Today is somewhat of a sad day for me as tomorrow I will attend Bob Hays funeral. Bob and I started this business when we both returned from Dubai where we worked for HPE in their cyber security business, across the Middle East. We came a long way since starting up in 2017 even though COVID happened in the middle, changing the way that business was conducted by many companies and therefore how we had to adapt and change in order to compete and provide the services needed by the new normal. I think we did a pretty good job all told.
In honour of Bob, I thought I’d focus my blog this week on data protection, his pet subject. He always went to great lengths to point out that we weren’t lawyers but were providing the how to, rather than the legal requirements of data protection legislation. He always said that lawyers were great at telling us what we need to do to meet our legal obligations but were lousy at telling us how to do it.
Data Protection, a somewhat dry subject that many companies, particularly SMEs, think they can get away from by simply paying a bit of lip service. The Data Protection Act 2018, or as it has become known, UK GDPR, is far from a toothless beast and can cause businesses to find themselves in all sorts of problems if they’re not careful.
Businesses that you might not think about, like Estate Agents, hold large amounts of personally identifiable information or PII, that is information that can identify a living individual. Not so long ago a London estate agent was fined £80,000 by the Information Commissioner’s Office (ICO), after leaving the personal data of more than 18,000 customers exposed for almost two years.
The incident occurred when the estate agent passed the details from its own servers onto a partner company. An “Anonymous Authentication” function was not switched off, which meant there were no access restrictions to the data.
It’s surprising just how much PII estate agents hold. Just think about what they ask for when you’re buying a house. In this case the exposed details included bank statements, salary details, copies of passports, dates of birth and addresses of both tenants and landlords.
But in some cases that might not be the end of it. Individuals can sue companies that release data into the wild. In fact, there are now law firms advertising no win no fee when representing these cases. Remember that data breaches almost always involve multiple people, sometimes hundreds if not thousands of records.
One thing that many misunderstand is the link between cyber security and data protection. The Act requires personal data to be secured by ‘default and design’. This means that cyber security requirements must be designed into your data protection processes which could considerably increase the number of policies and processes you require to stay safe and within the law.
Data Protection is a bit of a bureaucratic nightmare I have to admit. Here at H2 we have a raft of templates we use, originally drafted up by Bob, that have been successfully introduced into a variety of organisations, often integrated with their company handbooks. These include:
Data Protection – Overarching Policy
Data Protection Training
Data Protection – Consent
Consent Withdrawal
Subject Access Request
Data Protection Complaints
Retention of Records
Data Breach Notification (note there is an electronic version of this on the ICO website)
Data Protection Impact Assessment Procedure
Security & Control of data protection documentation
Policy Management Review Procedure
Internal Data Protection Breach Register
Retention & Disposal of Records Register
Data Protection Officer (DPO) Responsibilities
Required records to be maintained
Of course these aren’t necessarily the only things needed, there are a whole list of cyber security policies required to complement these. Nearly all are available online, but the problem is knowing what you need and what you don’t and not just downloading, topping and tailing, and hoping for the best. That happens all too often.
Our approach to this has been refined over the years as not just the legislation evolves, both here and in Europe, but as working practices evolve alongside it. We have spent many hours researching solutions and crafting them into services that meet the requirements, which in turn have evolved into a system which works, is both affordable and appropriate for all types of business, and is accreditable to standards such as cyber essentials, if that is required. Flexibility is another key attribute that the new working practices demand. Long gone is the old bastion security system whereby everyone works within a secure boundary, protected by firewalls and other similar technologies. These days we need a system of protection that works regardless of where you are working, office, home, on the move, and can switch seamlessly between them.
When we are first approached by a prospective client and we begin our offer of a free trial to examine their requirements, one of the first things we find is that they don’t know what data they are holding, or where it all is. Oh, they have a general idea; it’s on the cloud server(s), it’s not on laptops or desktops, it’s just the stuff we need to process our clients’ requirements and yes, we’ve only got one copy. And then we install our software that first carries out a discovery exercise and we find that their laptops/desktops are holding lots of copies of the data that is on the cloud server(s). How does that happen? Over time, especially with many now employing the hybrid system of working, ie between the office and remote (home) locations, employees log on to the cloud, find they have a bit of shaky internet link and download the data they need, work on it and then upload it again, forgetting to delete it from their machine. Or they need to share it and attach it to an email and send it out, forgetting, or perhaps not realising, that the data is now stored, attached to an email, on their email server.
Then comes the issue with audit trails. If the ICO ever wanted to carry out an investigation, then having an audit trail of who created/copied/deleted/forwarded what to who, is essential. And let’s not forget the member of the public who is fully entitled to submit a Data Subject Access Request or DSAR, which demands that you reveal what data you are holding on that person. The law insists on it, and you can’t refuse it. I know of a financial firm that took nearly 3 weeks to satisfy a DSAR, taking an employee off billing, for that time.
Our solution meets the requirements needed today and not only that, has a built-in encryption system, all within the same monthly cost. It’ll cost you nothing to trial it and we’d be very surprised if once you’ve seen it and seen the ridiculously low monthly charge for the managed service, you don’t want to keep it.
So a final farewell to Bob, with thanks for all his work in the data protection arena, and for the friendship forged in 3 different company’s before we took the bull by the horns and went out on our own.
I’ve made quite a bit recently about cyber resilience and the focus being placed on computer outages caused by third party suppliers, highlighted by not just the CloudStrike issue but also the ransomware attack on the UK NHS, made possible by infiltrating a key supplier. All of this of course highlights the importance of supply chain security, but my focus today will be all about disaster recovery and business continuity.
Disaster recovery and business continuity are very much connected but are different. The former is basically a plan for when things go sideways—like when a natural disaster hits, a cyberattack happens, or even if there’s a major tech failure. It’s all about making sure that businesses can bounce back and keep things running as smoothly as possible. Imagine your favourite coffee shop gets flooded. Disaster recovery is like their game plan for getting back on their feet: they might have backup equipment stored somewhere, a way to communicate with customers, and a strategy for cleaning up and reopening. In the tech world, it often involves regular backups of data, having alternate servers ready to go, and making sure everyone knows what to do in case of an emergency. The goal? To minimize downtime and get everything back to normal without too much hassle. It’s like having an insurance policy but for your operations—very important for keeping the lights on when the unexpected hits!
However, we need to understand that when it comes to the type of outages caused by supply chain cyber failures as we saw with CloudStrike, there isn’t much a customer can do to recover from that, without fixes from the suppliers. So, in this instance disaster recovery planning becomes a little difficult to say the least.
Business continuity on the other hand, is all about making sure that a company can keep running smoothly when it is deprived of their IT systems, in whole or in part. So, it’s about keeping business running whilst the disaster recovery plan kicks in and gets stuff back online. The idea is to have a plan in place that helps the business bounce back quickly. This includes figuring out which critical functions need to keep going, having some way of operating manually if necessary. Can you place an order, process an order, raise an invoice, pay a bill etc. It’s like having an emergency kit for your business—batteries included! Companies should create a business continuity plan (BCP) that outlines the steps they’ll take during a crisis. This way, they don’t just react on the fly; they can hit the ground running. It’s all about minimising downtime and keeping customers happy. In short, it’s like being prepared for a rainy day—just with more spreadsheets and meetings!
The first thing to decide is what the priorities are regarding business processes. What is essential, what is a nice to have and what you can live without in the short to medium term. Don’t leave it to managers and staff to guess, have it documented. This priority order is determined based on what is known as a business impact analysis (BIA). This determines the impact of an outage on the business and its customers. Don’t ever forget that your reputation is on the line, and you need to keep your customers serviced and happy. Each business process should have recovery time attached to it, ie how long you can do without it before it becomes truly disastrous.
It all sounds terribly complicated and therefore expensive, but in fact, it isn’t. All the information you need to work this out is already in your hands. You know your business best and you know what’s important and what isn’t quite so important. You just have probably never written it down. And that’s the crux of the matter.
Disaster recovery planning addresses the processes, technical requirements and infrastructure an organisation needs to implement to recover data and operations as required by the business in the event of a disaster. The planning process will involve identification of critical business processes, business impact analysis and thus determination of the overall requirements for a cost-effective plan.
Following the disaster recovery plan, business recovery planning is the process that organisations must use to assess appropriate timeframes for business resumption, also allowable data losses and risk tolerances for business disruptions. As stated earlier, it also needs a plan to carry on manually whilst the disaster recovery plan is implemented. Budgetary requirements for infrastructure and processes, to meet the disaster recovery plan, will also be determined by the business recovery planning process.
There are also 2 other key parts to this. Firstly, companies must ensure that their plans are tested, that everyone in the company is aware of them, where they can find them, and what their responsibilities are in this regard. Testing is critical to ensure that processes, systems and business restoration can meet the requirements laid down for them. Where the plans rely on third party service providers and/or indicate the need to support key customers, these should be involved in the testing process. This will give re-assurance that support will be received and/or given as expected.
And then we have key stakeholders. Who in your organisation is responsible for what, regarding disaster recovery and business continuity planning? Do they know their respective responsibilities, have they accepted this? Have you placed this in their job descriptions? Can they be held to this responsibility? Are they part of the planning and testing process? All seems a bit obvious when you say it, but you’ll probably not be surprised to know that it’s often totally overlooked.
Key Stakeholders
Roles and Responsibilities
CEO/Board of Directors
Aware of business continuity processes, inputs as required Approval of business continuity processes and integration with other technical functions – Note 1Ownership of business continuity processes together with relevant business units – Note 1
Infrastructure (IT operations)
Input into business continuity processes. Consideration of any infrastructure changes which may impact security architecture. Provide inputs and coordination for systems’ resiliency testing and remediation. Provide costs/budgets for systems requirements
Business units
Creation of BIA and corresponding recovery requirements. Budgetary approval.
Note 1 – these two functions would be carried out by a CIO and/or and CISO in a larger organisation, but as most, even top end, SMBs are unlikely to have anyone in that role, then it must be owned by other board members. I hope this is helpful, but it can only be a guide and there is no one size fits all solution.
Last week I talked about whether our ability to demonstrate resilience in the cyber field, is impacted by an over reliance on the companies who supply our IT products and services, and whether over time, that reliance has grown to the point where we are ignoring our own responsibilities in this area. I have used the phrase that you can outsource your IT, but you can’t outsource your responsibility. At the end of the day, there is only you and your employees who have the best interests of you company at heart. You wouldn’t tolerate a single point of failure in your business, you would try and ensure that there is resilience built into your business processes. Why then do we not apply that to IT?
It’s a fact, which often goes unrecognised or ignored, that cyber security is not a technical issue but a business issue, and as such much of it is reliant on policy and process. It is also a fact that your employees are both your first line of defence and potentially, your weakest link. Technology comes in in third place. The cyber mantra is People, Process, Technology. If your people don’t have at least a basic understanding of the issues involved, and you do not have the right policies and processes, rolled out to, and understood by all who need them, then all the technology in the world is likely to be a waste of money.
People
Let’s take a closer look, starting with People. Many businesses out there don’t have inhouse IT support but outsource that to an IT provider. That’s fine, you can ensure that your contract with them spells out their responsibilities regarding your security, your data. It then becomes their responsibility to ensure they protect to the standard stated in the contract, and that their people understand their responsibility. However, you still have your own staff who interact with suppliers, customers and possibly members of the public, on your behalf. I’ve discussed in my blogs before that most businesses are more likely to suffer from scams, than they are from technical hacks. Even ransomware can be considered a scam, as can most phishing attacks. The cyber-criminal is relying on someone on your staff to click a malicious link, or access something they shouldn’t, in order to facilitate the scam. Staff often make the mistake of opening malware because they didn’t know they shouldn’t, not because they are themselves malicious or lack common sense. If they fail, it’s often because they haven’t had any training. Likewise, staff can make mistakes, such as copying and releasing data to unauthorised persons, because they didn’t know they shouldn’t. So, whose failures are those, staff or managers?
It is critical to the success of the cyber-security resilience that the organisation develops a mature culture of understanding and awareness about cyber risks. Above all this is an issue that must be driven from the top of the organisation – unless cyber-security has the full support of the Board it will be impossible to generate the level of commitment necessary to develop the culture of awareness.
Awareness and understanding of cyber risks are so important because these are the essential elements of the “human firewall” that is all that stands between the organisation’s critical IT systems and the clever social engineering tactics of sophisticated cyber-criminals. Such tactics are even more ubiquitous in our “always on” culture that is driven by the social media and applications accessed through smartphones and other mobile devices. Employees need to be aware of the cyber risks inherent in the devices that are part of their everyday lives; and of the damage to their occupation and livelihoods that can be done as a result of ignorance, carelessness or inattention in their use (and abuse) of such devices.
For the security function in an organisation, the development of a mature culture of awareness and understanding is also critical. In order to achieve the shift in thinking needed to develop the culture of awareness, four things are required:
Board and CEO Level involvement and support
Training that is relevant to the job function. Giving technical awareness training to a shop floor worker will have no impact. If lessons from the training can be taken home and used there as well, big dividends will accrue from the reinforcement provide.
Training must be fun. A little humour lightens the load and will brighten the day of employees and mean that they are more likely to remember what was taught.
Training must be continual. It is more effective to do a little training each month than to have a single long session.
Policy and Process
Moving onto to processes now. First and foremost, all companies should have a cyber security policy. It doesn’t need to be more than a page and should lay down what other polices are needed and who is responsible for producing them and keeping them in date. Any of you who have achieved an ISO certification, in whatever subject you needed to, will have had a similar process to go through and if you ever wanted to achieve ISO27001, then you would need to fully understand and comply with this.
The development and documentation of an agreed set of clear and coherent policies and supporting standards, processes and baselines are essential to the success of a cyber-security program. These must be signed off at board level and preferably set within the context of the organisations cyber-security strategy. However, the nature of the policies and supporting elements themselves will, to some extent, also be governed by the risk management controls that are needed in order to manage risk to a level that is consistent with the organisation’s assessed risk, overall risk appetite and budgetary and cost constraints. I talked about risk management last week and that can be found at https://hah2.co.uk/are-we-failing-in-our-cyber-resilience/.
The are 3 elements to this that are essential:
Policy.
Standards and processes.
Minimum baselines.
This may seem onerous and a step too far for many businesses but they are essential to ensure that you are self-reliant and resilient. The whole process need not be that difficult or expensive and it is a lot cheaper than many of the technical solutions managers jump to, without first ensuring that such technologies are actually what is required. We can offer advice and guidance in this area (https://hah2.co.uk/why-use-an-independent-board-advisor/).
Policy is the highest element in the hierarchy – representing “why” the governance controls must be used. Below this, the standards and processes represent “what” needs to be implemented, in order to deliver compliance with the policy. Thirdly, minimum baselines constitute the element that shows “how” the standards and processes should be delivered. Each of the elements is discussed in more detail below.
Technology
Finally, we come to technology. In last weeks blog (https://hah2.co.uk/are-we-failing-in-our-cyber-resilience/ ) I went into more detail about risk management and how we go about putting the right controls in the right place, to reduce our liability to the lowest level we can, without impacting operational resilience. But let’s just reiterate that many of these controls will be procedural and not necessarily technical, or they might be a mix of the two. The message is don’t get hung up on technology, approach it from a risk management point of view, treat IT and cyber security in the same way you would treat any other business process. Don’t get swamped with technical jargon, it’s not that difficult.
Next Week
Another vital piece in our resilience matrix is disaster recovery and business continuity. Not the same thing and I have already touched on this in recent articles (https://hah2.co.uk/you-can-outsource-your-it-but-you-cant-outsource-your-responsibility/), relevant to the current issues around CloudStrike. Disaster recovery is how you plan to recover from a disaster whilst business continuity is all about how you keep the business running whilst you recover your IT assets and data. It’s quite an involved subject and demands an article on its own.
The fallout from the CloudStrike sensor failure, which caused severe outages throughout the globe, is still being felt and will be felt for some time to come. The emphasis has been on recovery but that will start to change, as we focus more on why it happened, and what can be done to mitigate further failures of this kind. I’ve said already, in a piece I wrote last week (https://hah2.co.uk/you-can-outsource-your-it-but-you-cant-outsource-your-responsibility/ ), that we appear to be becoming too reliant on our IT providers, particularly managed services, to ensure that we remain safe and our services can continue, and we aren’t looking too hard at ensuring resilience is built into our systems. It begs the question, is business continuity planning no longer in fashion.
Alexander Rogan of Abatis also wrote a piece that’s worth reading (https://www.linkedin.com/pulse/billions-lost-chaos-lessons-from-crowdstrike-microsoft-rogan-abxde/}. In his article Alexander emphasises the importance of zero trust architecture and processes. What this essentially means is that we cannot afford to trust anyone other than ourselves. Suppliers are there to help and as such they should ensure that their own processes are robust and include thorough pre-production testing, controlled roll outs and good baseline security measures. Where CrowdStrike falls in this regard, will I’m sure, get thoroughly tested in the not too distant future.
In the cyber security industry, there has long been a running war between those that sell products and those of us concerned more with services. Having been in the industry for 30 years, I have seen this time and again and the product sales nearly always win. Why? Simply because services are a hard sell with a long timeline whereas product sales are easier and quicker to achieve. Why would that be? Again, simple, people like to be able to quickly demonstrate a return on investment. They like to see a product, doing its stuff, even when often, they don’t realise how it’s doing what it’s doing, or if it’s the right product in the right place at the right time.
The risk managed approach is the way to go every time. That has not changed at all in the 30 years I’ve been plugging away at it. It’s all about People, Process and then Technology. I often quote Bruce Schneier, a US scientist on the Harvard Faculty, and a thought leader in this space. He says, ‘If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology’. Breaking this down, what he’s getting at is that first and foremost, you must understand the risks that you face and to do that, you have to identify your cyber assets. By that we don’t mean hardware and even software, what we are talking about is your data and the ability to keep your systems online and accessing what your staff and/or customers need to access, when they need to access it. Once you identify your assets, you then need to identify the threats to those assets and how vulnerable you are too those threats. Threat and vulnerability = risk. And by that we mean the risk to the business if it all goes pear shaped.
Once that’s done, we can then allocate a risk score to each asset with the aim of managing that risk down to an acceptable level, known as the risk appetite. That will change business to business, even asset to asset. You wouldn’t for example allocate the same level of risk [to the business], to a revenue earning system, as you would to perhaps a purely admin system that contains no personal data.
This all sounds terribly difficult and expensive, and that’s why many companies simply don’t do it, or maybe they do a subset of it. But unless you do, then it can be very difficult to know for sure that you are spending your limited budget on the right protections, in the right place. In the long run, it can save you a lot of money. This same assessment applies equally to the CrowdStrike problem, or for that matter, any other company that you have in your supply chain. You need to assess what damage they could do to you if they fail, and what you can do to mitigate that damage. It’s very well and good reaching for the nearest lawyer when it’s all gone to hell, how much better to stop it, or mitigate it, before you get there.
How are businesses improved through good cyber security? It’s a question just about every customer, or prospective customer, of ours asks themselves. They need to see a return on investment, after all, if you don’t see anything tangible for your money, you’re unlikely to keep going down that road.
When my business partner and I set up H2 after we returned from the Middle East where we’d been working for the HP division that was busy merging itself with CSC (been there done that, didn’t fancy returning to it), the whole question of how we could offer something that gave that return on investment, occupied much of our thinking. What services could we offer at a price that businesses were prepared to pay, and what tangible benefits could we offer?
At first, we were purely a services company, proudly product agnostic, recommending the right products for the right solutions for the right customer. Not at all altruistic, but rather we felt that was the right thing to do be doing. Like many people we didn’t see COVID coming around the corner like a freight train. The pandemic didn’t just change how we would be delivering our services, it changed the whole market, it changed working practices, which are still evolving. That meant that we had to change or die. A stark choice but not one that could be avoided or put off. Like many businesses we had to reengineer the business from the ground up whilst still providing services that customers wanted and could see a need for.
An interesting google search is finding out what businesses are researching online. I was quite surprised to find that the question ‘what is a cyber-attack?’, is the most searched phrase, by a long shot. This suggests that many are still confused as to what a cyber-attack actually is. Breaking that down, its probably not all that surprising because of all the various types of cyber-attack that are constantly being rammed down peoples’ throats and I think the cyber security industry needs to take responsibility for that. There’s a big difference between education and propaganda. FUD (fear, uncertainty and doubt) is a common method used by many to sell security. Personally, I’m not in favour of doing that. I like to educate, not scare.
Other subjects being searched for are ransomware, phishing, spoofing, cyber threats, insider threats and cyber awareness (there are more but they’re a long way down the list).
What people want to know hasn’t changed all that much, neither has the types of threats. What has changed is how those threats present themselves, how the methodologies have changed in order to match new technologies and working practices, particularly the move to remote or home working and the additional threats that this poses. AI is making a big impact already and that impact is going to get bigger as time goes on. Email spoofing for example, that is faking an email purporting to come someone legitimate in order to get someone to take some action that is in some way fraudulent, is now being done over the phone with AI being used to fake someones voice. It’s a scary development and there are now several well reported instances of this happening in the US. If it’s happening there, it’s only a matter of time for it to happen in the UK and across Europe.
One of the first services we offered was the Cyber Maturity Assessment and our very first client took that service. Our brief was to examine their Cyber Security and Data Protection posture, including policies, processes and technical configuration and controls. They were pleased that our assessment was very comprehensive in discovering the threats and vulnerabilities to their systems and that we described them in terms of business risk. We developed comprehensive policies and processes that were all encompassing and designed to fit in with the style and presentation of their employee handbook. All good but it required us to attend their site for a couple of days which was, at one time, normal and acceptable but in terms of the ‘new normal’, not so much.
Whilst we still offer that service, remote services are much more popular and much more in keeping with how businesses are now operating. It doesn’t much matter where their staff are working, home, office or on the move. What matters is that their protections are maintained regardless.
As we developed our new offerings we researched and came up with solutions that do just that. We adopted Software as a Service (SaaS) and found some very innovative solutions that we can use to provide a managed security service to our clients at a very affordable price.
Returning to our first paragraph, how do we show a return on investment? Using our SaaS platform, we offer a 14 day free trial during which we can show a client where they currently stand and then carry out some quick remediations to show how that can be improved, so that the client can see the value of what they are going to get, using their own data. It works and I commend it to you.
Some introspection is good for the soul they say, and I can’t help but try and apply that to how we, ie so called cyber security professionals, approach prospective clients, or indeed, converse with existing clients. Is there a certain smugness involved where we believe we know best and whether we do or not, try and push what we think a client should have, rather than what a client needs. Does this attitude, no matter how hard we try to suppress it, make prospective clients wary of what we have to say?
Of course we have our methodologies, particularly regarding risk management, and I am a great exponent of getting that right, but how many of us take the time and make the effort, to understand the clients situation. It’s what we used to call situational awareness. It didn’t just refer to a client understanding their own situation, but us appreciating that situation as well. After all, not all clients, even those in the same vertical and the same size of business, has exactly the same problems.
A lot depends on who you are and who you work for. The larger IT system integrators and consultancies do take the time to try and understand their clients. In fact, going back to the early 2000s, working for a multinational IT product and services giant, we never actually outright tried to sell anything. Our salespeople at the enterprise level, were very much relationship managers, they built relationships with their clients, got to know their businesses and made suggestions that the client might be interested in. The mantra was that people buy from people, not from brands. Brands are great in the marketing context, building awareness and a market presence, but they never seal the deal.
Of course, at the start of a sales year some bright young thing sporting an MBA and a burning ambition would move the salespeople around, ruining years of relationship building and vertical knowledge, because ‘it needs shaking up’. The end result is hacked off employees who look elsewhere and hacked off clients who think, well, if I have to start with someone else, I’d might as well see what else is out there. But that’s a whole other story.
Research your client, understand their business, make sure you’re building a relationship with the right person. Understand the industry, their pain points and needs. Only then can you really start to craft a value proposition and call to action that the client can relate to. Foster that relationship, make sure that not every call you make is about your products and/or services, make it more personal. Above all, be genuine, it pays off in the end.
I guess what I’m getting at is that it really is all about building relationships with people. You can have a deep understanding of your subject, fantastic product knowledge and a sparkling personality, but if you talk down to a prospective client, come across as in anyway condescending or patronising, you’ve lost the game. You have to listen, ask intelligent questions, show that you are really interested in understanding the issues that face this prospective client, and make suggestions that might be suitable to solve the pain points being put in front of you.
We decided a couple of years ago, to offer a service which we entitle Board Advisor (https://hah2.co.uk/why-use-an-independent-board-advisor). The point was not to try and sell solutions, not to try and sell any particular product, but to work with our clients to identify the issues they really do face and work through those issues to identify potential solutions that will help them in their business by protecting those critical assets that would cripple the business if they were not available or were corrupted in some way. It’s all about putting appropriate measures in place before disaster strikes and preventing the vastly higher costs of recovery post-breach, from immediate financial impacts to lasting reputational damage.
The security threat landscape is becoming both more sophisticated and easier to exploit by the less sophisticated. This seems to be at odds but such things as artificial intelligence (AI) is transforming nearly every industry, including cybersecurity. Whilst AI enables enhanced threat detection and response, this powerful technology can also be weaponised by cyber criminals. As AI-driven cyber-attacks grow more advanced, organisations must act quickly to implement robust defences. Trying to keep abreast of this whilst running a business and focusing on your core requirements, is daunting and frankly, you’re not going to succeed.
If you’d like to discuss the art of the possible, give us call.
Another good question, or perhaps it should be, do they ask any questions, other than cost, about cyber security, or do they leave everything up to their IT support, whether contracted or in house?
What is the cost of ignoring cyber security?
Perhaps this is the first question that they should be asking. The financial hit of a data breach can be crippling, especially for the smaller businesses who are perhaps running on tight margins and for whom cash flow is often critical. The average clean up for a smallish business is about £27K. this relates to system restoration, hardware replacement, and the implementation of enhanced security measures. and doesn’t include financial loss from the actual data stolen, or whatever scam was perpetrated, and any fall out from compliance failures, such as fines from the ICO. And at least a third of organisations admit to losing customers post a data breach, highlighting reputational damage and a loss of customer trust.
So, what should owners, managers and board members be asking?
I think many get bogged down in the technicalities of IT and don’t consider it in business terms. They don’t think about the business impact of cyber security, about what it is they’re trying to protect. It’s not your IT systems, it’s your data that is the crown jewels. IT systems can be replaced but once the data is stolen, then you are in very real trouble.
Risk Management
First and foremost, the board members need to ask themselves if they have a good handle on their cyber risk. Have they identified their cyber assets? What is a cyber asset? Cyber assets are not just hardware and software, in fact those are often the least of your worries. It’s the data, where it is and how it’s protected that is important. Have you assessed the risk to those assets? Have you assessed the training requirements for your staff, not just the techies but all staff? Think People, Process and then Technology.
Once you have done this, then you can consider what controls need to be put in place to reduce the risk to an acceptable level.
Below is some of the controls you will need to consider. This list is not exhaustive
1. User Access Control (Admin access is a whole other discussion)
This isn’t just about passwords. Yes, they remain important but on their own, they are no longer sufficient. Nonetheless weak passwords, password re-use and password sharing remain one of the leading root causes of a data breach. 123456 and, believe it or not, password, remains the most used passwords across the world!
It is imperative that you have a strong password policy, dictating not just the length of the password, but also its construction, ensuring that there is a good mix of upper and lower case characters, numbers and symbols, that together make things very difficult for password crackers.
On their own though passwords remain a potential weak spot. Multi factor authentication (MFA), sometimes referred to as 2FA, provides that extra layer of defence and can help to protect against brute-force attacks, phishing scams, key-logging and social engineering. MFA can be simply implemented on most email platforms and within various apps you are using. For those of you trying for Cyber Essentials or ISO 27K series, MFA is mandatory, so make sure it’s put in place.
2. Are you backing up your files?
This seems an obvious thing to do but you’d be surprised how often when trying to restore from a backup, it fails. This is often because the backup routine was set up back in the mists of time and has never been reviewed and even more dangerous, it’s never been tested to see if it works. Set up your backup regime, have it reviewed regularly and tested regularly to make sure it works. If you are backing up online, keep in mind that if a cyber-criminal gets access to your systems to, for example, carry out a ransomware attack, then they can probably get at your back up as well. So, belt and braces, consider having an offline backup as well as an online backup. The latter is more convenient but can be corrupted.
3. Do you train your staff in cyber awareness?
My favourite subject – cyber awareness training. Your first line of defence is your staff, but if not trained adequately, they can be your greatest vulnerability. It’s known in the trade as the insider threat but it is caused mainly by human error, staff members doing something they shouldn’t, not maliciously but simply because they didn’t know they shouldn’t. It actually accounts for 88% of data breaches. Providing your people with training on the threats, current scams and basic cyber awareness reduces the chance of a cyber-attack. This really is the easiest and cheapest quick win any organisation can take in reducing their risk exposure.
4. Do your employees regularly travel or work remotely?
This brings us neatly to what Microsoft coined as the New Normal. Essentially this means remote working shared with in office working, known as the hybrid working model, or for some, moving to a totally remote working system. Totally remote is not as common as hybrid working but is becoming more normal with certain size businesses in certain commercial verticals. It’ll never work for everyone, but for those who have embraced it, it saves a considerable amount of expense. It does however require us to rethink our cyber strategy.
Work-from-home employees are at much greater risk than those in offices. Since home connections are less secure, cybercriminals have an easier entry into the company network. Furthermore, the explosion of various online tools, solutions, and services for collaboration and productivity tend to have the bare minimum of security default setting, and updates from third-party vendors can change security preferences and be easily overlooked.
Phishing becomes an even greater threat to home workers, often because, in an office environment, they have access to colleagues and managers, who they can approach for advice and guidance. This is much harder to replicate with remote workers, especially those who may not be particularly tech savvy and who may not wish to become ‘burdensome’ to their co-workers.
Ransomware also enjoys an advantage in the work-from-home model. If their connection to the company is blocked, it is more difficult for workers to get assistance from the right experts and authorities. And since trust levels are lower when working from home, some workers will be concerned that they have “done something wrong” and so may be more reluctant to seek help. While this risk can be addressed by increased training, as well as messaging that vigilance and involving IT support will be rewarded, it can still be an uphill battle.
We need to break out of the old ‘bastion’ security model of a network protected by firewalls and other technologies and think about solutions that are designed to protect your assets regardless of where your employees work from. They exist and aren’t hard to find.
Data tends to proliferate, especially when working remotely. Cyber awareness training helps here, but it also helps for management to have a handle on data storage. All organisations have this problem, but it becomes more acute for those businesses that hold large amounts of what is known as Personal Identifiable Information or PII. This is information that can identify a living individual and compromise their privacy in some way. Financial advisors, estate agents, solicitors etc, all share this issue. The data protection act, becoming referred to as UK GDPR, is not a suggestion, it is law.
5. Where is all your data stored and who has access to it?
One of the biggest issues we find with organisations of all sizes, is that they think they know where all their data is but get quite a surprise when they discover multiple instances of the same data set. This has become a real issue in that the new normal tempts users when working remotely, with possibly less than robust broadband, to copy data from cloud storage to their PC or laptop to ensure they can keep working on it. Then they upload it again when they’ve finished but forget to delete their copy. That’s just one instance but it is vital to understand where all this data is. What if for instance, you get what is known as a subject access request, where a client or other member of the public wants to know exactly what personal data you have on them, and why. I spoke to a financial advisor recently who told me that it took one of their partners off the road for 3 weeks, to discover where all the data was kept on just one person. But under the law, they had no choice but to bite the bullet.
There are several systems on the market which will help with this but what most need now is a system that works regardless of the location of the user and continues providing that cover when the user moves from one location to another. This is just a suggestion, but we’d be delighted to demo it to anyone who is interested. https://hah2.co.uk/gdpr-data-protection/
6. Disaster Recovery and Business Continuity
Business Continuity refers to the proactive strategies and plans put in place to ensure that essential business functions can continue in the event of a disruption or disaster. This could include natural disasters, cyber-attacks, power outages, or any other event that could disrupt normal business operations. Business Continuity planning typically involves identifying critical business processes, implementing redundant systems and processes, and developing communication plans to ensure that the organisation can continue to operate smoothly in the face of adversity.
Disaster Recovery, on the other hand, is focused specifically on restoring IT infrastructure and data after a disaster has occurred. This could involve recovering lost data, restoring systems and networks, and ensuring that IT operations can resume as quickly as possible. Disaster Recovery planning typically involves creating backup systems, implementing data recovery procedures, and testing these plans regularly to ensure they are effective. Both are critical components of a comprehensive risk management strategy and should be integrated into an organization’s overall resilience planning efforts.
Just like backups, which are a crucial part of Disaster Recovery, these plans can become very quickly out of date and useless, unless reviewed periodically and tested to see if they actually work.
7. Vulnerabilities and Threats
A vulnerability is a flaw or weakness in an asset’s design, implementation, or operation and management that could be exploited by a threat. A threat is a potential for a threat agent to exploit a vulnerability. A simple way to explain this is that a vulnerability is the inability to resist a hazard or to respond when a disaster has occurred. For instance, people who live on plains are more vulnerable to floods than people who live higher up. The threat is the flood itself.
IT risks and vulnerabilities are the potential threats and weaknesses that can affect the performance, security and reliability of your business function and processes. They can have serious consequences for your business goals, customer satisfaction, and competitive advantage.
Identifying vulnerabilities to your cyber security assets and then identifying the threat to those assets in terms of the vulnerability being exploited, informs your risk and enables you to assign a value to it. Financial value can be assigned to the risk score if you so wish. You then apply controls to bring the risk down to an acceptable level, starting with the Very High risks, and then bringing them down to whatever is acceptable to you. That acceptable level, known as the risk appetite, will vary business to business, risk to risk.
8. Supply Chain Security?
In short, a supply chain attack is a cyber-attack that seeks to damage an organisation by targeting less-secure elements in the supply chain.
An example of such an attack was published by NCSC and points out that many modern businesses outsource their data to third party companies which aggregate, store, process, and broker the information, sometimes on behalf of clients in direct competition with one another.
Such sensitive data is not necessarily just about customers, but could also cover business structure, financial health, strategy, and exposure to risk. In the past, firms dealing with high profile mergers and acquisitions have been targeted. In September 2013, several networks belonging to large data aggregators were reported as having been compromised.
A small botnet was observed exfiltrating information from the internal systems of numerous data stores, through an encrypted channel, to a botnet controller on the public Internet. The highest profile victim was a data aggregator that licenses information on businesses and corporations for use in credit decisions, business-to-business marketing, and supply chain management. While the attackers may have been after consumer and business data, fraud experts suggested that information on consumer and business habits and practices was the most valuable.
The victim was a credit bureau for numerous businesses, providing “knowledge-based authentication” for financial transaction requests. This supply chain compromise enabled attackers to access valuable information stored via a third party and potentially commit large scale fraud.
NCSC also cited what is known as a watering hole attack, which works by identifying a website that’s frequented by users within a targeted organisation, or even an entire sector, such as defence, government, or healthcare. That website is then compromised to enable the distribution of malware.
The attacker identifies weaknesses in the main target’s cyber security, then manipulates the watering hole site to deliver malware that will exploit these weaknesses.
The malware may be delivered and installed without the target realising (called a ‘drive by’ attack) but given the trust the target is likely to have in the watering hole site, it can also be a file that a user will consciously download without realising what it really contains. Typically, the malware will be a Remote Access Trojan (RAT), enabling the attacker to gain remote access to the target’s system.
If you are in someones supply chain, then you need to make doubly sure that your security protects your customer as well as yourself. And conversely, if you are connected electronically to someone who supplies you, are you sure that you are protected from any vulnerability they may have.
As I move around talking to business leaders of all sizes of company, one thing stands out. And that’s that there are many different views as to how involved management needs to be in cyber defence, and some of these views are markedly different. They range from a very hands off approach, happily leaving it to their IT support, to, and it has to be said, a minority, who see it as their responsibility.
Arguably one of the most, if not the most, important roles any CEO/MD/Chairman (call him or her whatever you like and for the purposes of this article I’ll stick with CEO) is to set the importance of cyber defence in everyones mind. The tone has to come from the top to be accepted and effective. When cyber defence is clearly prioritised by the CEO and the Board, it assumes an importance in the mind of the employees. It is crucial that everyone from the CEO down understands the impact that a cyber breach, or a scam, or a cyber based fraud, can have on the bottom line.
This also aligns cyber defence and data protection with the business goals. Cyber defence is a business issue, not an IT issue. It’s crucial that all clearly understand this and how it should be woven into the very fabric of the business. The CEO and the board have a clear perspective on the company’s strategic goals and direction. By their involvement with cyber defence, they can ensure that it is aligned with the broader business strategy to fully protect the businesses data and systems. It aids with budgets for cyber security tools, training and personnel, addressing the threats to the business.
CEOS might need advice and guidance but their involvement is essential and will help to identify some issues which may not be clear to employees, especially technical employees. One such is reputational damage. The damage to a company from a data breach may not be immediately clear. But once it hits the press, or once the company becomes subject to a fine from a regulatory body such as the Information Commissioner, the word tends to spread. If you can’t be trusted to maintain a level of confidentiality, can you be trusted with other things? Doubt spreads and can destroy vendor, customer and partner relationships.
Cyber defence begins with risk management. Managing cyber risks is no different to managing any other business risk. There is no business without risk, the trick is to manage your risks down to a level that you are prepared to accept, known as the risk appetite. This must involve the CEO and directors and business managers. Each knows what could damage, perhaps catastrophically damage, their part of the business. IT staff don’t have this knowledge, their focus is often on the technical risks, not the business risks.
Risk management itself begins with a clear cyber defence and data protection strategy. Depending upon the size of your business, some elements of the suggested strategy below, may not be relevant to you. This is offered as a guide, not an absolute.
Figure 1- Suggested Cyber Strategy Framework
To help in defining your strategy, you need to undertake a risk analysis which will inform the selection, deployment and management of Appropriate, Affordable and Accreditable (if required) controls.
Appropriate in the sense that controls need to support rather than hinder business process as well as being capable of achieving their goals. Your controls also need to be appropriate to your business. Affordable may seem self-explanatory, however in the context of cyber security controls and overall budgetary constraints, return on investment is as important as cost effectiveness. Accreditation to agreed cyber security standards – of which there are many, is crucial for all organisations. Being able to provide a trail of evidence which demonstrates on going compliance to selected standards is essential in times of crisis.
Having got this far, we need a risk treatment plan to match the identified risks. What you’re trying to achieve here is to manage the risk down to an acceptable level. Don’t get bogged down in trying to eliminate risk, you won’t succeed, but rather get the risk down as low as you can. Don’t make it too complicated, identify your risks as High, Medium and Low. Then manage the high risks down to Low, followed by the medium risks. You do this by applying controls, be they procedural or technical, to the risk and measuring the outcome.
It sounds complicated and you may need guidance, but once done and adhered to, it provides peace of mind to you, that you have done what you need to do to get your Cyber Defence in place.
H2 provides affordable and flexible one-off and ongoing data protection and cyber risk protection services.
When you are an owner or director of a company, you will have to face many challenges starting from employing the right people to protecting the sensitive data regarding the company, your workers, suppliers and clients, who buy products and services from you. Nowadays, data leakage prevention is essential in every business. Last week I touched on cyber security strategy, and I’ll expand on that a little more in a week or two, but I’ll just reiterate here that cyber security and data protection are inextricably linked, both practically and legally. They apply equally to the large corporate entities and SMEs alike. It’s purely a matter of scale. So, let’s dive in and learn more about the security and data protection services that you may wish to consider, having first identified your risks and come up with what is called a risk treatment plan, ie a plan to remediate the identified risks to an appropriate level, taking account of the residual risk that your organisation finds acceptable.
Cyber Security Defence – What Are the Most Common Services?
The Insider Threat
There are a lot of actions that can be taken regarding cyber defence. You need to cover both external and insider threat detection. We need to simplify, and where possible, automate our responses and solutions. The more complicated we make it, the more chance of it becoming a liability rather than a solution. The insider threat is one that is often misunderstood and in fact, often ignored. It is one of the most fascinating and alarming aspects of cybersecurity! It refers to the potential risks posed by individuals within an organisation who have access to sensitive information and can misuse it for personal gain or to sabotage the company. These insiders could be employees, contractors, or even business partners who have intimate knowledge of the company’s processes and systems. It’s like a real-life spy thriller unfolding right within the walls of your own organisation! The challenge lies in identifying and mitigating these risks before they cause serious damage. It’s an adrenaline-pumping game of cat and mouse that keeps cybersecurity professionals on their toes! It is important to note that many insider threats come not from any intended action by an employee, but rather a mistaken action taken by an employee who didn’t know they shouldn’t do whatever it is they had done. It’s a primary reason why cyber awareness training is so important. I can’t stress enough how important a comprehensive campaign of such training is.
To protect against insider threats you need, as well as awareness training, a good mix of procedural and technical security. You need a sound access control policy that clearly lays down how to onboard an employee, what access to allow, and how to protect against employees gaining privilege they don’t need and shouldn’t have. That policy should also cover off-boarding when an employee leaves. Here at H2 we have partnered with Cyber Elements to provide solutions to provide the correct provisioning in an easy to administer way.
External Threats
These are the threats that everyone thinks of when the subject of cyber security comes up. It can be very easy, such as identifying and blocking a virus, or it can be very complex. It all depends on the size and range of the problem. For example, ransomware protection. We have partnered with Platinum-HIT (UK) to provide the HDF concept. This provides a unique approach to anti malware and provides a good level of ransomware, and indeed, phishing, protection. On any computer system, data is stored either as non-runnable information data or runnable application programs. Malware is a type of runnable program with undesirable behaviours. HDF prevents malware infection by stopping malware program files from being stored and run on a computer. Simply put, if a program can’t run, it can’t infect your system. This does require a period of examination of your system to identify what does need to run, to run the business, and that is provided within the product.
We have introduced a fully managed proactive cyber defence solution that complements our data protection solution, described below, whilst remaining able to stand alone, in the unlikely event that the data protection element is not required.
In the dynamic world of cybersecurity, staying ahead of evolving threats requires a comprehensive approach that adapts to the ever-changing landscape. At H2, we recognize that one-size-fits-all solutions often fall short, which is why we’ve developed a flexible and scalable cybersecurity solution powered by Guardz, to address the needs of our clients.
Our approach is grounded in sound risk management principles, ensuring that our solutions are aligned with your specific cybersecurity requirements. Whether you need one or more of our solutions, we can tailor an approach that meets your exact needs and budget.
I talked earlier about the symbiotic relationship between cyber security and data protection, which of course includes data leakage prevention, data privacy and compliance. Once again, we have this covered. Our data protection solution is very comprehensive and looks not just at the technical, but also at the procedural aspect of data protection, from providing a virtual data protection officer, to writing and/or reviewing your policies and processes, to identifying where your data actual is, what it’s status is ie sensitive or non-sensitive, and provides the ability to encrypt the sensitive data in order to reduce your risk. If you have a data leak and the data is encrypted, then you are significantly reducing any risk.
Summary
All cyber security defence solutions are designed and implemented in collaboration with the client, during a trial period that consists of between 14 and 30 days, depending upon the solution. All actions can be performed remotely and online and there is no requirement for us to be on site, thus reducing time and expense. Additionally, all solutions are based on SaaS and therefore there is no expensive infrastructure or hardware requirements and being cloud based, it provides the additional advantage that it can monitor and protect end points regardless of where they are, in the office, on the move, or at home.
What’s the advantage of using a cyber defence managed service?
This will differ company to company, and some will have more of an issue, certainly regarding the protection of what is known as Personally Identifiable Information or PII, as defined in the Data Protection Act 2018. Each must decide what their threshold is for residual risk, ie what risk is acceptable to them, once protections have been put in place.
Professional cyber security staff are, currently, difficult to source. There is a global shortage of experienced personnel. They are also expensive to employ. You could also argue that there isn’t a full time job for more than one or two, in many organisations. It therefore makes both operational and financial sense, to outsource at least some of your security operations.
A cyber security strategy is a plan that outlines an organisation’s approach to protecting its information systems and data from cyber threats. This strategy typically includes measures such as implementing security controls, conducting regular risk assessments, training employees on security best practices, monitoring network activity for suspicious behaviour, and responding to security incidents in a timely manner. The goal of a cyber security strategy is to minimise the risk of cyber-attacks and protect the confidentiality, integrity, and availability of an organisation’s sensitive information.
Well yes, you are a target and there are a ton of statistics available which shows that SMEs globally are a very real target for cyber-attacks and can in fact, be very profitable for cyber criminals. There are a lot of reasons for that but one of the top reasons is that typically, SMEs spend very little on cyber defence and generally have very weak defences. Add to this that they don’t tend to carry out cyber awareness training for their staff, have limited resources and generally don’t have a good grasp of the issues.
Not their fault. Most are focused on their core business, trying make a quid or two and are pressed for time. They tend to rely on whatever company, usually local, that supplied their network, hardware and software, generally on a retainer. The problem is that those companies don’t really have a good grasp of the issues either, concentrating on technology, and then, not necessarily the right technology.
Secure by default and design
Now that’s an interesting title, but what does it mean? Secure by default and design means that a system or product is inherently built with security measures in place from the start. This ensures that security is a priority throughout the development process and that users can trust that their data and information will be protected. It also means that security features are enabled by default, reducing the risk of vulnerabilities or breaches. This approach helps to create a more robust and resilient system that is better equipped to withstand potential threats.
It applies as much to your network and systems as it does to software development and possibly more importantly to you, it is a legal requirement under the Data Protection Act 2018, or as it is becoming known, UK GDPR.
The first problem many people come up against is that they already have a network, probably connected to the cloud of some sort, very possibly for SMEs, MS365, but when the design was done, there wasn’t a full risk assessment undertaken which is a requirement to underpin that design. In other words what we in the cyber security industry refer to as Security Architecture Design (SAD), wasn’t a prominent consideration.
No unusual and the common technologies were probably set up, firewalls and anti-virus, but not much else. And that is where a well thought out strategy comes into play.
We’ve already said you are an SME, so do you need the sort of comprehensive cyber security strategy that we would see in a major corporate? No, but it should still cover off the major points and should continue to be reviewed alongside things like your Health and Safety policy and other industry standards that are required to be reviewed for you to stay in business, usually annually.
You need to be thinking about the key components needed to effectively protect an organisation’s digital assets and data. These components may include:
1. Risk assessment: Assessing potential cybersecurity risks and vulnerabilities to identify areas of weakness and prioritise areas for improvement.
2. Security policies and procedures: Establishing clear and enforceable policies and procedures for data protection, access control, incident response, and other security-related activities.
3. Employee training: Providing ongoing training and education to employees on cyber security best practices, such as password management, phishing awareness, and safe browsing habits.
5. Incident response plan: Developing a detailed incident response plan that outlines the steps to be taken in the event of a security breach or cyber-attack, including communication protocols, containment measures, and recovery strategies.
6. Regular audits and testing: Conducting regular security audits and penetration testing to assess the effectiveness of existing security measures and identify any vulnerabilities that need to be addressed.
7. Collaboration with external partners: Establishing a partnership with cyber security company that understands the issues that affect SMEs and who themselves can establish a solid working relationship with the IT provider that is providing and administering your network and IT resources, will enhance your protections, significantly improve your employee and managerial awareness of the issues, and provide you with the peace of mind you need, allowing you to concentrate on your core business.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
Recent Comments