to enable the distribution of malware.
The attacker identifies weaknesses in the main target’s cyber security, then manipulates the watering hole site to deliver malware that will exploit these weaknesses.
The malware may be delivered and installed without the target realising it (called a ‘drive by’ attack) but given the trust the target is likely to have in the watering hole site, it can also be a file that a user will consciously download without realising what it really contains. Typically, the malware will be a Remote Access Trojan (RAT), enabling the attacker to gain remote access to the target’s system.
If you are in someones supply chain, then you need to make doubly sure that your security protects your customer as well as yourself. And conversely, if you are connected electronically to someone who supplies you, are you sure that you are protected from any vulnerability they may have.
H2 provides affordable and flexible one-off and ongoing data protection and cyber risk protection services.
All the information below is contained within the website but we thought it might be useful to summarise it in one post to make it easier for people who want to understand what we are all about.
About myself and H2
I like to start any discussion by saying that I’ve been in the cyber security game almost since before it was a game! I started in Information Security at the MOD at a time when IT and databases were in their infancy and got in on the ground floor. I subsequently went to work for the NHS, HP/HPE, CSC and Symantec, during which time I led many major cyber security projects in the public and private sectors, designing and commissioning the Security Operations Centre for the FCO, carrying out several projects for the MOD, leading the security team for the new online passport application, as well as several high street banks.
In 2013 I was asked to go to the middle east to set up a Cyber Security team covering the UAE, Bahrain, Saudi Arabia, and Qatar, growing the team from 3 people to 24.
On return my business partner and I set up H2 to serve the SME community. Sadly, my business partner did not survive the pandemic, and I am now the sole management of the company.
So why SMEs? Surely there’s more money in corporate security?
Well yes there is, but SMEs are at the heart of our ethos. During our time working in the corporate sector, it became clear that there was little to no support given to SMEs, either at the S, or the M end of the scale, and the big security companies and system integrators were content to leave that to their resellers ie those local IT support companies that resold their products.
Here at H2 we understand that the only real difference between an SME and a corporate organisation, in terms of cyber security, is that of scale. We have therefore scaled our services, the products that support them, and our pricing, to fit with an SMEs issues and
pocket. We like to say that we offer a triple A service providing solutions that are Appropriate (to you), Affordable and Accreditable (to standards such as Cyber Essentials).
Take a look at our Blog and social media posts. We try to inform and educate, placing a link between what we know, and what SMEs need to know but are rarely told.
Solutions Provided to SMEs
The first thing that we discovered is that SMEs have a very poor grasp of cyber security issues, although that is changing following the pandemic when many were forced to change their working practices almost overnight and have subsequently embraced a distributed working model. There is no doubt that the propensity for working from home, or other remote locations, since COVID has introduced some very difficult, or at least challenging, security vulnerabilities into SME networks. For instance, prior to the pandemic, when they were 100% office based (except perhaps some mobile salespeople), their local IT provider will have almost certainly set up what we called the bastion security model. Ie, like a castle, a bastion, you had a wall around you, and for belt and braces, you also had a moat. The gateway was robust, had a drawbridge and portcullis, or let’s call it a secure firewall and anti-malware system. Everything was locked up inside and nice and secure (in fact it probably wasn’t but that’s for another day).
Whilst Microsoft didn’t invent the term the ‘new normal’, they were the first, I believe, to apply it to IT, following the enforced change in working practices brought about by the pandemic. Many companies have embraced this new normal and have settled into some form of hybrid working. Of course, this is nothing new, it’s been ‘a thing’ for years now, certainly in corporate organisations. The real change came about in SMEs for whom it really was quite revolutionary. Corporate bodies will have spent a lot of money on a variety of remote access systems to keep their data secure, whilst SMEs not only had to rush unprepared because of the pandemic, but they simply didn’t have the budget to employ more secure connections.
What the pandemic has done is change that, or perhaps arguably, accelerated the change to a more distributed way of working, already underway in corporate organisations but now common amongst SMEs.
Our first challenge then was that of education. Changing the mindset of SMEs, moving them away from being simply technology focused, onto a more business oriented cyber
security focus. Cyber security is a business issue, not a technical issue and that is something that many SMEs fail to grasp. Any true cyber security professional takes a
risk managed approach, identifying the risks posed to their client, and then applying the principles of People, Process and then Technology, in that order. That risk managed
approach is equally applicable to all sizes of organisation in all sectors and has not changed since the advent of the internet.
Taking the services we provide as shown clearly on our website (where pricing is shown), www.hah2.co.uk, the first is that of Board Advisory, where we offer advice and guidance to our clients regarding their security. We often end up providing this advice for free as we are putting forward solutions to solve their issues but there is of course a limit to that. We also offer a Cyber Maturity Assessment (CMA), which is close to a full risk assessment but tries to keep the costs down to an order that an SME can afford. The CMA is fully described on the website, and we won’t reprint that here.
Another service we provide is Penetration Testing and Vulnerability assessment. Pen Testing is a point in time test ie the minute you finish it and have read the report, it’s out of date. It is however useful to do once a year or when you add a new feature to your systems, or take a new system into use. We use a fully qualified CREST team who can, if you wish, also carry out attack simulations.
Vulnerability assessments are carried out continuously via agents deployed on the network. The main difference is that as a Pen Test will find real issues, a vulnerability assessment will find things that you may be vulnerable to, but which haven’t necessarily been exploited and in fact, may not be a real issue once investigated. They are, however, continuous throughout the year and can be more effective.
We talked earlier about People, Process and then Technology. Arguably your first line of defence is your people. They can also be your weakest link. Data leaks often occur inadvertently, due to a lack of awareness rather than malicious intent. We offer cyber awareness training designed to equip your team with the knowledge and skills to safeguard sensitive information.
This training can be delivered in one of 2 ways. The first is classroom based, either on site or over a remote connection such as Zoom or Google Meet. The second is online training provided via another of our solutions which will be described below and allows
staff to pick when they will take some time to undertake the training which is delivered in a modular fashion, taking up very limited time which won’t take staff away from their desks to too long.
Another very important service which we provide online, cloud based, using a SaaS solution, is aimed at Data Protection. Clients with large amounts of sensitive data that they wish to protect, use this solution. It is essentially a data loss prevention system
that is designed and priced for SMEs, using state of the art file level encryption. This system comes with a 30-day free trial so that clients can see it for themselves.
Based on Actifile it is tailored to the unique needs of the modern business which often sees its staff work remotely as well as in the office. It protects the valuable data you hold and reduces your risk, without breaking the bank. It covers:
Insider Threat Detection: Protect your business from internal threats posed by employees
Ransomware Protection: Safeguard your data from ransomware attacks that can cripple your operations
Data Leakage Prevention (DLP): Prevent confidential information from falling into the wrong hands
Data Privacy and Compliance: Ensure you meet GDPR requirements and avoid costly fines
Automated Encryption: Protect sensitive data with encryption that’s easy to manage.
In the dynamic world of cybersecurity, staying ahead of evolving threats requires a comprehensive approach that adapts to the ever-changing landscape. At H2, we recognise that one-size-fits-all solutions often fall short, which is why we’ve developed a flexible and scalable cybersecurity solution powered by Guardz, to address the needs of our clients.
Our approach is grounded in sound risk management principles, ensuring that our solutions are aligned with your specific cybersecurity requirements. Whether you need one or more of our products woven into a solution, we can tailor that solution to meet your exact needs and budget.
This complements the data protection solution whilst remaining capable of standing alone. Especially devised and priced for SMEs, it maintains our commitment to affordability and accessibility which is reflected in our incredibly competitive price of
£12 per seat, which includes no hidden charges, add-ons, or expensive infrastructure costs. The solution comes with a 14-day trial to give you hands-on experience with our solutions and assess their impact on your business.
This solution comes with a fully loaded Cyber Security Awareness training course, and a Phishing simulation capability.
You should note that we have bundled the 2 managed services together and offer them at a price reduced by £3 per seat per month.
Finally, we offer certification in Cyber Essentials and Cyber Essentials Plus which provide robust defences, endorsed by UK government to guard against common cyber-attacks. They are required certifications to work with public sector entities, and achieving certification signals a commitment to securing client data.
We now offer different pricing options to our clients. For Cyber Essentials we offer:
Our Supported Package whereby we guide you during yourself assessment ensuring that you achieve certification first time, can be purchased at a one-off price which we are happy to quote for or a monthly subscription from £61 per month.
If you are short on time or not too sure what to do, try our Turnkey Package whereby we carry out the assessment for you in total, once again ensuring that you achieve certification first time. This can also be purchased as a one off at a price which we are happy to quote for or there is a subscription price which starts at £120 per month.
We can offer consultancy around ISO 2700X if it is considered desirable or appropriate. We can advise on that.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
Recent Comments