General Security Issues Archives - Page 5 of 6

Can a Board Advisor Help You Devise Your Cyber Security Strategy?

I’ve always dabbled in Board Advisory roles, even when working for major IT integrators, because consultancy at a senior level, often crosses that boundary. The bigger companies will often value having independent advice, although I have found it’s not always welcomed by their in house IT/Cyber team, who can become quite defensive. The more experienced of them do see the value, even if it’s only validating what they have already put forward as a solution to a particular problem. And they often use a Board advisor to craft the boring bits, around strategy and policies. And I’m OK with that.

When we set up H2 to service the SME sector, we naively thought that they’d welcome an advisor who could guide them through what can be a difficult minefield. It was a bit of an eye opener that SMEs don’t see the value in this at all. In fact, what they see is a drain on resources. It’s a little strange because they are very happy to spend money on getting advice from their local IT company that supplies, and often manages, their IT infrastructure, but who are also focused of selling a product set, dressed up as a solution. Now, I know that that will upset some IT providers and I’ll water my comments down a little by saying I’m referring to Cyber Security which is a distinct discipline which many nibble around the edges without any in depth knowledge or experience.

So, what does a Board Advisor do?

Board Advisors help to guide businesses but are not legally authorised to bind them. As companies establish themselves, moving from an idea to a fully structured and realised organisation, they typically prepare for full operation, sales, and/or fundraising, and in my case, Cyber Security.

As they begin these processes, experts in the field – including mentors or specialists brought into the organisation by a mentor – become hugely valuable as the organisation works to achieve its goals. Advisors are key assets, and it’s crucial to formalise exactly what they will provide, their availability, who they can introduce you to, and how much time they can give you – as well as how they will be compensated in exchange for these services. A board advisor can help fill in any gaps in your team in terms of both experience and expertise. They can also help you bring in new team members and sometimes sources of funding as opportunities allow. Most crucially, they can do all of this while giving you time to think about what you need to be doing to grow your business, or just get it and keep it, running.

Board Advisors are also far more flexible, offering services either on an ongoing basis, in parallel to a Board of Directors, or as part of your transition into a formal, Board-run business. In other words, they are not full time employees, but work on a part time basis where you pay them for their time, bounded as you see fit.

How does a board advisor add value?

In terms of cyber security, a Board Advisor is an experienced cyber security professional who provides advice and support to a business’s leadership without sitting on their Board. They provide counsel based on their prior experience in this field to help the Board make decisions, especially when faced with unfamiliar challenges. And most challenges in the field of Cyber Security will be unfamiliar to them.

When working as an advisor it is essential that we are excellent coaches and can demonstrate our deep knowledge of the subject. We need to take both their board members, their in house IT teams and IT users, getting them onside and letting them know that we are there to enhance their knowledge and skills, we are not their enemies. We must also be prepared to work with any IT company they may have under contract, although that can be a bigger challenge.

Summary

Having a Board Advisor who can mentor the leadership team and other employees, either on a retainer or paid for actually hours worked, can be a great boon for an SME. Just having someone who can debunk the myths and devise strategy, training programmes and advise on cyber risk, is something that any SME management team should value.

What Are The Chances of a Cyber Attack Affecting You?

That’s a really good question and one that’s very difficult to pin down. There are studies galore, mostly from the cyber security industry, and you might feel a little sceptical about those, but also from Governmental sources, which you might consider hold more weight. Fear, Uncertainty and Doubt, known as FUD, permeates the airwaves about this and it can be a bit of a nightmare separating fact from exaggeration. And I get that, I really do.

Aviva, not of course a cyber security company but who nonetheless do sell insurance, carried out some research reported in December 2023, which seems, on the fact of it, to be a little more realistic. They have said that one in five UK businesses have experienced a cyber-attack or incident, with nearly one in 10 (9%) small businesses experiencing this in the last year. This number rises to 35% of large corporate businesses, showing the increasing risk that cyber presents. But even this has some problems in that it depends on how many businesses reported such an attack or incident. There is other research that suggests that many businesses, especially SMEs, keep such things well under wraps.

Small Business Cyber Attack Statistics 2024 (And What You Can Do About Them) says that SMEs account for 43% of cyber-attacks annually, of which 46% were SMEs with 1,000 or fewer employees.

In the 2023 Not (Cyber) Safe for Work Report, there are some alarming statistics. A staggering 97% of executives use personal devices to access work accounts, and 74% frequently send work-related emails and texts from these devices. Behaviour which significantly increases the vulnerability of SMEs to cyber-attacks, putting not just operations at risk but also sensitive employee and customer data.

SMEs are often repositories of a considerable amount of personal and financial information, making them lucrative targets for cyber criminals. The report further indicates that one in three respondents has fallen victim to data theft via scams. A single can result in identify theft, financial loss, and severe reputational damage.

This is a suggested list of the top 10 Cybersecurity Threats:

Social Engineering (often a precursor to Phishing).
Third-Party Exposure.
Configuration Mistakes.
Poor Cyber Awareness and Practice.
Cloud Vulnerabilities.
Mobile Device Vulnerabilities.
Internet of Things.
Ransomware.

Given that many SMEs have now adopted the hybrid working style since COVID, these are not particularly surprising. Working remotely isolates employees who can be much more easily panicked into doing things that are unsafe, than if they have someone on hand, in the office, they can turn to for advice. For example, Phishing. Should I click this, does look a bit iffy? I’ll ask Fred and see what he thinks. As opposed to sitting at home, working to a deadline, and getting pressured by well-crafted Phishing emails, and thinking, I’ll just do it, what’s the worst that can happen?

One of the major problems facing all sizes of business is the lack of cyber security skills available for hire, either as an FTE or a contractor. Shockingly, In September 2023, 50% of all UK businesses had a basic cybersecurity skills gap, while 33% have an advanced cybersecurity skills gap. These figures are consistent with those from 2022 and 2021, highlighting the persistent skills gap issue.

We talked a little bit above, about people using their devices. This isn’t necessary a major issue, providing the individual is prepared to adhere to some security controls being placed on that device, if it is to be used for work. It’s a bit of a balancing act. It is reported that 80% of employees are uncomfortable with the idea of their personal devices being monitored by their companies, yet 73% would consent to having cyber security software installed on their devices. So, a balanced approach is needed, which respects individual privacy while ensure collective security. Not easy.

Here are 5 actionable steps we are recommending SMEs take:

Employee cyber awareness training. Probably the biggest and cheapest quick win any SME can and should be taking.

Strong access control using multi factor authentication. This should be a no brainer.

Cyber Security audits and monitoring. Not easy for many SMEs who will be put off by thinking about costs. However, this has become much more affordable, and all SMEs should be having conversations around this.

Encryption. Again, becoming much more affordable and easier to use. If your sensitive data is encrypted, the chances of falling foul of data protection becomes much less of an issue.

Supply chain security. Many SMEs are in the supply chains of the bigger companies, often utilising online processes, connecting direct to the customer. What would happen if a cyber-criminal gained access to a customer of yours, through your systems?

There is no silver bullet for this. First and foremost, it must be recognised as a business issue, not an IT issue. It must be owned from the top, and dealt with by the board, as they would any other business issue. You can outsource your IT management, but you can’t outsource your responsibility.

Cyber Security Really is a Business Issue, not an IT Issue

Happy New Year and welcome to my first blog post of 2024. For my theme I thought I’d expand on a post I made earlier this week on LinkedIn, about how cyber security is viewed by many SMEs and explore why that view appears to be paramount. I am pretty much of the view that the attitude I’m about to expand on, is as much the fault of the cyber security industry, as anything else.

We tend to flood potential clients with adverts and articles, mainly focused on technology. Many of this comes from sales, rather than from the seasoned cyber security experts, that you might wish it did.

Let me give you a couple of quotes. The first comes from a renowned Harvard scientist and cyber security specialist. He says, ‘If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology’.’ The second comes from Joe Longo, the Chair of the Australian Securities & Investments Commission. He says, ‘If boards do not give cybersecurity and cyber resilience sufficient priority, this creates a foreseeable risk of harm to the company and thereby exposes the directors to potential enforcement action by ASIC based on the directors not acting with reasonable care and diligence.’

Boil that down and they are saying that this is not an IT issue, it’s a business issue. That’s not discounting technology’s role but without integrating it with PEOPLE and PROCESS, we’re only curing half the ailment. When advising a company’s leaders, we must not only identify the threats but also gauge vulnerability to these threats and ascertain the risk to the business. Only then can we craft a solution that harmoniously unites People, Process, and Technology.

Perhaps because there is a considerable amount of what we call FUD, fear, uncertainty and doubt, doing the rounds constantly, it concentrates people on thinking about specifics, instead of looking at the bigger picture. Whilst there is no doubt that phishing, ransomware, and other scams have certainly concentrated the mind somewhat, and these attacks are most definitely not confined to the large enterprise businesses, but have been attacking, with a lot of success, the small to medium business market, this causes vendors to try and exploit the issues around that and push their technology solutions and of course, SMEs rarely, if ever, have the expertise to judge whether or not a particular product will actually give them the protection they need. We now must add into the mix AI and its capacity for increasing cyber-attacks at all levels, making the production of code, so much easier and making it available to those perhaps less skilled than heretofore.

As we travel around and visits clients or potential clients, it is common to find that they have the view that adequate security is provided by technology. They rely on their IT provider to provide the guidance they need which tends to involve firewalls, anti-malware software and perhaps a backup regime. All well and dandy. Let’s just remind ourselves of the quote from Bruce Schneier:

‘If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology’.

So, what does he mean? As he’s not here to ask I suggest what he’s saying is that essentially the technology available can be an essential part of your protection but it has to be targeted in the right way, which not only means you have the right piece of kit doing the right thing, but that you are targeting your IT spend to support your business goals and give a maximum return on investment (ROI). It should also be married to good policies and processes that are enforceable and auditable and fully understood by your work force. To do this you have to understand exactly what your risks, vulnerabilities and threats are to ensure that your solution to those risks, vulnerabilities, and threats, is targeted for maximum effect and ROI and that the technology is supporting the policies and processes, all of which is underpinned with good security awareness training.

It’s also necessary to have some form of measuring the effectiveness of your solutions through a protective monitoring solution. Such solutions for SMEs have long been considered too expensive to even consider, even though it provides a set of cybersecurity practices and measures aimed at safeguarding an SMEs digital assets and sensitive information.

But first and foremost, you need to identify the risks that you face. How can you identify that risk and then mitigate it? Taking risks is a part of business. You assess risk every day when doing business. Do you want to do this deal? What happens if it goes not as expected? Do I want to take this person on? Etc etc etc. Whether you formally undertake a risk assessment or whether you assess that risk informally, you are working out what is appropriate to a level that is consistent with the risk that your organisation is prepared to take. Failure to do that will almost certainly be damaging to your business, perhaps fatally so.

Within SMEs the difference between assessing day to day business risk and assessing risk to information assets, is one of understanding. What is an information asset? Note the word ‘information’ rather than IT. It is the information contained within the IT system that is the important asset, not the piece of hardware it is sitting on. You understand your business risk, after all it is your business, but do you understand information risk? Do you have a clear idea of what information assets you have and where they are? Before you answer that think it through. Do you really know where all the data is? OK, you know that you have a server or servers and that somewhere in those servers there is a bunch of data which runs your business. How much of that data has been saved onto staff workstations when they needed it to carry out some work? How much has been copied off somewhere else for what was probably a very good reason at one point? How well is your firewall functioning? Can malware work its way onto the network because the firewall does not have Universal Threat Management installed and can therefore be probing the servers and workstations. I could go on.

The first thing to understand is that these risks are owned by the board, and if you don’t have a formal board, then the management team. That needs to be understood fully by those at the top. That team needs to understand what level of risk is acceptable and agree what risks you are prepared to tolerate to achieve your business aims. You need to ensure that supporting policies are produced, implemented, understood by employees, and regularly reviewed and updated. At H2 we tend to produce an information security and data protection handbook which can run into many pages. Producing these policies is not as easy as it sounds.

You may also wish to look at some recognised standards by which you can regulate your risk management. One such is the international standard for information security, ISO 27000 series but perhaps the most appropriate for SMEs is the Cyber Essentials Scheme which will help you demonstrate an appropriate level of information security and risk management within your company.

Once you have a risk management framework in place, owned from the top, then you can identify your information assets and assess the risk to your business should those assets be compromised in some way. Then and only then can you adequately assess what processes and technologies you need to mitigate the risks identified for each asset thus targeting your spend for maximum effectiveness.

Sadly, that’s not the end. User education is probably the most important element of all for an SME. Ensuring that your staff are aware of the policies and why they exist. Protect yourself against scams which sadly, form the biggest danger to SMEs rather than hacks. Scams can be very low tech or high tech using malware, but however they come in, your staff need to be aware of them.

Christmas Scams

I’ve just arrived back in the UK having been in the Netherlands and Germany visiting some Christmas markets. As well as nearing bankruptcy, having bought stuff that we would never buy at any other time of the year, and in any other place, it reminds me of the way that Christmas tends to open wallets like no other time of year, but that we still need to watch the pennies. A bargain cannot be passed up. This of course can open us up to some scams that we might otherwise not give the time of day to.

I thought I’d compile a list of 8 of the current types of scams doing the rounds, that tend to get more success at this time of year.

Phishing Scams

Always top of my list. Criminals send emails that look genuine to make you click on a link to a fake site or open an attachment that infects your machine with malware. They will be designed to make you panic and rush your decision. THINK before clicking.

Shopping Scams

A seasonal favourite. Love top brands with low prices? Stay vigilant for counterfeit goods. These range from poorly made clothes to dangerous electronics which fail to comply with safety laws. These are often pushed hard on web sites put up just for this purpose and taken down again soon after. If it sounds too good to be true, it probably is.

Phone Scams

Criminals ring you to discuss a topic then ask you to press a number on your phone keypad to ‘opt out’ of a survey for example. It will generate extreme charges which the criminals will profit from. Just put the phone down. Another is asking a simple question and wanting a Yes or No answer. They then record you saying yes, to use your voice giving agreement to something totally different, that will cost you big money.

Ecard Scams

Watch for those e-cards you receive online. It could be infected with a virus that could shut down your device and you could be held to ransom to restore files. Get a good anti-malware installed that will alert you.

Fake Websites

Using the web to buy Christmas presents? Criminals set up fake websites that look identical to steal your personal details and money. Secure website addresses start with ‘https’ and display a locked padlock. However, that doesn’t always protect you. All a scammer must do is to buy an SSL certificate and then their website will display the padlock and begin with https. There is no substitute for awareness and vigilance.

IT support scams

IT support scams could be via a phone call or email stating there is something wrong with your computer and it needs fixing. They will try to direct you to a bogus website. Companies like Microsoft will NEVER call you directly.

Fake Charities

Watch out for criminals using a legitimate charity’s name and appealing on their behalf, for a donation. If suspicious, ask to see their official charity ID which they’re required to carry. TRUST your instincts. If it’s online then go to their official website and see if it matches the one you’re looking at, or check the email address/phone number if it’s an email or text you’re looking at. Again, vigilance at all times.

Refund Scams

You may receive an email or text pretending to be from the Council or a well-known store promising a credit or tax refund and a link to click to claim the money back. They’ll ask for bank details. DON’T give them out.

Many of these sound very familiar and I’m sure you are going to think that you’d never fall for anything like that. But people do, and it’s a thriving industry. They prey on people who are busy and the scammers don’t give you time to think. Electronic scams in the main, are just a rehash of old fashioned con tricks which use the same formula.

One major difference we are seeing though is the use of AI by scammers. I wrote a piece back in May about AI entitled ‘AI – Good or Evil? A Clear and Present Danger to Cyber Security? I’ve discussed how AI could be used to generate code to be inserted into a Ransomware attack, and perhaps heralding the re-emergence of the once fabled ‘script kiddy’. Whilst there is no doubt that AI has a great potential for good with applications in just about every sphere of IT, it can allow some very nasty people, who have very limited technical ability, to introduce new and frightening scams. I also quoted a story from CNN where a lady in the US received a call allegedly from her daughter, which was very scary indeed and the ‘daughter’ was yelling and sobbing that she’d been kidnapped, and other voices could be heard in the background. Of course, these were all generated by AI and turned out to be totally untrue, the daughter having called her mother and assured her she was safe.

Of course, this is an extreme case, but it does demonstrate the power of AI and its ability to be used by unscrupulous and nasty people. If this is happening in the US, it’s only a matter of time before it arrives here.

Another scam, this time reported in The Washington Post, was an update on the very well reported CEO Scam, whereby someone impersonates the CEO of a company using spoofed email, but this time it’s using AI spoofing the CEOs voice, attempting to scam money from the company. This one worked, and the company lost a lot of money.

Stay safe out there and online, be more vigilant now than you are at any other time of the year.

Aligning business strategy with Cyber Security Strategy

“If boards do not give cybersecurity sufficient priority, this creates a foreseeable risk of harm to the company, and thereby exposes the directors to potential enforcement action by ASIC, based on the directors not acting with reasonable care and diligence” – Joe Longo

Now, SMEs of course don’t generally have to worry about enforcement action regarding their cyber security, but the effects of not taking ownership fully can be quite devastating. Cyber security is a risk, just like any other regarding running a business, and needs to be treated accordingly.

Cyber security can be both a business and an IT issue. It’s a business issue because breaches can have a significant financial and reputational impacts. It’s also an IT issue because it involves implementing technical measures to protect systems and data. Effective cyber security requires a collaboration between business leaders and IT professionals to address both the strategic and technical aspects of security.

That said it has to business led as the IT and cyber security strategy must reflect the overall business strategy that all elements of the business must adhere to. You can outsource your IT, but you can’t outsource your responsibility.

Phishing, ransomware, and other scams have certainly concentrated the mind somewhat, and these attacks are most definitely not confined to the large enterprise businesses, but have been attacking, with a lot of success, the small to medium business market. We now must add into the mix AI and its capacity for increasing cyber-attacks at all levels, making the production of code, so much easier and making it available to those perhaps less skilled than heretofore.

More than half (54%) of SMEs in the UK had experienced some form of cyber-attack in 2022, up from 39% in 2020 (Vodafone Study, 2022). So, what can you do to better protect your business? Well, here are some quick wins you can implement straight away: Ensure that you and your employees are using some form of password management software. Implement strong access controls to ensure that only authorised individuals can access critical systems and data. Invest in employee training and awareness programs. But this is just the tip of the iceberg when it comes to cybersecurity.

As we travel around and visits clients or potential clients, it is common to find that they have the view that adequate security is provided by technology. They rely on their IT provider to provide the guidance they need which tends to involve firewalls, anti-malware software and perhaps a backup regime. All well and dandy. A quote from Bruce Schneier, Fellow at the Berkman Center for Internet & Society at Harvard Law School, goes like this:

‘If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology’.

So, what does he mean? As he’s not here to ask I suggest that he’s saying is that essentially the technology available can be an essential part of your protection but it has to be targeted in the right way, which not only means you have the right piece of kit doing the right thing, but that you are targeting your IT spend to support your business goals and give a maximum return on investment (ROI). It should also be married to good policies and processes that are enforceable and auditable and fully understood by your work force. To do this you have to understand exactly what your risks, vulnerabilities and threats are to ensure that your solution to those risks, vulnerabilities, and threats, is targeted for maximum effect and ROI and that the technology is supporting the policies and processes, all of which is underpinned with good security awareness training.

SMEs and their Trials and Tribulations in regard to Cyber Security and Data Protection

Earlier this week I put a post on LinkedIn talking about why SMEs don’t take cyber security as seriously as they should and often just pay lip service to it. I said I’d elaborate on that in the next newsletter. Well, here it is.

When Cyber Security hits the news, and thus our consciousness, it’s nearly always in terms of breaches, regulatory fines, and business disasters, and nearly always concerning a major household name. We don’t talk about the benefits that it can bring, particularly these days when businesses of all sizes are looking to drive efficiency through digitising their admin and operations. Cyber-attacks on British businesses are increasing year on year. When it comes to cybercrime, small and medium-size businesses are not exempt from the disruption that impacts large organisations. If anything, their size can make them more vulnerable as they are perceived as a softer target.

So why SMEs tend to underestimate the chances of being on the receiving end, and often play that down, is something of a mystery. As is the mindset that it’s an IT matter, not a business matter, when nothing could be further from the truth. Cyber security must be owned by the business owner or board and driven top down. It cannot be left to an IT manager, or worse, a company under contract to provide IT services.

Let’s think for a moment about one potential aspect, supply chain security. Many SMEs sit in a supply chain for a major company or companies. In fact, for many it’s a critical part of their business, without which they could be in real trouble. Their customer will spend money and commit resources to their own security and I’m willing to bet that somewhere in their contract with their suppliers, there will be a stipulation laying down some cyber security standards as a minimum that they must adhere to, which I’m also willing to bet that unless audited, are rarely being met.

Large organisations rely on a network of SMEs. If they operate within the EU, they are subject to the EU General Data Protection Regulation (GDPR) and if they operate only with the UK, then they are required to be in line with what has become known as UK GDPR. The two are very similar indeed. Under both, data controllers (those that collect the data) are responsible for their own compliance as well as that of any third-party processors. Lax compliance in implementing regulations has in fact created a unique opportunity for those SMEs that make the effort to invest in cyber security. With so many damaging data breaches, large organisations are now starting to examine the security practices of any potential third party and seeking agreement with partners to ensure that secure systems are in place. It is the responsibility of the data controller to ensure that third parties within its supply chain take appropriate technical and organisational measures equal to their own.

The UK Government-backed framework Cyber Essentials Plus provides SMEs with a way to demonstrate their security credentials. By gaining Cyber Essentials Plus certification, SMEs can demonstrate that their cyber security has been verified and audited by independent experts. Auditable proof is often requested during tender bids as part of the warrants and liabilities process. Being Cyber Essentials Plus certified can leapfrog a business ahead of the competition.

Supply chains are only as strong as their weakest link and therefore require standardisation in terms of security across the whole chain. SMEs able to prove their cyber security credentials can differentiate themselves from the crowd and maximise on lucrative business opportunities. Some 65% of UK small businesses have no plans in place to deal with potential supply chain disruption, including cybercrime. Ensure your company isn’t one of them by staying ahead of the game – don’t lose business due to supply chain weaknesses.

I’ve already said that the main challenges that I come across is that SMEs do not accept that this is a business issue and continue to see it as an IT Issue. Consider this; if an attack, say Ransomware, hits the business, who suffers? Is it the IT department and/or the IT Support company you have under contract to supply your IT/Network? Or is it the business that takes both a financial hit and reputational damage, perhaps losing contracts from the larger businesses they have been supplying? You know the answer. You can outsource your IT, but not your responsibility.

Let’s examine what stops SMEs from taking the view that it is in fact a business issue. My experience of working with SMEs is that the two main issues are budget and resource, both of which are closely entwined.

SMEs do not budget for Cyber security. They conflate this with their costs for IT support and will expect their IT support company to provide an adequate level of security within the services and products they supply. I’ve talked before about this. Most, if not all, of these companies are what is known as Value Added Resellers, or VARs. What this means is that they sell other people’s products, firewalls, anti-virus etc. And of course, they push those products, ie the flavours of those products they sell, onto their clients. The value added bit comes in the services they provide. In terms of security that generally, although not always, means that their skill set is in the configuration and maintenance of the products they sell.

I’m not knocking that, it’s a perfectly acceptable business plan and has been around for as long as IT has been around. But from a security perspective, it ignores the basics. Whilst technology has come on in leaps and bounds, making it sometimes a nightmare to keep up with, the basic principles of security have never changed. It is built on three towers, People, Process and then Technology. If you haven’t got the right training and awareness in place, if your processes and policies aren’t sound, up to date and rolled out across the business, then all the technology in the world won’t protect you. Risk management is crucial. Understanding the threats to your business and how vulnerable you are to those threats, married to your assets (which aren’t confined to hardware and software), will inform you of the risks you face, in turn allowing you to focus your limited spend on the weakest areas first.

How you arrive at those risks brings us to the second point, resource. It’s not just SMEs that don’t have the resource, but their IT support company rarely does either. Cyber security professionals are expensive and very thin on the ground. Perhaps buying in an advisor for a defined period every month, or on a retainer to be called off as and when required, is the way to go.

Another key plank is innovation. Finding innovative solutions that SMEs can be sure are appropriate for their business, mitigating identified risks. Of course, such innovations have also got to be affordable. This is one of the reasons why many are adopting cloud services, not necessarily for security reasons, but for cost reasons ie no expensive infrastructure to buy in and maintain. It’s also a reason why many security solutions these days are Software as a Service, SaaS, as again, no expensive infrastructure.

In summary, what I’m saying is that SMEs have to:

Accept cyber security as a business, not an IT issue.
Have a senior manager or preferably, board member, take responsibility for it.
Have an adequate budget. Of course, that will be subject to what you can afford. Take advice on what is important and what can wait. It just might save you a lot of time, money, and angst.
Have a defined strategy for improving your security stance, perhaps phased over budgetary periods.
Consider a standard such as Cyber Essentials or, for the larger SME, perhaps even ISO2700x.

Hybrid Working – Have We Really Got a Handle on the Security Issues?

The last few years have been strange, to say the least. But arguably the biggest effect it has had on the way we do business has been the necessity for working from home. Many SMEs had very little experience of this and were bounced into it with very little time to prepare, or to understand many of the implications of what this meant.

But perhaps the strangest thing of all, is that many SMEs still haven’t grasped the security implications of home working. They have this belief that because they are working to a cloud environment, all is well and secure. I only wish it were. Now I’m not decrying cloud environments, quite the contrary, there are many reasons why all sizes of business should be going down this route, but it does come with its own set of issues.

Businesses of all sizes have been forced to transform their operations to support remote work and by and large have done well, but not without many challenges—including video conferencing burn out, (along with wishing they’d taken out shares in Zoom!!), and a yearning to actually work together in person again, someday. We all realise that group working, face to face, is often necessary not just for efficiency, but because we are social animals. Experience has taught many businesses many things, but strangely, to my mind at least, many have simply not grasped the potentially dire consequences in terms of Cyber security and data protection.

A distributed work environment i.e., personnel spread around various locations home working, creates critical challenges and new security threats as a result. The speed with which this has happened has meant that many simply did not take this into account and if they did, thought, well, this is temporary and it won’t matter in the long run. Well perhaps, but as many are now finding, there have been advantages to home working, not least a lowering of costs in terms of how much office space is actually needed to carry out the business function. Many are now looking at Hybrid working i.e., from home with a day or two in the office during the week. There are pros and cons to this outside of the scope of this article, and businesses will have to make their own judgements, but one thing is clear and that is that businesses need to understand the risks now inherent in distributed work, and need to get better are cyber security and data protection, in those environments.

Work-from-home employees are at much greater risk than those in offices. Since home connections are less secure, cybercriminals have an easier entry into the company network. Furthermore, the explosion of various online tools, solutions, and services for collaboration and productivity tend to have the bare minimum of security default setting, and updates from third-party vendors can change security preferences and be easily overlooked.

Phishing becomes an even greater threat to home workers simply because, in an office environment, they have access to colleagues and managers, who they can approach for advice and guidance. This is much harder to replicate with remote workers, especially those who may not be particularly tech savvy and who may not wish to become ‘burdensome’ to their co-workers.

Ransomware also enjoys an advantage in the work-from-home model. If their connection to the company is blocked, it is more difficult for workers to get assistance from the right experts and authorities. And since trust levels are lower when working from home, some workers will be concerned that they have “done something wrong” and so may be more reluctant to seek help. While this risk can be addressed by increased training, as well as messaging that vigilance and involving corporate IT will be rewarded, it can still be an uphill battle.

I have long been saying that Cyber Awareness training for managers and staff is no longer a ‘nice to have’ and is now very much a necessity. In fact, it is arguably the biggest quick win, giving the greatest potential return on investment that there is. Of course, this means that companies have to understand what their threats, vulnerabilities and risks are, in order to assess exactly what training is going to be the most effective.

[/et_pb_blurb][/et_pb_column][/et_pb_row][/et_pb_section]

AI – Good or Evil? A Clear and Present Danger to Cyber Security?

I’ve blogged about Artificial Intelligence (AI) before (click on General Security Issues and you’ll find it), in that blog I was concentrating on how AI could be used to generate code to be inserted into a Ransomware attack, and perhaps heralding the re-emergence of the once fabled ‘script kiddy’. Whilst there is no doubt that AI has a great potential for good with applications in just about every sphere of IT, it can allow some very nasty people, who have very limited technical ability, to introduce new and frightening scams.

The following is taken from CNN.

Jennifer DeStefano’s phone rang one afternoon as she climbed out of her car outside the dance studio where her younger daughter Aubrey had a rehearsal. The caller showed up as unknown, and she briefly contemplated not picking up.

But her older daughter, 15-year-old Brianna, was away training for a ski race and DeStefano feared it could be a medical emergency.

“Hello?” she answered on speaker phone as she locked her car and lugged her purse and laptop bag into the studio.

She was greeted by yelling and sobbing.

“Mom! I messed up!” screamed a girl’s voice.

“What did you do?!? What happened?!?” DeStefano asked.

“The voice sounded just like Brie’s, the inflection, everything,” she told CNN recently. “Then, all of a sudden, I heard a man say, ‘Lay down, put your head back.’ I’m thinking she’s being gurnied off the mountain, which is common in skiing. So I started to panic.”

As the cries for help continued in the background, a deep male voice started firing off commands: “Listen here. I have your daughter. You call the police, you call anybody, I’m gonna pop her something so full of drugs. I’m gonna have my way with her then drop her off in Mexico, and you’re never going to see her again.”

DeStefano froze. Then she ran into the dance studio, shaking and screaming for help. She felt like she was suddenly drowning.

After a chaotic, rapid-fire series of events that included a $1 million ransom demand, a 911 call and a frantic effort to reach Brianna, the “kidnapping” was exposed as a scam. A puzzled Brianna called to tell her mother that she didn’t know what the fuss was about and that everything was fine.

But DeStefano, who lives in Arizona, will never forget those four minutes of terror and confusion – and the eerie sound of that familiar voice.

“A mother knows her child,” she said later. “You can hear your child cry across the building, and you know it’s yours.”

Another scam, this time reported in The Washington Post and this time, it’s an update on the very well reported CEO Scam, whereby someone impersonates the CEO of a company using spoofed email, but this time it’s using AI. It went something like this:

Earlier this year, a sales director in India for tech security firm Zscaler got a call that seemed to be from the company’s chief executive.

As his cell phone displayed founder Jay Chaudhry’s picture, a familiar voice said “Hi, it’s Jay. I need you to do something for me,” before the call dropped. A follow-up text over WhatsApp explained why. “I think I’m having poor network coverage as I am traveling at the moment. Is it okay to text here in the meantime?”

Then the caller asked for assistance moving money to a bank in Singapore. Trying to help, the salesman went to his manager, who smelled a rat and turned the matter over to internal investigators. They determined that scammers had reconstituted Chaudhry’s voice from clips of his public remarks in an attempt to steal from the company.

Chaudhry recounted the incident last month on the sidelines of the annual RSA cybersecurity conference in San Francisco, where concerns about the revolution in artificial intelligence dominated the conversation.

Criminals have been early adopters, with Zscaler citing AI as a factor in the 47 percent surge in phishing attacks it saw last year. Crooks are automating more personalized texts and scripted voice recordings while dodging alarms by going through such unmonitored channels as encrypted WhatsApp messages on personal cell phones. Translations to the target language are getting better, and disinformation is harder to spot, security researchers said.

Scammers can and do, use every advantage, every advance in technology, to make a few quid. It’s a nightmare trying to keep up with this and it is essential that you have some method, be it electronic (difficult), or procedural (an easier no cost option), to identify such scams. Your staff need training but first you have to have someone on tap to keep you up to date with what’s going on.

As AI continues to develop and is taken into use more and more, we will see a clash between its proponents and the security world. That’s nothing new. Everytime there is a new development in applications, operating systems etc, there is always a lag before security catches up. This time however AI can be taken into use with low levels of skill, at a rapid pace. Cyber security needs to be on its metal, as do IT departments, CISOs, CIOs etc. Companies at all levels need to be on their guard.

Supply Chain Security, Spear Phishing and Remote Working

Reports on Cyber trends abound, and you could be forgiven for thinking that they are often produced by organisations trying to sell you something. And I might be tempted to agree. Am I any different, well I’ll leave you to judge but I do think that it is very important to educate, and not just sell, into the SME market. I’ve said many time times before, that the SME market has been badly served by the Cyber security industry, in that it tends to get ignored. However, that doesn’t mean that they are any less at risk, or any less important to the UK economy. Quite the reverse. I do read several reports about cyber trends, and if I think they are of use, then I do pass them on via this newsletter. I have read one recently which I think is worth passing on. It highlights 3 different scenarios, all of which I have blogged about in the past. They are, in no particular order, supply chain attacks, spear phishing and attacks against hybrid workers. These are clearly not exhaustive, but they are relevant to SMEs.

An often forgotten element of Cyber security lies within a company’s supply chain. Manufacturers for instance, often use what is known as ‘just in time supply’, i.e., they have an electronic connection to their key suppliers who are connected to the company’s inventory, and automatically resupply when an item runs low. It’s efficient and prevents the holding of unnecessary stock. But it can, if not done correctly, drive a coach and horses through your security.

In short, a supply chain attack is a cyber-attack that seeks to damage an organisation by targeting less-secure elements in the supply chain.

Small to medium enterprises are at greatest risk from cyber security threats, and their vulnerability in turn poses a danger to the major corporations that they do business with. Why, well the problem with small to medium sized enterprises is that they are in the unique position of having disproportionate access to important information. They are often mission critical suppliers that produce niche products, and they generally have the weakest cybersecurity arrangements in terms of size, resources, and expertise. They open up large clients to leapfrog cyber security attacks.

Spear phishing is an email or electronic communications scam targeted towards a specific individual, organisation, or business. Although often intended to steal data for malicious purposes, cybercriminals may also intend to install malware on a targeted user’s computer.

Spear phishing is a more targeted cyber-attack than phishing. Emails are personalized to the intended victim. For example, the attacker may identify with a cause, impersonate someone the recipient knows, or use other social engineering techniques to gain the victim’s trust. In other words, this is what might be referred to more as a scam than a cyber-attack, but it is no less illegal.

The common characteristics of spear phishing emails are not unlike traditional phishing scams:

The email uses email spoofing to masquerade as a trusted person or domain. …
Social engineering is employed to create a sense of urgency to exploit the victim’s desire to be helpful to a friend or colleague.

Hybrid working has been the subject of several of my blogs and newsletters of late. We are all now seeing the ‘new normal’ and are embracing it to some extent. There are now surveys by HR consulting companies, suggesting that 60 to 70% of companies of all sizes are planning to adopt a hybrid model. In the IT industry, particularly amongst IT consultancies, this model has been in use for many years and is well regarded, allowing the downsizing of office space and a lower cost base.

As organisations of all sizes begin the decision making process which allows them to seriously consider the recalibration of their operating model to adapt to the new normal, then there is a real need to re-evaluate their cyber security stance, involving policies, processes, people training and technical defences.

Cyber criminals have used this shift in working patterns to their advantage and their attacks have increased hugely, across the globe. Working from home has increased the footprint of IT operations whilst weakening its defences and the scope for cyber criminals to develop new attack methods, new scams, and to generally increase their revenue, exponentially.

Cyber-attacks and data breaches tend to only hit the headlines when it’s a large company involved. However, SMEs are hit every day, but for somewhat smaller sums of money and there is an argument that often these attacks go unreported to protect reputations and even go undiscovered for long periods of time. Data breaches do get reported because of the requirement to make such a report to the Information Commissioners Office, but even then, actions taken by the ICO often fly under the radar. For instance, this year alone there have been over 40 fines by the ICO, many to companies categorised as SME. A finance company was fined £48k and a solicitor was fined £98k. You can research all of this on google if you want confirmation.

Artificial Intelligence and Cyber Security – Boon or Pain?

I wrote a piece back in May about AI entitled ‘AI – Good or Evil? A Clear and Present Danger to Cyber Security? I’ve discussed how AI could be used to generate code to be inserted into a Ransomware attack, and perhaps heralding the re-emergence of the once fabled ‘script kiddy’. Whilst there is no doubt that AI has a great potential for good with applications in just about every sphere of IT, it can allow some very nasty people, who have very limited technical ability, to introduce new and frightening scams. I also quoted a story from CNN where a lady in the US received a call allegedly from her daughter, which was very scary indeed and the ‘daughter’ was yelling and sobbing that she’d been kidnapped, and other voices could be heard in the background. Of course, these were all generated by AI and turned out to be totally untrue, the daughter having called her mother and assured her she was safe. Of course, this is an extreme case, but it does demonstrate the power of AI and its ability to be used by unscrupulous and nasty people. If this is happening in the US, it’s only a matter of time before it arrives here.

Two bad examples of AI. I’m not putting AI down or saying we shouldn’t be utilising it, but cyber security is my thing, and I can’t ignore the warning signs. Cyber criminals are never slow in adopting new technologies and methods. We need to be aware of that.

So why am I bringing this up again so soon? Well AI continues to be reported in the news, sometimes with a good result and sometimes not so good. So, I thought I’d ask Chat GPT what it thought about AI and Cyber Security. I asked 2 questions, the first was, ‘Is AI a danger in terms of Cybersecurity?’. The answer came back:

AI can be both a boon and a potential danger in terms of cybersecurity. On one hand, AI can enhance cybersecurity by detecting and mitigating threats more efficiently, analysing vast amounts of data for anomalies, and automating certain security tasks. On the other hand, AI can also pose risks if it falls into the wrong hands or is used maliciously. Sophisticated AI powered attacks could exploit vulnerabilities, evade detection, or launch targeted attacks at an unprecedented scale. It is crucial to develop robust safeguards ethical guidelines, and responsible AI practices to ensure AI remains a force for good in cybersecurity.

So even ChatGPT thinks this is a double edged sword. The real problem for my target clientele, the SME space, is that affording AI powered tools to detect and mitigate threats and analyse large amount of data, is almost certainly not going to be realistic. So, when we are talking about developing robust safeguards, understanding the risks becomes even more vital, if that’s possible, than it ever has been before. It also brings Zero Trust solutions sharply into focus and finding such solutions that are affordable, is going to become crucial.

The next question I asked was, ‘How do we ensure that AI isn’t a cybersecurity threat?’. The answer came back:

Ensuring that AI is not a cybersecurity threat requires a multi-faceted approach. Here are some key considerations:

Robust Security Measures: Implement strong security protocols, encryption, and access controls to safeguard AI systems and their underlying data from unauthorized access or manipulation.

Rigorous Testing and Validation: Thoroughly test and validate AI algorithms and models to identify and fix vulnerabilities, including potential avenues for cyberattacks, before deployment.

Adversarial Testing: Conduct adversarial testing to simulate potential attacks and evaluate the resilience of AI systems against different cybersecurity threats.

Data Privacy and Governance: Establish clear policies and practices for data privacy, ensuring that sensitive information is properly handled, stored, and shared in compliance with relevant regulations.

Ongoing Monitoring and Updates: Continuously monitor AI systems for potential security risks, promptly address vulnerabilities, and keep software and hardware up to date with the latest security patches.

Ethical AI Development: Integrate ethical considerations into the design and deployment of AI systems, emphasizing transparency, fairness, and accountability to mitigate potential biases or unintended consequences.

Collaboration and Information Sharing: Foster collaboration among industry, academia, and government entities to share knowledge, best practices, and emerging threats, enabling a collective effort to combat AI-related cybersecurity challenges.

Education and Awareness: Promote cybersecurity awareness and provide training to AI developers, users, and stakeholders, emphasizing responsible AI usage and the identification of potential threats.

By following these guidelines and continuously adapting to emerging risks, we can enhance the security of AI systems and minimize the potential for them to be exploited as cybersecurity threats.

Again, looking at this from an SME perspective, some of it isn’t relevant i.e., No6 for example, SMEs aren’t going to be developing their own AI solutions. But much of it I would have come up with on my own, without the aid of a machine. It would appear that AI uses some common sense, which is nice. No8 for example. I bang on and on about this. It is low cost and easy to implement. It’s staggering how many companies don’t do this. This list also shows the value of Zero Trust solutions and encryption, which on its own, vastly reduces the risk to data, particularly PII (personal identifiable information – UK GDPR).

General Security Issues