Ransomware, Phishing and other Malware Archives - Page 2 of 5

Remote Working and Encryption

This is a subject that I tend to jump on every so often, because it’s one that people just don’t seem to get. Whether it’s working from home, from a coffee shop, airport, railway station etc, there is this perception that it’s safe because you’re connected via VPN, or perhaps some other form of application which encrypts data in transit. Well, let’s explore this subject a bit further.

There is no doubt that the propensity for working from home, or other remote locations, since COVID has introduced some very difficult, or at least challenging, security vulnerabilities into your network. For instance, prior to the pandemic, when you were 100% office based (except perhaps some mobile salespeople), your local IT provider will have almost certainly set up what we called the bastion security model. Ie, like a castle, a bastion, you had a wall around you, and for belt and braces, you also had a moat. The gateway was robust, had a drawbridge and portcullis, or let’s call it a secure firewall and anti-malware system. Everything was locked up inside and nice and secure (in fact it probably wasn’t but that’s for another day).

Whilst Microsoft didn’t invent the term the ‘new normal’, they were the first, I believe, to apply it to IT, following the enforced change in working practices brought about by the pandemic. Many companies have embraced this new normal and have settled into some form of hybrid working. Of course, this is nothing new, it’s been ‘a thing’ for years now, certainly regarding corporate organisations. The real change came about in SMEs for whom it really was quite revolutionary. Corporate bodies will have spent a lot of money on a variety or remote access systems to keep their data secure, whilst SMEs not only had to rush unprepared because of the pandemic, but they simply didn’t have the budget to employ more secure connections.

What the pandemic has done is change that, or perhaps arguably, accelerated the change to a more distributed way of working, already underway in corporate organisations but now common amongst SMEs. What does that mean for us? Firstly, we have to re-think how we are going to work. We start from a position where we still have preexisting tech, such as VPNs and whole disk encryption, to tackle modern and evolving issues.

So, what about VPNs? What are they? A VPN, or Virtual Private Network, is a service that creates a secure, encrypted connection between your device and the internet. This private “tunnel” protects your data and hides your IP address, effectively masking your online identity and activity. It works by allowing you to connect to the internet via an encrypted tunnel to a VPN server, which then forwards your requests to the website or service you’re accessing. The benefits are that it protects your data from being accessed by hackers or eavesdroppers, especially on public WIFI. It masks your IP address and replaces it with one from the VPN server, so it’s harder for websites, advertisers, or even your ISP (Internet Service Provider) to track your online activity. It’s particularly useful when working from insecure public WIFI but should also be used when working from home.

VPNs are available as standalone apps and more often now, incorporated into other applications, particularly those used to connect to cloud services.

All good, right? Well yes, anything that helps secure your data is a good thing. But like all good things it has some downsides. A VPN does help protect data in transit over an insecure WIFI connection by encrypting the data you send and receive over the internet. This means that if you’re connected to an insecure WIFI network (like in a coffee shop or airport), the VPN will prevent anyone from intercepting and reading your internet traffic.

However, a VPN does not protect data stored locally on your laptop. Files or personal information saved directly on your hard drive are not protected by the VPN. To secure the data on your laptop, you may want to consider using additional protections such as some sort of full disk encryption (BitLocker for Windows or FileVault for macOS are standard with the operating systems) to protect data at rest. And you should be using strong passwords and multi-factor authentication.

So, what I’m saying here is that should someone manage to gain access to your end point ie your laptop, desktop, even your phone, then your VPN is not going to protect you.

Let’s now talk a bit more about Bitlocker and FileVault. BitLocker, Microsoft’s disk encryption tool, provides robust security when configured properly (but I make the point here that it’s often not only incorrectly configured but isn’t even in use, making it pointless). And, like all encryption systems, its security depends on several factors, including the version of BitLocker, implementation practices, and potential vulnerabilities in the system environment. Bitlocker uses strong encryption, either AES 128 or 256 Bit, both of which are considered secure.

FileVault is the MacOS equivalent of Bitlocker (roughly) and is considered secure and built into the MacOS and is very easy to switch on. It too offers full disk encryption using AES 128 or 256 Bit. Once again though it is often not in use by Mac users, many of whom don’t even know it exists.

Are there any drawbacks to whole disk encryption? Will it protect me against things like ransomware? Whole disk encryption is designed to secure data at rest by preventing unauthorised access to data on a physical storage device (e.g., in case the device is lost or stolen). The problem is that once the machine is booted up, using the correct authentication, the disk is unencrypted, allowing you access to the data. So, the answer to the specific question re ransomware is that such an attack is typically not mitigated by this kind of encryption because:

Ransomware Operates at the OS Level: Once a device is booted up and the encrypted disk is unlocked (usually via user login), ransomware can interact with files just like any other software. Since the operating system has access to the data, the ransomware does as well.

Ransomware Encrypts Data Independently: Ransomware generally works by encrypting the contents of individual files or directories (not the entire disk), effectively “locking” them within the already-decrypted environment. BitLocker, or any full disk encryption, won’t stop ransomware from doing this, as it doesn’t interfere with file operations once the system is unlocked.

No Version Control or Rollback: Whole disk encryption solutions don’t provide a way to revert to previous file versions or recover from ransomware encryption. This is where regular backups (stored separately from the network) play a critical role in protecting against ransomware.

You’re being careful, you have a VPN, and you have Bitlocker configured on your laptop. You’re feeling nice and secure and have no issues using the local Coffee Shop or your home WIFI. Your connection to your cloud service is secure and all your data in transit is encrypted. Even your email is going via a secure tunnel. All is good with the world. Except of course that as soon as you logged on your whole disk encryption is switched off and your data is vulnerable even before you transmit it. Any data you download to work on likewise becomes vulnerable as soon as it lands on your laptop.

Earlier I argued that VPNs were old tech being used to combat modern threats and a different way of working. Does that mean that I think the VPN is no longer useful and is going out of style. No of course not, VPNs have a very real place in our security architectures and that won’t go away anytime soon. But they, like the vulnerabilities they are trying to mitigate, have to evolve and keep pace with present day and future realities.

VPNs, whether stand alone, or incorporated into another technology are great at securing data in transit. What about your data at rest? The best VPN in the world won’t protect you from someone who is determined to get in and steal your data or install ransomware. The problem for SMEs is the same that it pretty much always has been. Cost. Can they afford a system that will protect their data and stop it being lost, stolen or ransomed.

What has long been needed is a simple, flexible and intuitive security solution. We believe we have found such a system that protects your company against all known threats, and puts you firmly in control of your data, working automatically 24/7 to identify and safeguard your sensitive information.

Delivering multi-level protection, it provides real time control over all sensitive data. You can identify and solve every problem with a single click of your mouse! Instead of whole disk encryption, which is decrypted as soon as you log on, it provides file level encryption which allows authorised users access but no one else. But it does more, it locates all your data, allows you to decide what is, and what is not, sensitive, and provides subscription pricing for a fully managed solution.

It’s a system that is designed specifically for SMEs and is therefore appropriate to you, and affordable. To prove that we offer a 30-day free trial so that you can see it for yourself. Check it out at https://hah2.co.uk/gdpr-data-protection/.

Ransomware and the risk to SMEs

There’s a lot of FUD (fear, uncertainty and doubt), going around about Ransomware, and it has to be said that a lot of it comes from cyber security companies. But amongst the rocks there are some very real diamonds that need the publicity. There is a very real difference between genuine information and propaganda. I hope what I do is spread information.

There is a prevailing feeling amongst small and medium-sized enterprises (SMEs) that they are not a desirable target for Ransomware and it’s therefore not a problem for them. However, that’s simply not true and they are increasingly vulnerable to ransomware attacks, with recent trends showing a notable rise in these incidents among smaller businesses. Several factors influence the likelihood of SMEs being targeted:

Widespread Targeting: SMEs are often viewed as “soft targets” because they may lack the advanced cybersecurity defences of larger corporations. Attackers assume that smaller businesses may have fewer resources dedicated to security, making them easier to compromise.
Increasing Ransomware Attacks Overall: Ransomware attacks globally have been on the rise, and attackers have shifted their focus to include not only large enterprises but also smaller organisations across various sectors. This is often due to the lower cost of launching ransomware campaigns, allowing attackers to spread wide nets with mass phishing campaigns and automated attacks.
Financial and Operational Impact: Many SMEs are attractive to attackers because the disruption from ransomware can be financially devastating for them. SMEs may feel greater pressure to pay the ransom to restore operations quickly, fearing the loss of business or reputation if the downtime persists.
Underinvestment in Cybersecurity: SMEs often underinvest in cybersecurity due to budget constraints, lack of expertise, or other business priorities. This underinvestment can lead to outdated software, limited employee training on cybersecurity best practices, and weaker defences that attackers can exploit.

Likelihood and Statistics

High Likelihood: Studies show that more than half of SMEs have experienced a cyberattack in the last year, with ransomware being one of the most common types of attack.
Small Business Victimisation: According to a 2022 survey by the Cyber Readiness Institute, nearly 60% of small businesses were targeted by cyberattacks, and a significant portion of these involved ransomware.
Increasing Cost: For many SMEs, the average cost of a ransomware attack, including downtime, lost revenue, and recovery expenses, can be as high as £50 to a £100K, making the financial impact severe and sometimes unmanageable without external assistance.

Key Risk Factors for SMEs

Lack of Security Awareness and Training: Employees at SMEs may be less well trained on cybersecurity threats, increasing the risk of phishing and social engineering attacks that lead to ransomware.
Lack of Backup and Recovery Plans: SMEs may not have effective data backup or disaster recovery strategies, making them more susceptible to extended downtime or paying the ransom.
Weak Network and Endpoint Security: Limited resources often mean that SMEs may not have enterprise-grade firewalls, intrusion detection, or antivirus solutions, leaving systems exposed to exploitation. They also struggle with the distributed work practice (office, home etc) that has happened since COVID.
Encryption: Data is often unencrypted on end point machines.

Reducing the Risk

While the risk is high, SMEs can take measures to reduce the likelihood and impact of a ransomware attack:

Implementing Regular Backups: Ensuring data backups are frequent, secured, and tested for restoration can significantly reduce the impact of an attack.
Employee Training: Conducting regular training to recognize phishing and social engineering can help employees avoid common attack vectors.
Monitoring: No or inadequate monitoring of their data and systems, including home and other remote workers.
Endpoint and Network Security: Investing in antivirus software, firewalls, and network monitoring can improve defences.
Cyber Insurance: Purchasing cyber insurance can help mitigate financial losses associated with an attack.
Data encryption.

In summary, while SMEs face a high likelihood of ransomware attacks, increasing awareness, preparation, and proactive defence measures can substantially reduce both the risk and the impact of an attack.

What is the impact of a Ransomware Attack?

Ransomware can have devastating effects on small and medium-sized enterprises (SMEs). Here are some of the key impacts:

Financial Losses

Ransom Payment: If SMEs decide to pay the ransom (which is not generally recommended), this can result in significant, sometimes crippling, costs.
Operational Downtime: Even if no ransom is paid, businesses often experience significant downtime as they attempt to recover systems, which can halt revenue generation and lead to lost sales.
Recovery Costs: In addition to the ransom, SMEs incur expenses related to data recovery, IT support, and forensic investigation. Often, additional security solutions are needed to prevent future attacks.

Loss of Data

Data Encryption or Destruction: Ransomware can lead to the permanent loss of critical data if files are corrupted or remain encrypted after an attack.
Loss of Sensitive Information: SMEs may lose access to sensitive customer or business data, leading to gaps in operational records or strategic plans.

Reputational Damage

Loss of Customer Trust: Ransomware attacks, especially if customer data is exposed or operations are disrupted, can damage customer confidence. Many SMEs rely on personal relationships, and a ransomware incident can harm these relationships.
Brand Damage: Businesses often struggle to rebuild trust, and reputation damage may deter new clients and weaken partnerships with vendors or other business partners.

Legal and Regulatory Consequences

Compliance Violations: If SMEs operate in regulated sectors (like finance, healthcare, or legal services), a data breach can lead to violations of regulations like GDPR, resulting in fines and other penalties.
Legal Liabilities: Affected customers or vendors may pursue legal action if sensitive data is compromised, adding further financial strain.

Operational Disruptions

Halting of Services: For many SMEs, especially those without a strong IT infrastructure, ransomware can paralyse day-to-day operations.
Long Recovery Times: SMEs often lack the same level of IT resources as larger enterprises, so restoring full operational capacity after an attack can take weeks or months.

Employee Productivity and Morale

Reduced Productivity: During and after a ransomware attack, employees may be unable to work if they lack access to necessary files, email, or software.
Psychological Impact: The stress and uncertainty from a cyberattack can lead to anxiety or frustration among employees, potentially impacting morale and retention.

Increased Insurance Costs

Higher Cyber Insurance Premiums: Cyber insurance costs tend to increase significantly for companies that have experienced ransomware attacks. Additionally, insurers may demand proof of enhanced security measures to continue providing coverage.

Pressure to Strengthen Cybersecurity Measures

Increased Security Costs: Post-incident, SMEs often must invest in more robust cybersecurity infrastructure, including advanced threat detection, backup solutions, and employee training.
Ongoing Monitoring Needs: Ransomware may prompt SMEs to adopt more rigorous monitoring and endpoint protection tools, leading to continuous IT spending.

Ransomware attacks can be particularly harmful to SMEs because they often have fewer resources for cybersecurity, and a single attack can have a prolonged impact. Many SMEs lack a full-time IT staff or robust data backup protocols, which can compound the impact. Consequently, proactive measures, such as employee training, regular data backups, and up-to-date cybersecurity defences, are critical to reducing the likelihood and impact of ransomware attacks on SMEs.

What Do SME Owners and Directors Want From Cyber Security?

I wrote a post earlier this week exploring what SME owners and directors really care about when it comes to cyber security! Do they really care about the how the latest technological solutions work? Do they really care about the scare stories, or at least, do they really think that they apply to them. Oh, they might have a sneaky suspicion that it could be a problem but is it on their mind enough for them to do something about it.

The argument was made that this is especially true in an economic downturn when they are focused on costs, even more than they normally are. They want robust cyber security solutions that don’t cost an arm and a leg. And what they don’t want is jargon and tech speak that they feel is aimed at bamboozling them with science in order to convince them they should buy something that they don’t actually need.

We are believers that what is needed is simplicity. SMEs are looking for user-friendly security measures that don’t require a PhD in Cyber Science. They don’t want jargon or even industry metrics. Remember the KISS principle – Keep It Simple Stupid.

Of course they are going to have a focus, and you need to understand what is important to them and what isn’t. That will depend on the nature of their business to a great extent. Whilst there are commonalities regardless of the vertical they work in, there will always be differences, some big, some more subtle, that will impact any cyber security solutioning.

Nowadays many SMEs are increasingly aware of cybersecurity risks, but a significant number still underestimate the importance of cybersecurity risk management. SMEs often face unique challenges in this area due to limited resources, competing priorities, and often a lack of expertise not just in their organisation but also in the IT support company’s they use. Here are some insights into the current landscape:

Growing Awareness: SMEs have started to recognise that they are just as likely to be targeted by cyber threats as larger companies, partly due to high-profile ransomware attacks and data breaches affecting businesses of all sizes. As a result, awareness is rising, especially as more businesses transition to digital platforms and remote work, which increases exposure to cyber risks.

Resource Constraints: For many SMEs, the cost of robust cybersecurity measures can be prohibitive. They often lack dedicated IT and cybersecurity teams, which makes it challenging to implement and maintain comprehensive security protocols. Cybersecurity solutions can be expensive, so SMEs may prioritise short-term operational needs over what they might perceive as longer-term security investments.

Risk Perception and Underestimation: Some SMEs mistakenly believe they are too small to be targeted by cybercriminals, assuming that attackers primarily focus on large corporations. However, this “security by obscurity” mindset has been proven false, as attackers often view SMEs as easier targets due to their weaker defences.

Impact of a Breach on SMEs: Unlike larger companies, SMEs are less likely to recover from a significant cyber incident. A data breach or ransomware attack can be devastating, leading to financial losses, reputational damage, and even closure. Despite this, many SMEs may not fully understand the potential scale of these consequences.

Compliance and Regulatory Pressure: With increasing data protection regulations (e.g., GDPR, PCI), SMEs are under more pressure to adopt better cybersecurity practices to remain compliant. This has led to greater awareness among some SMEs, especially those handling sensitive data like healthcare, finance, or customer and payment information.

Cybersecurity Awareness Training and Culture: Even when SMEs implement some cybersecurity measures, they may lack the necessary employee training and risk management practices that foster a security-focused culture. Human error remains a leading cause of data breaches, so SMEs need to prioritize employee awareness and training.

In summary, while awareness of cybersecurity risk management is growing among SMEs, gaps remain, particularly around adequate investment, robust risk perception, and ongoing management of cybersecurity threats. Cybersecurity can seem overwhelming for small businesses, but as the digital landscape continues to evolve, understanding and addressing these risks is becoming essential for SME survival and growth.

Cybersecurity Awareness Month

Did you know that October is Cybersecurity Awareness Month? No – not terribly surprised after the poll we put out asking how important this subject was. The response was truly frightening. Cybersecurity Awareness month has participants in many countries and sponsored by many governments and tries to push awareness of the importance of this subject, across all industries.

Why do we think it’s so important? Why would an SME bother with it? Well, in short, it’s probably the single most cost effective and quickest win you can make. It really doesn’t have to cost a fortune, it’s not techie if done right, is educational and it beefs up your security by ensuring your staff can spot a scam when they see one, can recognise social engineering and how to counter it, won’t open a rogue email and it generally keeps the subject in the forefront of minds.

OK, but what’s the threat? Do hackers/scammers prey on SMEs? Is there sufficient financial reward there for them? Yes, yes and again yes. The UK GDP is made up of north of 90% from SMEs. Just think about that – 90% of the countries wealth is generated by SMEs, so a huge financial target. The big companies spend a fortune on cyber security protections. Most spend up to 15% of their annual IT budget on security and when you think that the IT budget often runs into millions, that’s big bucks. SMEs can’t afford that and that makes them a much easier target.

I wrote a blog recently about the findings of the 2024 cyber security breaches survey. The report tells us that among businesses, there has been a shift in the proportion saying cyber security is a “fairly” high priority (e.g. from 35% of businesses last year, to 40% this year). The proportions of businesses saying it is a very high priority is consistent with last year (36% last year and 35% this year). In 2023, as evidenced by the qualitative interviews, it was felt that cyber security had moved down the agenda among the businesses where it was already seen as a more marginal priority, and among businesses that typically have the fewest resources to deploy. The qualitative findings this year point towards an increased awareness of the risks that are faced when not prioritising cyber security, which could explain the increase in businesses this year rating it as a high priority.

It is more common for larger businesses to say that cyber security is a high priority (93% of medium businesses and 98% of large businesses, vs. 75% overall). The same is true for high-income charities (93% of those with income of £500,000 or more, vs. 63% overall). This continues the pattern seen since 2020, where larger organisations tend to treat cyber security more seriously, and consequently allocate more resources to it.

Businesses in the following sectors tend to treat cyber security as a higher priority than others:

information and communications (65% a “very” high priority)
finance and insurance (61% say it is a “very” high priority)
health, social care and social work (62% a “very” high priority).

These percentages are still very low and amongst this, if we drill down, we will find that the prevailing answer amongst SMEs remains to reach for technology for protection. Technology will help, but it isn’t the full answer. When faced with constraints such as a tight budget it’s essential that a business prioritises its spend, making sure that it is targeting what really needs protection, and making sure that the protections in place are actually doing what you think they’re doing. That is essentially what we refer to in regard to risk management. It’s a business issue, not an IT issue.

In the 2024 survey, half of businesses and around a third of charities report having experienced some kind of cyber security breach or attack in the last 12 months. As in previous years, larger businesses and charities are more likely to identify breaches or attacks than smaller ones. This latter point is worth mentioning because it’s generally only the larger businesses that have some kind of monitoring in place to identify an attack and many smaller businesses only find out when they start losing money.

Of course, good old COVID has had its effect, and I know we still bang on about it but that’s because its effect is long term. It has changed our working practices in many respects although there is more of a move towards a return to the workplace currently, but some businesses have embraced the hybrid working practice and look unlikely to change. My own client base has only seen one client move to 100% remote working, but they are all working some form of hybrid working pattern.

Many corporates have had some form of hybrid working for a long time, pre-COVID. When I was at HP and before that in Symantec, we worked the hot desk system with people working remotely a couple of days a week. It’s not new at that level but it is at the SME level, and we need more sophisticated ways of protecting ourselves at a price we can afford. And that’s been the focus for us, and we are now confident that we have solutions that fit an SMEs requirement, at a price they can afford.

Can Remote Working be Dangerous?

Well frankly, yes it can be dangerous. There is a myriad of issues which have sprung out of remote working since COVID, with many SMEs, now operating a hybrid working scenario, although in my experience, certainly amongst my customer base, there are very few going 100% remote.

Businesses of all sizes have been forced to transform their operations to support remote work and by and large have done well, but not without many challenges—including video conferencing burn out, (along with wishing they’d taken out shares in Zoom!!), and a yearning to work together in person again, someday. We all realise that group working, face to face, is often necessary not just for efficiency, but because we are social animals. Experience has taught many businesses many things, but strangely, to my mind at least, many have simply not grasped the potentially dire consequences in terms of cyber security and data protection.

A distributed work environment i.e., personnel spread around various locations, office, home working, even the local coffee shop, creates critical challenges and new security threats as a result. The speed with which this has happened has meant that many simply did not take this into account and if they did, thought, well, this is temporary, and it won’t matter in the long run. Well perhaps, but as many are now finding, there have been advantages to home working, not least a lowering of costs in terms of how much office space is needed to carry out the business function. Many are now looking at Hybrid working i.e., from home with a day or two in the office during the week. There are pros and cons to this outside of the scope of this article, and businesses will have to make their own judgements, but one thing is clear and that is that businesses need to understand the risks now inherent in distributed work and need to get better at cyber security and data protection, in those environments.

Employees when remote working, are at much greater risk than those in offices. Since home connections are less secure, cybercriminals have an easier entry into the company network. Furthermore, the explosion of various online tools, solutions, and services for collaboration and productivity tend to have the bare minimum of security default setting, and updates from third-party vendors can change security preferences and be easily overlooked.

Phishing becomes an even greater threat to home workers simply because, in an office environment, they have access to colleagues and managers, who they can approach for advice and guidance. This is much harder to replicate with remote workers, especially those who may not be particularly tech savvy and who may not wish to become ‘burdensome’ to their co-workers.

Ransomware also enjoys an advantage in the remote working model. If their connection to the company is blocked, it is more difficult for workers to get assistance from the right experts and authorities. And since trust levels are lower when working from home, some workers will be concerned that they have “done something wrong” and so may be more reluctant to seek help. While this risk can be addressed by increased training, as well as messaging that vigilance and involving corporate IT will be rewarded, it can still be an uphill battle.

One of the biggest dangers I still see day to day is the dangers inherent in working from the local coffee shop. This is a subject that I tend to jump on every so often, because it’s one that people just don’t seem to get. Whenever I drop into a coffee shop for my caffeine infusion, there are usually at least a couple of people with their laptops open, working away on business issues. I could see open spreadsheets (and easy to read if you were sitting behind them), and all have their email open. They are often on a video call, and I can often hear all their side of the conversation, annoying enough for other café users but they are oblivious of the data being released into the wild.

If you are among those free Wi-Fi lovers, there’s bad news for you… your online privacy and security is at risk, if you rely on the weak to non-existent Wi-Fi security protocolsat coffee shops. This means that you could be exposed to various threats such as identity theft which has over 15 million cases each year, data theft/breaches, introducing malware to your business network and that of your customers/suppliers. This list is not exhaustive.

Free or public Wi-Fi’s are hotspots for hackers and data snoopers who want to steal your private data or financial information. It is easy for hackers to do that nowadays. You will be surprised to know the different ways hackers can compromise your device or your private information and why you shouldn’t rely on Wi-Fi security at coffee shops as they come with a lot of risk.

Unencrypted Data Exposure: If the Wi-Fi network is not encrypted, your sensitive information (e.g., passwords, emails, and financial data) can be intercepted by hackers using packet-sniffing tools.

Man-in-the-Middle Attacks: Hackers can position themselves between you and the network, intercepting and potentially altering the communication between your device and the server, leading to data theft or manipulation.

Fake Hotspots (Evil Twin Attacks): Cybercriminals may create a rogue Wi-Fi network that mimics the coffee shop’s legitimate network. If you connect to it, they can access all the data transmitted over the connection.

Malware Injection: Open networks can allow hackers to inject malware or viruses onto your device, which can lead to long-term breaches of your data or systems.

Session Hijacking: Attackers can intercept your session cookies, giving them access to your accounts, even if you’re using secure websites.

To mitigate these risks, use a VPN, avoid sensitive transactions, and ensure your firewall and antivirus software are active. Although a VPN may not save your data if it’s stored on your laptop.

We are huge supporters of Cyber Awareness training for managers and staff, arguing that this is no longer a ‘nice to have’ and is now very much a necessity. In fact, it is arguably the biggest quick win, giving the greatest potential return on investment that there is. Of course, this means that companies must understand what their threats, vulnerabilities and risks are, to assess exactly what training is going to be the most effective.

But that alone won’t save you from a dedicated hacker. We need to look at some more technical solutions to help you beat attacks. Here at H2 we have researched and developed services using Software as a Service (SaaS), which, being cloud based, work wherever you are, office, home or coffee shop, and encrypts your most sensitive data whether on your machine, or in transit.

If you feel a no obligation chat about this would be helpful, give us a call.

Another Rant about Cyber Awareness Training

I make no apologies for having another rant about this subject, because it’s so important and easy to do. Recently I put up a poll on LinkedIn asking about how important it was felt that cyber awareness training was. The poll got a lot of views but very little interaction, which is very disappointing. It tells me that either people out there have little interest in it, don’t consider it a priority, or even a necessity, or don’t understand it’s importance to the safety of their systems, data and staff.

Very simply put Cyber Awareness Training is the quickest and cheapest win you can make in the fight against the cyber-criminal.

Cyber awareness training is an essential component of modern organisational security strategies. It equips employees with the knowledge and skills necessary to recognise, respond to, and mitigate cyber threats. Let’s look at some key advantages of implementing cyber awareness training:

1. Enhanced Security Posture: Employees who are educated about cyber threats can identify potential risks and take proactive measures to protect sensitive information. This collective vigilance strengthens the overall security framework of the organisation.

2. Reduction in Human Error: Many cyber incidents stem from human mistakes, such as falling for phishing scams or mishandling sensitive data. Cyber awareness training helps mitigate these errors by teaching employees how to recognise red flags and adhere to best practices.

3. Improved Incident Response: Training empowers employees to respond effectively to security incidents. By understanding protocols and reporting procedures, they can act swiftly in the event of a breach, minimising potential damage.

4. Cultivation of a Security Culture: Regular training fosters a culture of security within the organisation. When employees prioritise cybersecurity in their daily activities, it becomes an integral part of the organisational ethos, enhancing overall resilience.

5. Compliance with Regulations: Many industries face stringent regulatory requirements regarding data protection and cybersecurity. Cyber awareness training helps organisations comply with these regulations, reducing the risk of legal penalties and reputational damage.

6. Increased Employee Confidence: Knowledgeable employees are more confident in their ability to navigate the digital landscape safely. This confidence can lead to greater engagement and a more proactive approach to cybersecurity.

7. Cost Savings: By preventing cyber incidents through effective training, organisations can save significant costs associated with data breaches, including legal fees, recovery expenses, and loss of business reputation.

8. Adaptability to Emerging Threats: The cyber threat landscape is constantly evolving. Cyber awareness training keeps employees informed about the latest threats and trends, ensuring they can adapt their behaviours accordingly.

9. Strengthened Team Collaboration: A shared understanding of cybersecurity risks encourages collaboration among teams. Employees are more likely to communicate about potential threats and share knowledge on best practices, leading to a more cohesive defence strategy.

10. Customer Trust: Organisations that prioritise cybersecurity demonstrate their commitment to protecting customer data. This commitment builds trust with clients and partners, which is crucial for maintaining long-term relationships in today’s digital economy. In summary, cyber awareness training is a vital investment for organisations looking to enhance their cybersecurity defences. By equipping employees with the knowledge and skills needed to identify and respond to threats, organisations not only protect their assets but also foster a culture of security that benefits everyone involved.

And the reality is that it doesn’t have to cost a fortune. It can in fact be done very cost effectively, in such a way that it doesn’t require staff to spend time in the classroom by automating the courses and having them delivered online, allowing staff to carry it out in their own time.

Is Cyber Security about Tech or the Business?

It’s simply a fact that many owners, managers, directors etc, believe that cyber security is a technology issue and is best left to those guys in IT who understand that stuff. Here at H2 we spend a lot of time and effort trying to educate C level people, that it really is a business issue, although it has significant input from the techies. It’s a business issue because breaches can have a significant financial and reputational impact. It’s also an IT issue because it involves implementing technical measures to protect systems and data. Effective cyber security requires a collaboration between business leaders and IT professionals to address both the strategic and technical aspects of security.

The crux of the issue though, is that it must be led by the business, and at board level. It requires a strategy to be followed, which is laid down at board level and which is focused on the goals and aspirations of the business, especially when your IT is outsourced. You can outsource your IT, but you can’t outsource your responsibility.

A valid argument is that the proliferation of security tools creates an illusion of safety. Organisations, large and small, often believe that by deploying a firewall, antivirus software and maybe some other tools, such as intrusion detection systems, they are adequately protected. This ignores the fact that such tools are controls put in place to mitigate risks identified and qualified in terms of importance, in a risk assessment and unless the benefits they bring are properly identified, and the solutions placed and configured correctly, they may well not be doing what you think they are doing. This thinking can also introduce significant third-party risks into your domain. The most recent example of this is the CrowdStrike issue which caused so much chaos throughout the globe.

To be fair to most companies in the smaller and mid-market arenas, their focus is on obtaining IT solutions as cost effectively as possible, and with the minimum of support costs. Cost control is vital to most. This means that they are extremely reluctant to spend money on what they see as not being part of their core business. Of course, if they get a cyber-attack or scam, or worse a data breach attracting the attention of the ICO, then their costs trying to fix the issue can easily outstrip any costs in prevention. Unless they have a well thought out risk managed strategy, they are wide open to slick sales pitches which push products. The rub is that in order to have that well thought out strategy, it means spending on what they see as expensive services that can seem somewhat nebulous, not something they can see and feel, and there is that vague feeling that they are being led to do something that really isn’t all that important.

The approach most take is to trust their IT provider to give them the protections they need. Most of these IT providers are what is known as re-sellers, ie they sell other people’s products and will push those products because that’s their business model. What they won’t do is take a risk managed approach which is essential in ensuring that any limited spend on security, limited because of cost constraints, is targeted where it’s needed and will be most effective. In other words, the technological approach taken by most IT support company’s will do half a job at best.

In essence then, if you don’t understand the risks you face, how can ensure that your cyber security strategy and protections are fit for purpose? Risk management is all about helping us to create plans for our future in a deliberate and responsible way. This requires us to explore what could go wrong in an organisation, on a day-to-day basis.

A quote from Bruce Schneier, Fellow at the Berkman Center for Internet & Society at Harvard Law School, goes like this:

‘If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology’.

How do we approach this then? First and foremost, you need to identify the risks that you face. How can you identify that risk and then mitigate it? Taking risks is a part of business. You assess risk every day when doing business. Do you want to do this deal? What happens if it goes not as expected? Do I want to take this person on? Whether you formally undertake a risk assessment or whether you assess that risk informally, you are working out what is appropriate to a level that is consistent with the risk that your organisation is prepared to take. Failure to do that will almost certainly be damaging to your business, perhaps fatally so.

The difference between assessing day to day business risk and assessing risk to cyber assets, is one of understanding. What is a cyber asset? In this context insert the word ‘information’ instead of cyber. It is the information contained within the IT system that is the important asset, not the piece of hardware it is sitting on. You understand your business risk, after all it is your business, but do you understand information risk? Do you have a clear idea of what information assets you have and where they are? Before you answer that think it through. Do you really know where all the data is? OK, you know that you have a server or servers probably in a cloud somewhere (cloud storage and access is a whole other subject) and that somewhere in those servers there is a bunch of data which runs your business. How much of that data has been saved onto staff workstations when they needed it to carry out some work? How much has been copied off somewhere else for what was probably a very good reason at one point? How well is your firewall functioning? Can malware work its way onto the network because the firewall does not have Universal Threat Management installed and can therefore be probing the servers and workstations. And we haven’t even thought about changes in working patterns. How many of your staff now work remotely some or all of the time. I could go on.

How can we be sure where all this information is and how important each bit is to the business? How can we assess this risk to the business, if information is lost or otherwise compromised? What about ransomware, phishing scams etc? The good news is that some of this can now be automated and managed for you at an affordable price and you can even arrange a 14 day totally free trial to assess its effectiveness.

New Cyber Threats and Innovations

Cybersecurity is an ever-evolving field, with new threats and innovations emerging regularly. Not all these threats will apply to everyone, the trick is, and has always been, identifying the threats that apply to you, working out how vulnerable you are too those threats, and applying controls to bring those down to an acceptable level. That acceptable level will change, not just from company to company, but also asset to asset. Don’t waste valuable time and energy trying to achieve a zero-threat level. It doesn’t exist. You need to understand clearly what your appetite for risk is, ie what is an acceptable level of risk for you, and then go for it.

But what emerging threats are there that you just might have to combat in your daily business life. These trends highlight the ongoing innovation in both cyber threats and defences, driven by the growing reliance on digital infrastructure and the rapid evolution of technology.

Here are some suggestions and trends in cybersecurity as of late 2024:

1. AI-Powered Cyber Attacks and Defences

Threats: Cybercriminals are increasingly using AI to launch more sophisticated attacks, such as AI-driven phishing campaigns, automated hacking attempts, and machine learning-based malware that adapts to security measures. We’re seeing AI powered social engineering, phone calls mimicking voices of managers, and similar. Like with just about all AI usage, what it does it make things much easier by reducing human effort. So, attacks can be set up using AI and become almost fire and forget, just letting it get on with it in the background.

Defense: Organisations are countering this with AI-based threat detection systems, anomaly detection, and predictive analytics to identify potential breaches before they occur. What about your defences? Are they keeping up with these types of threat. What about mobile workforces, are your staff covered once they leave the office; do you have a hybrid or even fully remote workforce? If so, are your defences up to the job? Check out https://hah2.co.uk/

2. Ransomware Evolution

Ransomware continues to be a major threat, but it’s evolving with more advanced encryption techniques, and multi-stage attacks where attackers exfiltrate data before encrypting it. They then threaten to publish the stolen data unless a ransom is paid. I recently heard of a company that had been infiltrated through its website which was transactional, ie it sold stuff via the website and the website was connected to their database of products and sales order processing system. The web developer didn’t have sufficiently robust security in place. A good example of an SME being exploited via their supply chain.

Double extortion and Ransomware-as-a-Service (RaaS) have become more common, where hackers sell ransomware kits to other criminals.

3. Zero Trust Architecture

Zero Trust has moved from a buzzword to a mainstream security model. Organisations are adopting a “never trust, always verify” approach, assuming that every user and device, both inside and outside the network, could be compromised.

Implementing least privilege access, micro-segmentation, and continuous authentication are key features of this approach. And no, this doesn’t have to be cost prohibitive.

4. Supply Chain Attacks

Attacks targeting third-party vendors and software providers have increased. By compromising trusted suppliers, attackers can infiltrate many organisations through a single breach.

Notable Examples: The SolarWinds and Kaseya attacks were significant instances that highlighted the dangers of such supply chain vulnerabilities. The attack on the NHS via a contracted service provider, is also a good example but it doesn’t just affect the big organisations. See above for an example of how an SME was attacked via a third-party web designer.

5. Post-Quantum Cryptography

With quantum computing on the horizon, there’s increasing focus on developing encryption algorithms that can resist quantum attacks. Post-quantum cryptography is becoming a hot topic as organisations prepare for the future of computing.

Even without quantum computing, many organisations do not use encryption, even for their critical data. If you are subject to a data breach, but that data is encrypted, you could save yourself a lot of money and reputational damage.

6. Cloud Security and Misconfiguration

As cloud adoption accelerates, the security of cloud environments remains a top concern. Misconfigured cloud settings continue to expose sensitive data, while cloud-native security solutions (e.g., CSPM, CWPP) are becoming more prevalent.

Securing multi-cloud environments and addressing shared responsibility models are critical challenges.

7. Cybersecurity for IoT and OT

The Internet of Things (IoT) and Operational Technology (OT) are becoming frequent attack targets. Securing connected devices, industrial systems, and critical infrastructure from cyber threats is a growing concern, especially as they are often lacking in adequate security protocols.

This is becoming more critical as home working becomes more and more popular. Employees connecting to your company cloud and systems using home broadband and WIFI, are also de fact connecting to any IOT devices that they are using in the home, potentially opening up back doors into your system.

8. Data Privacy Regulations and Compliance

Data privacy is a key focus as more countries introduce stricter regulations like the Data Protection Act 2018, now becoming known as UK GDPR (General Data Protection Regulation). There are other compliances such as FSA regulations and other industry bodies, that many need adherence to. Data breaches can produce fines from regulatory bodies, law suites from those affected, and quite severe reputational damage.

9. Cybersecurity Automation and SOAR

Automation is becoming critical in cybersecurity due to the sheer volume of threats. Security Orchestration, Automation, and Response (SOAR) tools help streamline incident detection and response, freeing up analysts to focus on complex tasks.

Do you have anything in place to automate your defences? Do you monitor your systems for threats?

10. Identity and Access Management (IAM)

Identity theft and credential stuffing attacks are rising, making IAM solutions more important than ever. Multi-factor authentication (MFA), password less authentication, and biometrics are seeing widespread adoption to prevent unauthorised access.

Still on the subject of Cyber Resilience………

Last week I talked about whether our ability to demonstrate resilience in the cyber field, is impacted by an over reliance on the companies who supply our IT products and services, and whether over time, that reliance has grown to the point where we are ignoring our own responsibilities in this area. I have used the phrase that you can outsource your IT, but you can’t outsource your responsibility. At the end of the day, there is only you and your employees who have the best interests of you company at heart. You wouldn’t tolerate a single point of failure in your business, you would try and ensure that there is resilience built into your business processes. Why then do we not apply that to IT?

It’s a fact, which often goes unrecognised or ignored, that cyber security is not a technical issue but a business issue, and as such much of it is reliant on policy and process. It is also a fact that your employees are both your first line of defence and potentially, your weakest link. Technology comes in in third place. The cyber mantra is People, Process, Technology. If your people don’t have at least a basic understanding of the issues involved, and you do not have the right policies and processes, rolled out to, and understood by all who need them, then all the technology in the world is likely to be a waste of money.

People

Let’s take a closer look, starting with People. Many businesses out there don’t have inhouse IT support but outsource that to an IT provider. That’s fine, you can ensure that your contract with them spells out their responsibilities regarding your security, your data. It then becomes their responsibility to ensure they protect to the standard stated in the contract, and that their people understand their responsibility. However, you still have your own staff who interact with suppliers, customers and possibly members of the public, on your behalf. I’ve discussed in my blogs before that most businesses are more likely to suffer from scams, than they are from technical hacks. Even ransomware can be considered a scam, as can most phishing attacks. The cyber-criminal is relying on someone on your staff to click a malicious link, or access something they shouldn’t, in order to facilitate the scam. Staff often make the mistake of opening malware because they didn’t know they shouldn’t, not because they are themselves malicious or lack common sense. If they fail, it’s often because they haven’t had any training. Likewise, staff can make mistakes, such as copying and releasing data to unauthorised persons, because they didn’t know they shouldn’t. So, whose failures are those, staff or managers?

Cyber Awareness Training (https://hah2.co.uk/cyber-awareness-training-smes/)

It is critical to the success of the cyber-security resilience that the organisation develops a mature culture of understanding and awareness about cyber risks. Above all this is an issue that must be driven from the top of the organisation – unless cyber-security has the full support of the Board it will be impossible to generate the level of commitment necessary to develop the culture of awareness.

Awareness and understanding of cyber risks are so important because these are the essential elements of the “human firewall” that is all that stands between the organisation’s critical IT systems and the clever social engineering tactics of sophisticated cyber-criminals. Such tactics are even more ubiquitous in our “always on” culture that is driven by the social media and applications accessed through smartphones and other mobile devices. Employees need to be aware of the cyber risks inherent in the devices that are part of their everyday lives; and of the damage to their occupation and livelihoods that can be done as a result of ignorance, carelessness or inattention in their use (and abuse) of such devices.

For the security function in an organisation, the development of a mature culture of awareness and understanding is also critical. In order to achieve the shift in thinking needed to develop the culture of awareness, four things are required:

Board and CEO Level involvement and support
Training that is relevant to the job function. Giving technical awareness training to a shop floor worker will have no impact. If lessons from the training can be taken home and used there as well, big dividends will accrue from the reinforcement provide.
Training must be fun. A little humour lightens the load and will brighten the day of employees and mean that they are more likely to remember what was taught.
Training must be continual. It is more effective to do a little training each month than to have a single long session.

Policy and Process

Moving onto to processes now. First and foremost, all companies should have a cyber security policy. It doesn’t need to be more than a page and should lay down what other polices are needed and who is responsible for producing them and keeping them in date. Any of you who have achieved an ISO certification, in whatever subject you needed to, will have had a similar process to go through and if you ever wanted to achieve ISO27001, then you would need to fully understand and comply with this.

The development and documentation of an agreed set of clear and coherent policies and supporting standards, processes and baselines are essential to the success of a cyber-security program. These must be signed off at board level and preferably set within the context of the organisations cyber-security strategy. However, the nature of the policies and supporting elements themselves will, to some extent, also be governed by the risk management controls that are needed in order to manage risk to a level that is consistent with the organisation’s assessed risk, overall risk appetite and budgetary and cost constraints. I talked about risk management last week and that can be found at https://hah2.co.uk/are-we-failing-in-our-cyber-resilience/.

The are 3 elements to this that are essential:

Policy.
Standards and processes.
Minimum baselines.

This may seem onerous and a step too far for many businesses but they are essential to ensure that you are self-reliant and resilient. The whole process need not be that difficult or expensive and it is a lot cheaper than many of the technical solutions managers jump to, without first ensuring that such technologies are actually what is required. We can offer advice and guidance in this area (https://hah2.co.uk/why-use-an-independent-board-advisor/).

Policy is the highest element in the hierarchy – representing “why” the governance controls must be used. Below this, the standards and processes represent “what” needs to be implemented, in order to deliver compliance with the policy. Thirdly, minimum baselines constitute the element that shows “how” the standards and processes should be delivered. Each of the elements is discussed in more detail below.

Technology

Finally, we come to technology. In last weeks blog (https://hah2.co.uk/are-we-failing-in-our-cyber-resilience/ ) I went into more detail about risk management and how we go about putting the right controls in the right place, to reduce our liability to the lowest level we can, without impacting operational resilience. But let’s just reiterate that many of these controls will be procedural and not necessarily technical, or they might be a mix of the two. The message is don’t get hung up on technology, approach it from a risk management point of view, treat IT and cyber security in the same way you would treat any other business process. Don’t get swamped with technical jargon, it’s not that difficult.

Next Week

Another vital piece in our resilience matrix is disaster recovery and business continuity. Not the same thing and I have already touched on this in recent articles (https://hah2.co.uk/you-can-outsource-your-it-but-you-cant-outsource-your-responsibility/), relevant to the current issues around CloudStrike. Disaster recovery is how you plan to recover from a disaster whilst business continuity is all about how you keep the business running whilst you recover your IT assets and data. It’s quite an involved subject and demands an article on its own.

How Can We See a Return on Investment from our Cyber Security Spend?

How are businesses improved through good cyber security? It’s a question just about every customer, or prospective customer, of ours asks themselves. They need to see a return on investment, after all, if you don’t see anything tangible for your money, you’re unlikely to keep going down that road.

When my business partner and I set up H2 after we returned from the Middle East where we’d been working for the HP division that was busy merging itself with CSC (been there done that, didn’t fancy returning to it), the whole question of how we could offer something that gave that return on investment, occupied much of our thinking. What services could we offer at a price that businesses were prepared to pay, and what tangible benefits could we offer?

At first, we were purely a services company, proudly product agnostic, recommending the right products for the right solutions for the right customer. Not at all altruistic, but rather we felt that was the right thing to do be doing. Like many people we didn’t see COVID coming around the corner like a freight train. The pandemic didn’t just change how we would be delivering our services, it changed the whole market, it changed working practices, which are still evolving. That meant that we had to change or die. A stark choice but not one that could be avoided or put off. Like many businesses we had to reengineer the business from the ground up whilst still providing services that customers wanted and could see a need for.

An interesting google search is finding out what businesses are researching online. I was quite surprised to find that the question ‘what is a cyber-attack?’, is the most searched phrase, by a long shot. This suggests that many are still confused as to what a cyber-attack actually is. Breaking that down, its probably not all that surprising because of all the various types of cyber-attack that are constantly being rammed down peoples’ throats and I think the cyber security industry needs to take responsibility for that. There’s a big difference between education and propaganda. FUD (fear, uncertainty and doubt) is a common method used by many to sell security. Personally, I’m not in favour of doing that. I like to educate, not scare.

Other subjects being searched for are ransomware, phishing, spoofing, cyber threats, insider threats and cyber awareness (there are more but they’re a long way down the list).

What people want to know hasn’t changed all that much, neither has the types of threats. What has changed is how those threats present themselves, how the methodologies have changed in order to match new technologies and working practices, particularly the move to remote or home working and the additional threats that this poses. AI is making a big impact already and that impact is going to get bigger as time goes on. Email spoofing for example, that is faking an email purporting to come someone legitimate in order to get someone to take some action that is in some way fraudulent, is now being done over the phone with AI being used to fake someones voice. It’s a scary development and there are now several well reported instances of this happening in the US. If it’s happening there, it’s only a matter of time for it to happen in the UK and across Europe.

One of the first services we offered was the Cyber Maturity Assessment and our very first client took that service. Our brief was to examine their Cyber Security and Data Protection posture, including policies, processes and technical configuration and controls. They were pleased that our assessment was very comprehensive in discovering the threats and vulnerabilities to their systems and that we described them in terms of business risk. We developed comprehensive policies and processes that were all encompassing and designed to fit in with the style and presentation of their employee handbook. All good but it required us to attend their site for a couple of days which was, at one time, normal and acceptable but in terms of the ‘new normal’, not so much.

Whilst we still offer that service, remote services are much more popular and much more in keeping with how businesses are now operating. It doesn’t much matter where their staff are working, home, office or on the move. What matters is that their protections are maintained regardless.

As we developed our new offerings we researched and came up with solutions that do just that. We adopted Software as a Service (SaaS) and found some very innovative solutions that we can use to provide a managed security service to our clients at a very affordable price.

Returning to our first paragraph, how do we show a return on investment? Using our SaaS platform, we offer a 14 day free trial during which we can show a client where they currently stand and then carry out some quick remediations to show how that can be improved, so that the client can see the value of what they are going to get, using their own data. It works and I commend it to you.

Check it out – https://hah2.co.uk/

Ransomware, Phishing and other Malware