This is a subject that, at one time, was pretty much confined to the larger enterprise organisations but largely because of the pandemic, it is gaining popularity within SMEs and is now getting a lot of attention from the National Cyber Security Centre.
So, what is it? Well the idea was to allow employees to use their own devices for work purposes. The thinking was that in this day and age, many employees have developed preferences for what they use. So whilst many will stick to Microsoft, others may prefer an Android or Apple tablet, whilst others still may prefer a MacBook or Chromebook. There’s a wide choice these days.
But what do we mean by work purposes? It can mean anything from accessing your emails, which most of us do on our phones, to accessing critical services and applications. And this makes it a potentially complex issue.
The pandemic brought with it many issues that needed swift resolutions and now, it’s not uncommon to visit companies that have allowed their staff to continue to work from home often because the cost savings in office accommodation are very beneficial, and some have allowed staff to use their own preferred devices when working, including connecting to the company network and/or cloud services, remotely.
For just about all SMEs, this has started from a position of necessity. But like many such events, if it seems to be working, it rapidly becomes the norm and in creeps a complacency that it’s actually all OK.
BYOD solutions need to be planned and thought through. And pretty much the same as most things, particularly risk based assessments, what you need to do really depends on your organisation. You need to ask some questions:
Is there anything that needs to be done from the office that cannot be done by home workers?
Are there functions which employees need to do, that requires the company to have visibility and management of, and is there anything that doesn’t?
What do my employees need to do?
How can we balance what employees do that also involves your need to protect data and their privacy (DPA2018)? They are after all, using their own device.
Above all you need a well thought through and comprehensive strategy, which, while offering flexibility and potential cost savings, recognises and deals with several security implications that organisations must address to ensure sensitive data and systems remain secure. Below are the key concerns:
a. Data Security
Data Leakage: Employees’ personal devices may lack adequate protections, increasing the risk of unauthorised access or accidental data leaks.
Loss or Theft of Devices: Personal devices may not have encryption enabled, making sensitive corporate data vulnerable if the device is lost or stolen.
Uncontrolled Sharing: Employees might unknowingly share corporate data via apps or cloud services outside the organisation’s control.
b. Malware and Cyber Threats
Insecure Devices: Personal devices might not have up-to-date antivirus software, firewalls, or operating system patches, making them susceptible to malware or ransomware attacks.
Unverified Applications: Employees may install unauthorised or malicious applications that could compromise corporate networks.
c. Network Security
Untrusted Connections: BYOD devices may connect to public Wi-Fi networks, exposing them to man-in-the-middle (MITM) attacks that could jeopardise corporate data.
Device Spoofing: An attacker could mimic a BYOD device to gain unauthorised access to the network.
d. Compliance Risks
Regulatory Violations: BYOD policies may lead to data handling practices that violate regulations like GDPR or PCI DSS if personal devices aren’t properly managed.
Audit Challenges: Tracking and demonstrating compliance can become difficult with non-standardised, user-managed devices.
e. Access Control
Weak Authentication: Personal devices may not support strong authentication mechanisms, increasing the risk of unauthorised access.
Lack of Segmentation: Employees’ devices may access both corporate and personal systems, creating potential crossover risks.
f. Insufficient Visibility
Limited Monitoring: Organisations may lack full visibility into personal devices, making it harder to detect breaches or policy violations.
Shadow IT: Employees might use unauthorised apps or services that bypass official security controls.
g. Employee Turnover
Data Retention: When an employee leaves, ensuring the removal of corporate data from their personal devices can be challenging.
Device Ownership: Legal and practical issues might arise when attempting to enforce data wiping on personal devices.
Mitigation Strategies
To address these risks, organisations adopting BYOD should:
Implement Mobile Device Management (MDM) or Endpoint Detection and Response (EDR) solutions.
Enforce strong authentication, such as multi-factor authentication (MFA).
Require device encryption and ensure compliance through regular checks.
Use some form of file separation to ensure separate corporate data from personal data.
Deploy a zero-trust security model with conditional access controls.
Establish clear policies and training to educate employees on BYOD security best practices.
By proactively addressing these risks, organisations can leverage the benefits of BYOD while maintaining robust security.
Cybersecurity is an ever-evolving field, with new threats and innovations emerging regularly. Not all these threats will apply to everyone, the trick is, and has always been, identifying the threats that apply to you, working out how vulnerable you are too those threats, and applying controls to bring those down to an acceptable level. That acceptable level will change, not just from company to company, but also asset to asset. Don’t waste valuable time and energy trying to achieve a zero-threat level. It doesn’t exist. You need to understand clearly what your appetite for risk is, ie what is an acceptable level of risk for you, and then go for it.
But what emerging threats are there that you just might have to combat in your daily business life. These trends highlight the ongoing innovation in both cyber threats and defences, driven by the growing reliance on digital infrastructure and the rapid evolution of technology.
Here are some suggestions and trends in cybersecurity as of late 2024:
1. AI-Powered Cyber Attacks and Defences
Threats: Cybercriminals are increasingly using AI to launch more sophisticated attacks, such as AI-driven phishing campaigns, automated hacking attempts, and machine learning-based malware that adapts to security measures. We’re seeing AI powered social engineering, phone calls mimicking voices of managers, and similar. Like with just about all AI usage, what it does it make things much easier by reducing human effort. So, attacks can be set up using AI and become almost fire and forget, just letting it get on with it in the background.
Defense: Organisations are countering this with AI-based threat detection systems, anomaly detection, and predictive analytics to identify potential breaches before they occur. What about your defences? Are they keeping up with these types of threat. What about mobile workforces, are your staff covered once they leave the office; do you have a hybrid or even fully remote workforce? If so, are your defences up to the job? Check out https://hah2.co.uk/
2. Ransomware Evolution
Ransomware continues to be a major threat, but it’s evolving with more advanced encryption techniques, and multi-stage attacks where attackers exfiltrate data before encrypting it. They then threaten to publish the stolen data unless a ransom is paid. I recently heard of a company that had been infiltrated through its website which was transactional, ie it sold stuff via the website and the website was connected to their database of products and sales order processing system. The web developer didn’t have sufficiently robust security in place. A good example of an SME being exploited via their supply chain.
Double extortion and Ransomware-as-a-Service (RaaS) have become more common, where hackers sell ransomware kits to other criminals.
3. Zero Trust Architecture
Zero Trust has moved from a buzzword to a mainstream security model. Organisations are adopting a “never trust, always verify” approach, assuming that every user and device, both inside and outside the network, could be compromised.
Implementing least privilege access, micro-segmentation, and continuous authentication are key features of this approach. And no, this doesn’t have to be cost prohibitive.
4. Supply Chain Attacks
Attacks targeting third-party vendors and software providers have increased. By compromising trusted suppliers, attackers can infiltrate many organisations through a single breach.
Notable Examples: The SolarWinds and Kaseya attacks were significant instances that highlighted the dangers of such supply chain vulnerabilities. The attack on the NHS via a contracted service provider, is also a good example but it doesn’t just affect the big organisations. See above for an example of how an SME was attacked via a third-party web designer.
5. Post-Quantum Cryptography
With quantum computing on the horizon, there’s increasing focus on developing encryption algorithms that can resist quantum attacks. Post-quantum cryptography is becoming a hot topic as organisations prepare for the future of computing.
Even without quantum computing, many organisations do not use encryption, even for their critical data. If you are subject to a data breach, but that data is encrypted, you could save yourself a lot of money and reputational damage.
6. Cloud Security and Misconfiguration
As cloud adoption accelerates, the security of cloud environments remains a top concern. Misconfigured cloud settings continue to expose sensitive data, while cloud-native security solutions (e.g., CSPM, CWPP) are becoming more prevalent.
Securing multi-cloud environments and addressing shared responsibility models are critical challenges.
7. Cybersecurity for IoT and OT
The Internet of Things (IoT) and Operational Technology (OT) are becoming frequent attack targets. Securing connected devices, industrial systems, and critical infrastructure from cyber threats is a growing concern, especially as they are often lacking in adequate security protocols.
This is becoming more critical as home working becomes more and more popular. Employees connecting to your company cloud and systems using home broadband and WIFI, are also de fact connecting to any IOT devices that they are using in the home, potentially opening up back doors into your system.
8. Data Privacy Regulations and Compliance
Data privacy is a key focus as more countries introduce stricter regulations like the Data Protection Act 2018, now becoming known as UK GDPR (General Data Protection Regulation). There are other compliances such as FSA regulations and other industry bodies, that many need adherence to. Data breaches can produce fines from regulatory bodies, law suites from those affected, and quite severe reputational damage.
9. Cybersecurity Automation and SOAR
Automation is becoming critical in cybersecurity due to the sheer volume of threats. Security Orchestration, Automation, and Response (SOAR) tools help streamline incident detection and response, freeing up analysts to focus on complex tasks.
Do you have anything in place to automate your defences? Do you monitor your systems for threats?
10. Identity and Access Management (IAM)
Identity theft and credential stuffing attacks are rising, making IAM solutions more important than ever. Multi-factor authentication (MFA), password less authentication, and biometrics are seeing widespread adoption to prevent unauthorised access.
Another good question, or perhaps it should be, do they ask any questions, other than cost, about cyber security, or do they leave everything up to their IT support, whether contracted or in house?
What is the cost of ignoring cyber security?
Perhaps this is the first question that they should be asking. The financial hit of a data breach can be crippling, especially for the smaller businesses who are perhaps running on tight margins and for whom cash flow is often critical. The average clean up for a smallish business is about £27K. this relates to system restoration, hardware replacement, and the implementation of enhanced security measures. and doesn’t include financial loss from the actual data stolen, or whatever scam was perpetrated, and any fall out from compliance failures, such as fines from the ICO. And at least a third of organisations admit to losing customers post a data breach, highlighting reputational damage and a loss of customer trust.
So, what should owners, managers and board members be asking?
I think many get bogged down in the technicalities of IT and don’t consider it in business terms. They don’t think about the business impact of cyber security, about what it is they’re trying to protect. It’s not your IT systems, it’s your data that is the crown jewels. IT systems can be replaced but once the data is stolen, then you are in very real trouble.
Risk Management
First and foremost, the board members need to ask themselves if they have a good handle on their cyber risk. Have they identified their cyber assets? What is a cyber asset? Cyber assets are not just hardware and software, in fact those are often the least of your worries. It’s the data, where it is and how it’s protected that is important. Have you assessed the risk to those assets? Have you assessed the training requirements for your staff, not just the techies but all staff? Think People, Process and then Technology.
Once you have done this, then you can consider what controls need to be put in place to reduce the risk to an acceptable level.
Below is some of the controls you will need to consider. This list is not exhaustive
1. User Access Control (Admin access is a whole other discussion)
This isn’t just about passwords. Yes, they remain important but on their own, they are no longer sufficient. Nonetheless weak passwords, password re-use and password sharing remain one of the leading root causes of a data breach. 123456 and, believe it or not, password, remains the most used passwords across the world!
It is imperative that you have a strong password policy, dictating not just the length of the password, but also its construction, ensuring that there is a good mix of upper and lower case characters, numbers and symbols, that together make things very difficult for password crackers.
On their own though passwords remain a potential weak spot. Multi factor authentication (MFA), sometimes referred to as 2FA, provides that extra layer of defence and can help to protect against brute-force attacks, phishing scams, key-logging and social engineering. MFA can be simply implemented on most email platforms and within various apps you are using. For those of you trying for Cyber Essentials or ISO 27K series, MFA is mandatory, so make sure it’s put in place.
2. Are you backing up your files?
This seems an obvious thing to do but you’d be surprised how often when trying to restore from a backup, it fails. This is often because the backup routine was set up back in the mists of time and has never been reviewed and even more dangerous, it’s never been tested to see if it works. Set up your backup regime, have it reviewed regularly and tested regularly to make sure it works. If you are backing up online, keep in mind that if a cyber-criminal gets access to your systems to, for example, carry out a ransomware attack, then they can probably get at your back up as well. So, belt and braces, consider having an offline backup as well as an online backup. The latter is more convenient but can be corrupted.
3. Do you train your staff in cyber awareness?
My favourite subject – cyber awareness training. Your first line of defence is your staff, but if not trained adequately, they can be your greatest vulnerability. It’s known in the trade as the insider threat but it is caused mainly by human error, staff members doing something they shouldn’t, not maliciously but simply because they didn’t know they shouldn’t. It actually accounts for 88% of data breaches. Providing your people with training on the threats, current scams and basic cyber awareness reduces the chance of a cyber-attack. This really is the easiest and cheapest quick win any organisation can take in reducing their risk exposure.
4. Do your employees regularly travel or work remotely?
This brings us neatly to what Microsoft coined as the New Normal. Essentially this means remote working shared with in office working, known as the hybrid working model, or for some, moving to a totally remote working system. Totally remote is not as common as hybrid working but is becoming more normal with certain size businesses in certain commercial verticals. It’ll never work for everyone, but for those who have embraced it, it saves a considerable amount of expense. It does however require us to rethink our cyber strategy.
Work-from-home employees are at much greater risk than those in offices. Since home connections are less secure, cybercriminals have an easier entry into the company network. Furthermore, the explosion of various online tools, solutions, and services for collaboration and productivity tend to have the bare minimum of security default setting, and updates from third-party vendors can change security preferences and be easily overlooked.
Phishing becomes an even greater threat to home workers, often because, in an office environment, they have access to colleagues and managers, who they can approach for advice and guidance. This is much harder to replicate with remote workers, especially those who may not be particularly tech savvy and who may not wish to become ‘burdensome’ to their co-workers.
Ransomware also enjoys an advantage in the work-from-home model. If their connection to the company is blocked, it is more difficult for workers to get assistance from the right experts and authorities. And since trust levels are lower when working from home, some workers will be concerned that they have “done something wrong” and so may be more reluctant to seek help. While this risk can be addressed by increased training, as well as messaging that vigilance and involving IT support will be rewarded, it can still be an uphill battle.
We need to break out of the old ‘bastion’ security model of a network protected by firewalls and other technologies and think about solutions that are designed to protect your assets regardless of where your employees work from. They exist and aren’t hard to find.
Data tends to proliferate, especially when working remotely. Cyber awareness training helps here, but it also helps for management to have a handle on data storage. All organisations have this problem, but it becomes more acute for those businesses that hold large amounts of what is known as Personal Identifiable Information or PII. This is information that can identify a living individual and compromise their privacy in some way. Financial advisors, estate agents, solicitors etc, all share this issue. The data protection act, becoming referred to as UK GDPR, is not a suggestion, it is law.
5. Where is all your data stored and who has access to it?
One of the biggest issues we find with organisations of all sizes, is that they think they know where all their data is but get quite a surprise when they discover multiple instances of the same data set. This has become a real issue in that the new normal tempts users when working remotely, with possibly less than robust broadband, to copy data from cloud storage to their PC or laptop to ensure they can keep working on it. Then they upload it again when they’ve finished but forget to delete their copy. That’s just one instance but it is vital to understand where all this data is. What if for instance, you get what is known as a subject access request, where a client or other member of the public wants to know exactly what personal data you have on them, and why. I spoke to a financial advisor recently who told me that it took one of their partners off the road for 3 weeks, to discover where all the data was kept on just one person. But under the law, they had no choice but to bite the bullet.
There are several systems on the market which will help with this but what most need now is a system that works regardless of the location of the user and continues providing that cover when the user moves from one location to another. This is just a suggestion, but we’d be delighted to demo it to anyone who is interested. https://hah2.co.uk/gdpr-data-protection/
6. Disaster Recovery and Business Continuity
Business Continuity refers to the proactive strategies and plans put in place to ensure that essential business functions can continue in the event of a disruption or disaster. This could include natural disasters, cyber-attacks, power outages, or any other event that could disrupt normal business operations. Business Continuity planning typically involves identifying critical business processes, implementing redundant systems and processes, and developing communication plans to ensure that the organisation can continue to operate smoothly in the face of adversity.
Disaster Recovery, on the other hand, is focused specifically on restoring IT infrastructure and data after a disaster has occurred. This could involve recovering lost data, restoring systems and networks, and ensuring that IT operations can resume as quickly as possible. Disaster Recovery planning typically involves creating backup systems, implementing data recovery procedures, and testing these plans regularly to ensure they are effective. Both are critical components of a comprehensive risk management strategy and should be integrated into an organization’s overall resilience planning efforts.
Just like backups, which are a crucial part of Disaster Recovery, these plans can become very quickly out of date and useless, unless reviewed periodically and tested to see if they actually work.
7. Vulnerabilities and Threats
A vulnerability is a flaw or weakness in an asset’s design, implementation, or operation and management that could be exploited by a threat. A threat is a potential for a threat agent to exploit a vulnerability. A simple way to explain this is that a vulnerability is the inability to resist a hazard or to respond when a disaster has occurred. For instance, people who live on plains are more vulnerable to floods than people who live higher up. The threat is the flood itself.
IT risks and vulnerabilities are the potential threats and weaknesses that can affect the performance, security and reliability of your business function and processes. They can have serious consequences for your business goals, customer satisfaction, and competitive advantage.
Identifying vulnerabilities to your cyber security assets and then identifying the threat to those assets in terms of the vulnerability being exploited, informs your risk and enables you to assign a value to it. Financial value can be assigned to the risk score if you so wish. You then apply controls to bring the risk down to an acceptable level, starting with the Very High risks, and then bringing them down to whatever is acceptable to you. That acceptable level, known as the risk appetite, will vary business to business, risk to risk.
8. Supply Chain Security?
In short, a supply chain attack is a cyber-attack that seeks to damage an organisation by targeting less-secure elements in the supply chain.
An example of such an attack was published by NCSC and points out that many modern businesses outsource their data to third party companies which aggregate, store, process, and broker the information, sometimes on behalf of clients in direct competition with one another.
Such sensitive data is not necessarily just about customers, but could also cover business structure, financial health, strategy, and exposure to risk. In the past, firms dealing with high profile mergers and acquisitions have been targeted. In September 2013, several networks belonging to large data aggregators were reported as having been compromised.
A small botnet was observed exfiltrating information from the internal systems of numerous data stores, through an encrypted channel, to a botnet controller on the public Internet. The highest profile victim was a data aggregator that licenses information on businesses and corporations for use in credit decisions, business-to-business marketing, and supply chain management. While the attackers may have been after consumer and business data, fraud experts suggested that information on consumer and business habits and practices was the most valuable.
The victim was a credit bureau for numerous businesses, providing “knowledge-based authentication” for financial transaction requests. This supply chain compromise enabled attackers to access valuable information stored via a third party and potentially commit large scale fraud.
NCSC also cited what is known as a watering hole attack, which works by identifying a website that’s frequented by users within a targeted organisation, or even an entire sector, such as defence, government, or healthcare. That website is then compromised to enable the distribution of malware.
The attacker identifies weaknesses in the main target’s cyber security, then manipulates the watering hole site to deliver malware that will exploit these weaknesses.
The malware may be delivered and installed without the target realising (called a ‘drive by’ attack) but given the trust the target is likely to have in the watering hole site, it can also be a file that a user will consciously download without realising what it really contains. Typically, the malware will be a Remote Access Trojan (RAT), enabling the attacker to gain remote access to the target’s system.
If you are in someones supply chain, then you need to make doubly sure that your security protects your customer as well as yourself. And conversely, if you are connected electronically to someone who supplies you, are you sure that you are protected from any vulnerability they may have.
As I move around talking to business leaders of all sizes of company, one thing stands out. And that’s that there are many different views as to how involved management needs to be in cyber defence, and some of these views are markedly different. They range from a very hands off approach, happily leaving it to their IT support, to, and it has to be said, a minority, who see it as their responsibility.
Arguably one of the most, if not the most, important roles any CEO/MD/Chairman (call him or her whatever you like and for the purposes of this article I’ll stick with CEO) is to set the importance of cyber defence in everyones mind. The tone has to come from the top to be accepted and effective. When cyber defence is clearly prioritised by the CEO and the Board, it assumes an importance in the mind of the employees. It is crucial that everyone from the CEO down understands the impact that a cyber breach, or a scam, or a cyber based fraud, can have on the bottom line.
This also aligns cyber defence and data protection with the business goals. Cyber defence is a business issue, not an IT issue. It’s crucial that all clearly understand this and how it should be woven into the very fabric of the business. The CEO and the board have a clear perspective on the company’s strategic goals and direction. By their involvement with cyber defence, they can ensure that it is aligned with the broader business strategy to fully protect the businesses data and systems. It aids with budgets for cyber security tools, training and personnel, addressing the threats to the business.
CEOS might need advice and guidance but their involvement is essential and will help to identify some issues which may not be clear to employees, especially technical employees. One such is reputational damage. The damage to a company from a data breach may not be immediately clear. But once it hits the press, or once the company becomes subject to a fine from a regulatory body such as the Information Commissioner, the word tends to spread. If you can’t be trusted to maintain a level of confidentiality, can you be trusted with other things? Doubt spreads and can destroy vendor, customer and partner relationships.
Cyber defence begins with risk management. Managing cyber risks is no different to managing any other business risk. There is no business without risk, the trick is to manage your risks down to a level that you are prepared to accept, known as the risk appetite. This must involve the CEO and directors and business managers. Each knows what could damage, perhaps catastrophically damage, their part of the business. IT staff don’t have this knowledge, their focus is often on the technical risks, not the business risks.
Risk management itself begins with a clear cyber defence and data protection strategy. Depending upon the size of your business, some elements of the suggested strategy below, may not be relevant to you. This is offered as a guide, not an absolute.
Figure 1- Suggested Cyber Strategy Framework
To help in defining your strategy, you need to undertake a risk analysis which will inform the selection, deployment and management of Appropriate, Affordable and Accreditable (if required) controls.
Appropriate in the sense that controls need to support rather than hinder business process as well as being capable of achieving their goals. Your controls also need to be appropriate to your business. Affordable may seem self-explanatory, however in the context of cyber security controls and overall budgetary constraints, return on investment is as important as cost effectiveness. Accreditation to agreed cyber security standards – of which there are many, is crucial for all organisations. Being able to provide a trail of evidence which demonstrates on going compliance to selected standards is essential in times of crisis.
Having got this far, we need a risk treatment plan to match the identified risks. What you’re trying to achieve here is to manage the risk down to an acceptable level. Don’t get bogged down in trying to eliminate risk, you won’t succeed, but rather get the risk down as low as you can. Don’t make it too complicated, identify your risks as High, Medium and Low. Then manage the high risks down to Low, followed by the medium risks. You do this by applying controls, be they procedural or technical, to the risk and measuring the outcome.
It sounds complicated and you may need guidance, but once done and adhered to, it provides peace of mind to you, that you have done what you need to do to get your Cyber Defence in place.
H2 provides affordable and flexible one-off and ongoing data protection and cyber risk protection services.
When you are an owner or director of a company, you will have to face many challenges starting from employing the right people to protecting the sensitive data regarding the company, your workers, suppliers and clients, who buy products and services from you. Nowadays, data leakage prevention is essential in every business. Last week I touched on cyber security strategy, and I’ll expand on that a little more in a week or two, but I’ll just reiterate here that cyber security and data protection are inextricably linked, both practically and legally. They apply equally to the large corporate entities and SMEs alike. It’s purely a matter of scale. So, let’s dive in and learn more about the security and data protection services that you may wish to consider, having first identified your risks and come up with what is called a risk treatment plan, ie a plan to remediate the identified risks to an appropriate level, taking account of the residual risk that your organisation finds acceptable.
Cyber Security Defence – What Are the Most Common Services?
The Insider Threat
There are a lot of actions that can be taken regarding cyber defence. You need to cover both external and insider threat detection. We need to simplify, and where possible, automate our responses and solutions. The more complicated we make it, the more chance of it becoming a liability rather than a solution. The insider threat is one that is often misunderstood and in fact, often ignored. It is one of the most fascinating and alarming aspects of cybersecurity! It refers to the potential risks posed by individuals within an organisation who have access to sensitive information and can misuse it for personal gain or to sabotage the company. These insiders could be employees, contractors, or even business partners who have intimate knowledge of the company’s processes and systems. It’s like a real-life spy thriller unfolding right within the walls of your own organisation! The challenge lies in identifying and mitigating these risks before they cause serious damage. It’s an adrenaline-pumping game of cat and mouse that keeps cybersecurity professionals on their toes! It is important to note that many insider threats come not from any intended action by an employee, but rather a mistaken action taken by an employee who didn’t know they shouldn’t do whatever it is they had done. It’s a primary reason why cyber awareness training is so important. I can’t stress enough how important a comprehensive campaign of such training is.
To protect against insider threats you need, as well as awareness training, a good mix of procedural and technical security. You need a sound access control policy that clearly lays down how to onboard an employee, what access to allow, and how to protect against employees gaining privilege they don’t need and shouldn’t have. That policy should also cover off-boarding when an employee leaves. Here at H2 we have partnered with Cyber Elements to provide solutions to provide the correct provisioning in an easy to administer way.
External Threats
These are the threats that everyone thinks of when the subject of cyber security comes up. It can be very easy, such as identifying and blocking a virus, or it can be very complex. It all depends on the size and range of the problem. For example, ransomware protection. We have partnered with Platinum-HIT (UK) to provide the HDF concept. This provides a unique approach to anti malware and provides a good level of ransomware, and indeed, phishing, protection. On any computer system, data is stored either as non-runnable information data or runnable application programs. Malware is a type of runnable program with undesirable behaviours. HDF prevents malware infection by stopping malware program files from being stored and run on a computer. Simply put, if a program can’t run, it can’t infect your system. This does require a period of examination of your system to identify what does need to run, to run the business, and that is provided within the product.
We have introduced a fully managed proactive cyber defence solution that complements our data protection solution, described below, whilst remaining able to stand alone, in the unlikely event that the data protection element is not required.
In the dynamic world of cybersecurity, staying ahead of evolving threats requires a comprehensive approach that adapts to the ever-changing landscape. At H2, we recognize that one-size-fits-all solutions often fall short, which is why we’ve developed a flexible and scalable cybersecurity solution powered by Guardz, to address the needs of our clients.
Our approach is grounded in sound risk management principles, ensuring that our solutions are aligned with your specific cybersecurity requirements. Whether you need one or more of our solutions, we can tailor an approach that meets your exact needs and budget.
I talked earlier about the symbiotic relationship between cyber security and data protection, which of course includes data leakage prevention, data privacy and compliance. Once again, we have this covered. Our data protection solution is very comprehensive and looks not just at the technical, but also at the procedural aspect of data protection, from providing a virtual data protection officer, to writing and/or reviewing your policies and processes, to identifying where your data actual is, what it’s status is ie sensitive or non-sensitive, and provides the ability to encrypt the sensitive data in order to reduce your risk. If you have a data leak and the data is encrypted, then you are significantly reducing any risk.
Summary
All cyber security defence solutions are designed and implemented in collaboration with the client, during a trial period that consists of between 14 and 30 days, depending upon the solution. All actions can be performed remotely and online and there is no requirement for us to be on site, thus reducing time and expense. Additionally, all solutions are based on SaaS and therefore there is no expensive infrastructure or hardware requirements and being cloud based, it provides the additional advantage that it can monitor and protect end points regardless of where they are, in the office, on the move, or at home.
What’s the advantage of using a cyber defence managed service?
This will differ company to company, and some will have more of an issue, certainly regarding the protection of what is known as Personally Identifiable Information or PII, as defined in the Data Protection Act 2018. Each must decide what their threshold is for residual risk, ie what risk is acceptable to them, once protections have been put in place.
Professional cyber security staff are, currently, difficult to source. There is a global shortage of experienced personnel. They are also expensive to employ. You could also argue that there isn’t a full time job for more than one or two, in many organisations. It therefore makes both operational and financial sense, to outsource at least some of your security operations.
I read an interesting piece recently where the thrust was that true innovation consists of doing now what you should have done ten years ago. Harsh, maybe, but also fair. I’m constantly reading industry surveys which highlight the low level of cybersecurity maturity amongst large firms and, increasingly, an even lower level amongst smaller firms. We never seem to learn.
Of course, and as I’ve mentioned before, many of these surveys are written, or at least sponsored, by cybersecurity vendors and largish consultancies, who could potentially be seen as biased in that they are pushing their own solutions. But keeping that in mind, there is still and underlying truth.
My focus remains on SMEs, so I’ll skip more talk about the corporate world. In conversation with people I’ve worked with for years, their anecdotal evidence supports the underlying truth of these surveys. SMEs in particular struggle with the basics of good cybersecurity housekeeping, such as monitoring of basic network events, timely removal of user accounts, timely deployment of security patches, and revalidation of access level, particularly privileged access. This list is far from exhaustive. Whilst this message has been pushed over and over by cybersecurity professionals over the last 10-15 years, SMEs continue to rely on technical solutions which simply don’t stack up in many areas. Why? Simple, because they are relying on local IT providers to give them solutions and those IT providers continue to push the technologies that they sell. SME owners and managers are very reluctant to relinquish that argument. Strange when often the best solutions are procedural and as such, much much cheaper than a technology that probably doesn’t quite match up anyway.
Before we go any further, let’s briefly explore some issues that are common amongst SMEs. Some common myths first:
Small to medium size businesses are not worth attacking.
Cyber Security is an IT Issue.
Technology will keep me safe.
My policies and procedures are up to the job.
My staff are young and have been brought up with IT. They know the score.
Now let’s look at some of the more common issues that we see often amongst SMEs:
Lack of awareness around the current real-world cybersecurity risks
False sense of security, with a heavy reliance and dependence on an external IT third-party provider
Lack of cybersecurity knowledge, and understanding
Poor cybersecurity maturity and posture within their businesses
Lack of staff training (at all levels) – just like Health & Safety, cybersecurity is everyone’s responsibility.
Back to the topic in hand, innovation and how and when should we be seriously considering it. Ideally, we should be constantly looking for innovations, not just to keep us safe, but to encourage efficiency and cost savings, and I’m sure all SME owners would love to have the time and resource to do just that. But we live in the real world and will be cost, and resource constrained. But that’s not an excuse to not keep a weather eye on the need to innovate. We live in a changing world and what we in the business call the threat landscape, changes constantly. This simply means that threats evolve all the time, often to meet new circumstances, and AI for instance, is reducing the response time of cyber criminals to new technologies and changes in working patterns, to almost what is known as the zero day threat, ie zero days from the release of something new, to a threat being created to exploit it.
When COVID hit, many SMEs had to move very quickly to keep going, adopting remote working without the time or luxury of any real planning. It was a knee jerk born of necessity and certainly not the way they would have liked to do it. There are multiple cases of companies not having the necessary equipment, in terms of hardware, desktop, laptops etc, and allowing staff to work from home using their own home machines, connecting to both office and cloud-based systems, without any check on how those machines were configured, whether or not they were kept up to date with the latest patches, or whether they were used by other family members.
In terms of equipment, cloud usage and some working practices, that situation is righting itself, sort of. There are now surveys by HR consulting companies, suggesting that 60 to 70% of companies of all sizes are either planning to, or have adopted a hybrid model. In the IT industry, particularly amongst IT consultancies, this model has been in use for many years and is well regarded, allowing the downsizing of office space and a lower cost base. That new working model has arguably had the biggest effect on working practices and in turn, cyber security as it affects SMEs, since the innovation of IT itself.
So, what needs to be done if hybrid working patterns are to continue? Well, first and foremost comes your policies. Do they reflect the new hybrid working model? Have you laid down what is and what is not an acceptable use of company IT equipment if it’s being transported to a home address? Do you allow the use of home machines, and have you laid down how those machines must be configured before they can be used for company business? That list is not exhaustive.
Secondly comes user training. Cyber awareness training for staff, along with a broad understanding of data protection principles, becomes even more important when staff are working from home. It is a clear no brainer which many SMEs still don’t recognise as necessary.
Of course, those 2 things are hardly innovation, unless of course, you haven’t taken any of those measures and then it becomes innovative within your company. Real innovation perhaps comes from reviewing the technologies you have in place, and have relied on, possibly for years. Most, if not all those technologies will be based on the old bastion model of security, ie a network perimeter with a secure gateway, protecting your assets within that perimeter. With the new working model, relying usually on cloud connectivity, your staff could be working in the office, at home, from a coffee shop etc etc. You now have a mobile workforce. What is needed is real innovation that protects your data regardless of where it is, technologies which themselves are cloud based, not caring where the end point it is monitoring actually is, whilst maintaining cost effective pricing. This is something we’ve been at great pains to research and have now come up with such solutions.
We are holding a webinar to discuss and highlight these solutions and would love to see you there:
I’ve touched on this subject several times in the past but was encouraged to revisit it after reading a book by Jean-Christophe Gaillard entitled The Cyber Security Spiral of Failure. A provocative title and of course, the subject matter was aimed at the corporate sector. But my view is the difference between the 2 sectors, in terms of solutions is often one of scale, with corporations being more complex and faced with many problems that the SME sector doesn’t. They do however have the same threats and consequences of failure, as each other.
The author argues that for a couple of decades now, many organisations have been trapped in this spiral of failure, driven by endemic business short termism and the box-ticking culture of many executives in regard to compliance. This really does resonate in the SME world with short termism often driven by financial necessity and especially during and since COVID, where survival was paramount, often requiring day to day management. Of course, no SME owner or manager likes that and would love to have a solid and well-funded plan going forward, if only!
Successful transformation takes time and often requires changing the culture of the organisation, and this at a time when many owners are struggling with the emerging business practices of a more distributed work force, following the pandemic. Coming up with any transformative planning around IT naturally comes below that required for the business in general. Bottom line is often that if it isn’t our core business, it can wait. Even though of course, there are very few businesses that can continue to operate efficiently without their IT systems.
Which brings us to compliance. For most SMEs compliance often means data protection, although there are the financial services regulations, and many do have industry standards governing IT and data, that they must comply with. This often means that owners and managers undertake quick wins using box-ticking measures which often come a cropper sooner or later.
The book quotes from the BT Security survey released in January 2022. One aspect which I fully agree with is the emphasis on getting security basics right and the importance of awareness development amongst employees. Getting this right and training our employees are essential pillars of any cyber security practice, so as the book says, the question remains, why are we still banging on about it? – and everyone who reads my stuff knows I do that a lot.
There are a lot of traditional good security practices which have been pushed and re-emphasised time and time again. Patch management, access management, anti-virus/malware, firewalls etc, and from my time working in the corporate space, I know that large enterprises have spent millions on traditional areas of cyber security over the last 2 decades.
But are we really still stuck there, entrenched in traditional thinking when our working practices are changing, technology is changing, compliance requirements are changing?
SME management is often completely left behind by these changes. They have enough problems just keeping their businesses afloat and trying to grow, they don’t have enough time or resource to keep abreast of these many and varied issues. Let’s face it, if corporate management is struggling with this changing landscape given their resources, what hope for the SME.
More than half (54%) of SMEs in the UK had experienced some form of cyber-attack in 2022 (stats for 2023 are starting to trickle through), up from 39% in 2020 (Vodafone Study, 2022). As we travel around and visits clients or potential clients, it is common to find that they have the view that adequate security is provided by technology. They rely on their IT provider to provide the guidance they need which tends to involve firewalls, anti-malware software and perhaps a backup regime. All well and dandy. A quote from Bruce Schneier, Fellow at the Berkman Center for Internet & Society at Harvard Law School, goes like this:
‘If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology’.
So, what does he mean? As he’s not here to ask I suggest that he’s saying is that essentially the technology available can be an essential part of your protection but it has to be targeted in the right way, which not only means you have the right piece of kit doing the right thing, but that you are targeting your IT spend to support your business goals and give a maximum return on investment (ROI). It should also be married to good policies and processes that are enforceable and auditable and fully understood by your work force. To do this you have to understand exactly what your risks, vulnerabilities and threats are to ensure that your solution to those risks, vulnerabilities, and threats, is targeted for maximum effect and ROI and that the technology is supporting the policies and processes, all of which is underpinned with good security awareness training.
But now we have the ‘new normal’ with many businesses enjoying the financial bonus of having a smaller office footprint whilst many people work remotely, bringing with it an increase in security problems. Earlier we mentioned traditional security solutions that have been around for a long time, most of which pre-date the pandemic and were based on the old bastion security methodology ie a network perimeter, protected with traditional solutions. But that bastion model no longer exists in many places, or if it does, it only protects half the workforce in the office, whilst the other half work remotely. What is needed is new solutions that protect your staff wherever they might be working from.
In last weeks blog we talked about a company that was forced, by COVID restrictions, to move to working from home, and how that affected the organisations’ structure and ability to continue in business, and some of the difficulties they faced.
We reached a point where they had started to get back into the office but had decided to adopt the hybrid method of working, saving money on floor space, fuel and light etc. But this has come with problems of its own which we’ll look at now.
Hybrid working is something that many SMEs like because of the cost savings, providing of course that the business doesn’t require people on site, such as manufacturing, transport etc. Company’s such as lawyers, financial advisors/accountants, HR facilitators, recruiters and the like, can support hybrid working quite easily, from an operational standpoint.
Last week we saw that the 2 partners are aware that they hold a growing amount of personal and corporate data, not just about their own staff and systems but also about their clients. They were also aware of the Data Protection Act 2018 and GDPR but at a very surface level and were not sure about how much this will affect them. For example, in terms of policies, they have very little that references the DPA 2018 and/or GDPR. Their website does not contain the necessary privacy statement or statements regarding the use of Cookies. They don’t have an overarching security policy or a cyber security strategy in place.
So, what’s are the issues arising from last paragraph? Well, the DPA 2018, or UK GDPR as it’s becoming colloquially known, requires that data is processed and stored securely and that managers and staff are aware of the regulations regarding the safe processing and storage of information, which are quite extensive and can be daunting, but needn’t be an issue for SMEs, if not ignored. The ICO is, in my experience, very helpful in this regard and are not there to hand out heavy fines, threatening to put you out of business. If you can demonstrate that you have done your very best to obey the law, then they will be helpful and conciliatory. On the other hand, if you’ve been neglectful and even a little cavalier about it, then not so much.
But getting back to the case in point, these guys were now at the juncture where they had their staff working from home for about 3 days a week, and coming into the office on 2 days, unless of course they were consultants who were visiting client sites and were working on the move. Everyone now had a company laptop, including admin staff, and data was held on the cloud.
But what didn’t they have, and how would that affect the? Well, firstly they didn’t have a cyber security strategy in place. So, what is a cyber security strategy? It’s a plan that outlines an organisation’s approach to protecting its digitally held assets and information from cyber threats. This strategy typically includes policies, procedures, technologies, and practices that are designed to prevent, detect, respond to, and recover from cyber-attacks. People, Process and Technology combined and integrated to provide protection.
This needn’t be scary, and you can pick and choose what is important to your organisation, what needs to be comprehensive, and what can be less so. The level of risk you are prepared to take, is entirely your call. Key components might include:
Risk assessment: Identifying and prioritizing potential threats and vulnerabilities to the organization’s systems and data.
Security controls: Implementing technical and procedural measures to protect against cyber threats, such as firewalls, encryption, access controls, and employee training.
Incident response plan: Establishing protocols for responding to and recovering from security incidents, including communication plans, containment strategies, and forensic analysis.
Continuous monitoring: Monitoring systems and networks for suspicious activity or anomalies that could indicate a security breach.
Compliance management: Ensuring that the organization complies with relevant laws, regulations, and industry standards related to data protection and privacy.
What the management is doing here, is laying down a framework for how things need to be developed. It doesn’t need to happen all at once,
Not having formulated a strategy, the company didn’t have much of this in place, and what it did have wasn’t well structured and integrated. The security products in use were stand alone, working independently of each other. Another major flaw was that they had no cyber awareness training in place, neither did they have effective policies. Those that they had were downloaded from the internet as a box ticking exercise. They were in fact a cyber disaster looking for somewhere to happen.
The 2 partners were aware of these issues and yes, they took some time to get around to addressing them simply because recovering the business from the issues arising from COVID, took precedence. But they realised that this couldn’t be put off for any longer and took action.
They engaged with us to first carry out a Cyber Maturity Assessment. This covered:
Cyber Security Strategy.
Cyber Security and Data Protection policies.
Protective monitoring and vulnerability assessment.
Incident response and business continuity planning.
Access control.
Employee awareness training.
Compliance.
Technical Security
The strategy they needed could be very much simplified to meet their requirements, but it did cover the salient points and gave a clear indication of what was needed immediately, what could follow and what was more of a nice to have rather than a necessity. To that end we were able to structure remediation that was phased over a number of months, covering 2 budgetary periods.
End result, they had a solution that was affordable as well as appropriate to them. It covered staff in the office, working from home and on the move. It kept them compliant with the relevant legislation and set them up to achieve a standard such as Cyber Essentials, which is next on their list. If necessary, they could even go as far as ISO2700x series, although that might not be appropriate for them at their current size.
This is a tale that could be told regarding many organisations, especially since COVID hit. Names have been changed and certain other details have been omitted or masked.
Hawk Engineering Ltd is a company that provides high quality environmental engineering services to its clients, and began operations on 16 July 2019, not long before COVID hit. It’s a limited company owned and operated by Norman Jones and Rupert Smith. Mr. Jones and Mr. Smith both left their respective jobs to specialise in environmental engineering consulting to small and medium sized businesses.
The company was set up to target small to medium sized companies and government organisations within the UK. They have managed to secure several contracts and have grown from the original 2 man team to 8 consultants/engineers and 3 support staff, housed in a serviced building where they rent 4 rooms, one for the admin staff, one for the consultants, another for the 2 partners and a small conference room. The support staff cover finance, HR and general admin duties. The building shares a reception area and a cleaning contract. The cleaners operate out of hours, cleaning after everyone has left for the evening. The consultants are provided with laptops, tablets and smart phones whilst the admin staff use desk top PCs, and all are connected to a large printer.
Rather than ramp up its permanent staff too quickly, they use relevant qualified consultants when necessary. These consultants are given an email address and access to the data they need to work on projects.
The 2 partners are aware that they now hold a growing amount of personal and corporate data, not just about their own staff and systems but also about their clients. They are aware of the Data Protection Act 2018 and GDPR but are not sure about how much this will affect them. They have a local IT management company under contract and up to the start of COVID had an onsite server which stored their data and an email server providing mailboxes to the staff and contractors. At the outbreak of COVID, this caused an issue.
In terms of policies, they have very little that references the DPA 2018 and/or GDPR. Their website does not contain the necessary privacy statement or statements regarding the use of Cookies. They don’t have an overarching security policy or a cyber security strategy in place.
But everything in the garden was rosy, the company was doing well, it was in profit and had a relatively full order book, at least for the foreseeable future. And then along came COVID and everything changed.
At first it wasn’t a problem, we all remember how the UK ramped up relatively slowly, with lockdowns coming after those in other countries, but come along they did. The full implications of not being able to work in the office only started to become apparent after the office was out of bounds. They couldn’t claim any sort of immunity because they were simply not in an industry that required such immunity, so the office closed. The consultants used laptops and they could continue to work, but not securely. They didn’t have a remote access system in place as consultants worked on client site and tended to use client networks through which they could connect. Not optimum but cheap and cheerful and cash flow was everything to a small business. The real hit was on the admin staff as they used desktop PCs which they had left behind when they went home.
So initially the admin staff were the priority to find a solution for and the first issue was to be able to find machines they could use at home, and then connect them to the office file and mail servers, the latter applied to consultants as well.
I’m sure most reading this will remember the issues as many of you will have faced the same problems. So long story short, the problem was to establish as near to normal operations as possible and they ignored security as firstly, they didn’t grasp the implications, and secondly, they didn’t know what to do about it. Their IT management company wasn’t a lot of help in the latter regard simply because they were firefighting issues for all or most of their clients and didn’t have the time or resource, and frankly, didn’t really have the skill set either.
In many respects recovering an operational capability in that instance, wasn’t much different in recovering from any natural disaster and much of the planning required for a disaster recovery and business continuity situation, would have applied, with perhaps the difference that the office would continue to be out of bounds. So, plans could be adapted, assuming of course you had a plan in the first place, and they didn’t.
What they were able to do was to set up a contract with a cloud provider and as their IT support got some bandwidth, they migrated their data from the office based server to the cloud storage and at the same time migrated their email. Getting staff to connect to the cloud was an issue and some found it easier than others as that had to be done remotely and some were more IT savvy than others.
It didn’t solve the desktop PC problem though and staff continued to use home PCs, the same PCs their kids were gaming on, to connect to the company data. A recipe for disaster. Of course, this was solved by purchasing and shipping laptops which the IT support set up before shipping. But by then their data could easily have been compromised via the home PCs. There is no way of knowing whether or not they were compromised and if this is a problem which could come back to bite them.
Work-from-home employees are at much greater risk than those in offices. Since home connections are less secure, cybercriminals have an easier entry into the company network. Furthermore, the explosion of various online tools, solutions, and services for collaboration and productivity tend to have the bare minimum of security default setting, and updates from third-party vendors can change security preferences and be easily overlooked.
Phishing becomes an even greater threat to home workers, often because, in an office environment, they have access to colleagues and managers, who they can approach for advice and guidance. This is much harder to replicate with remote workers, especially those who may not be particularly tech savvy and who may not wish to become ‘burdensome’ to their co-workers.
Ransomware also enjoys an advantage in the work-from-home model. If their connection to the company is blocked, it is more difficult for workers to get assistance from the right experts and authorities. And since trust levels are lower when working from home, some workers will be concerned that they have “done something wrong” and so may be more reluctant to seek help. While this risk can be addressed by increased training, as well as messaging that vigilance and involving IT support will be rewarded, it can still be an uphill battle.
The company has now evolved further, and expanded a little, and has adopted the hybrid method of working, saving money on floor space, fuel and light etc. But this has come with problems of its own which we’ll look at next week.
These stories are fictitious but are based on real events with the company names, locations, and industry vertical either changed or obscured.
Company One
ABC Ltd is a chain of financial advisors which has seen strong growth even allowing for the hiccup of the COVID lockdowns. It has grown from one site nearly 20 years ago, to six sites situated in rural market towns in the East of England. As with nearly everyone else, COVID has significantly changed the way they operate as they were forced into home working and never went back to being fully office based and are now operating a more distributed hybrid working pattern, with staff working between offices and home. This hasn’t proven to be an issue and has some financial benefits, reducing the office footprint, fuel and light and travel costs. Their clients, consisting of local businesses mainly but with a significant department looking after individuals, have not been impacted by these changes.
John is the finance director, and he was given the additional responsibility for IT, something not unusual in SMEs, as they can rarely afford their own in house IT experts. This has led to John outsourcing the IT to a local IT management company and so far, they have had no complaints. Although John doesn’t profess to have any in depth IT knowledge, he discussed their requirements in detail and accepted that a move away from onsite servers and storage to a cloud based system made perfect sense and lent itself to the distributed network they now operated.
However, he had some concerns around cyber security. He read a lot and what he read worried him, particularly about things such as ransomware, phishing, social engineering and scamming. He knew that they held considerable amounts of personally identifiable information (PII) as defined by the Data Protection Act or UK GDPR as it is becoming known, and he had heard horror stories of company’s being fined a lot of cash for losing that data. So, John decided to bring to bring this up at a board meeting and was met with some resistance from the CEO and other board members. They asked what advice he was getting from their IT providers, and he said not a lot. They seemed to be happy with the defences in place, which relied on firewalls in the office, and personal firewalls on remote laptops and desktops, anti-virus software and secure channels for sending data to and from the cloud storage. The cloud provider operated under Ts&Cs which seemed to ensure that they took responsibility for the secure storage of their data. He was concerned that not all their data was stored on the cloud, even though it was supposed to be. He knew that staff working from home downloaded data onto their laptops, worked on it, and then uploaded it. He was sure they ever deleted the copy they had on their laptops and had no way of checking. He was also sure that data was attached to emails and sent around, so there would be copies on the email server, and on email clients. But he was told to forget about it as it wasn’t a priority for funding.
Jumping forward a couple of months and staff were panicking, and his phone was ringing off the hook as IT user after user was seeing a red text box sporting a skull and crossbones and the message that their data was encrypted, and if they wanted to unencrypt it, it would cost £50,000. The CEO convened an emergency board meeting, and the IT provider was dragged in. It didn’t take long to ascertain that this was a sophisticated attack and when they attempted to access their cloud storage, they found that the data held there, was also affected.
The CEO asked the IT provider how long this would take to fix, if indeed it was fixable. He replied that they did have two sources of backups of the data, online and offline. The problem was that the online data could also be affected and so the safest recourse was the offline backup, but that was only done weekly and therefore they would lose at least 3 days’ worth of data. The CEO was not pleased. Added to this, John wasn’t happy with just fixing the immediate issue, he wanted to get to the bottom of how this happened and how can they stop it in the future. He contacted a specialist cyber security company that was fairly local to them. Modesty forbids me to mention their name.
Once onsite they identified that there needs to be two strands to this. First and foremost, the company needs to be gotten up and running, which means restoring from backup. But there is no point doing that if the ransomware is still sitting on their systems because it would merely encrypt the backup. It’s never that easy. How did the ransomware get on the systems, how deeply is it embedded, how did it get on the cloud storage etc. How it got there was quite easily detected. It was simple email scam sent to around half of their workforce, at least two of whom clicked on it. Once that was done it spread itself around the system, infecting all connected machines, and easily jumped to the cloud storage and even the online backup, which was connected to the cloud storage itself.
From then it was a simple but painful exercise which took best part of a week to sort out. In order to be safe and thorough, all machines were wiped, including the operating systems, and then the OS reinstalled, along with all the applications. Meanwhile they worked with the cloud storage provider, who was cooperative, to clean up their servers. The data was then installed from the offline backup.
It was estimated that they lost money well into 6 figures, including fixing the problem, and lost business whilst it was all sorted out. Trying to get back the 3 days’ worth of data lost, was embarrassing. But at least they didn’t cave in to extortion as some might have, as we’ll see below. Luckily there was no indication of a data breach which sometimes accompanies ransomware attacks, so no involvement of the Information Commissioner and the embarrassment of having to contact clients about their personal information. It could have been worse.
Recommendations asked for by the board included:
Cyber Security Awareness training for all staff, including induction and 6 monthly refreshers.
Revisit the anti-virus/malware in use to see if there is a better solution for ransomware.
Revisit protections for the data itself. Do they know where it all is? Can it be audited? What about encrypting it themselves before anyone else can? It might not protect against ransomware, but if a data breach happens, it will avoid ICO fines.
Revisit the backup routines.
Have a solid disaster recovery and business continuity plan to avoid ad hoc and inevitable knee jerk responses.
The ransomware code required privileged access to do the real damage. It got it easily. Revisit the privileged access management system in place. Is it up to scratch?
Consider annual cyber security health checks.
Consider adhering to a standard such as Cyber Essentials or perhaps even ISO27000 series.
Company Two
Company Two was a transportation and storage company which operated from one site and its core business was transporting and storing produce before it was moved on to the consumer chain ie supermarkets and the like. As such they had 3 large cold stores which were of course temperature controlled and any prolonged period without temperature control could cost the business thousands in a relatively short space of time.
The problem was that their security architecture was still based on the old bastion model of having a secure perimeter, protected by firewalls, but once inside, there was no segmentation, ie once in, the world was your oyster and the temperature control systems were on the same network as the other IT systems, with nothing separating them.
At this point the same thing happened to them, as happened to Company One. They received the ransomware message which was even more damaging because it not only encrypted their data, but it knocked out the temperature control systems. This meant a more sophisticated attack than just embedding malware in an email, the attackers must have gotten into the system and identified a serious weakness that they could exploit.
This wasn’t as difficult as it seemed. There were several weaknesses in their defences. First, they had changed broadband provider, but the old broadband connection was still active and connected to their network. Second, they had security cameras which were remotely maintained. These cameras were also on the main network and therefore there was a remote backdoor into the system. There were other weaknesses, but these will do as explanations as to what happened.
As the gravity of the situation dawned on everyone, the decision was made to pay up and prevent a potential disaster in regard to the cold stores. Understandable I suppose but ultimately not a good solution. They did get back online within half a day. So far so good. But they wanted to make sure that this couldn’t happen again and so they called in some cyber experts to look things over. What was discovered was quite horrifying. Firstly, the attackers left a back door into the system which was discovered and closed down. This would have allowed the attackers easy access to do it all again. The issue with clicking on a dodgy link was also raised. But the real problem was that it was discovered that the ransomware attack was used to also disguise the theft of data. Missing was a considerable amount of financial information, including bank account details not just for them, but for their customers and suppliers, and PII relating to their customers and suppliers, but nothing too damaging other than business email and postal addresses. Luckily their HR and payroll was outsourced and so they held very little about their staff. Nevertheless, it was estimated that the cost of this breach would eventually reach 5 figures.
Lessons included very much the same as Company One but with the addition of having a security architecture review with the aim of tightening things up and introducing network segmentation.
Summary
Cyber security is a business issue not an IT issue. It’s the business that suffers, not the IT support.
Cyber Awareness training is the biggest and cheapest quick win that any company can take to protect itself.
Make sure your backups are adequate and up to date.
Make sure you have a disaster plan to recover from an attack.
Make sure you have a business continuity plan to continue working whist you recover from a disaster.
Make sure you privileged access management is adequate.
Make sure your anti-malware solution is the best available to protect against modern threats.
Don’t be complacent. Just because your cloud provider is popular, doesn’t necessarily mean it’s up to par.
Don’t rely on firewalls alone, the bastion model of security is well out of date now.
Consider adhering to a standard such as Cyber Essentials or perhaps even ISO27000 series.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
Recent Comments