Security Tools Archives - H2 Cyber Security for SMEs

What are the questions business owners ask when considering cyber security?

I wrote a post recently about what SMEs care about regarding Cyber Security v the continued FUD (fear, uncertainty and doubt), which many sales pitches tend to rely on, which helps foster the view that it’s all a little hyped up and not as serious as it advertised. Well, I hope my post did a little to dispel this and show that there really is an issue out there that needs to be addressed by all businesses, not just the corporate big boys. Let’s leave the stats and hype behind and concentrate on what SMEs need to be thinking about.

What is the cost of ignoring cyber security?

Perhaps this is the first question that they should be asking. The financial hit of a data breach can be crippling, especially for the smaller businesses who are perhaps running on tight margins and for whom cash flow is often critical. The average clean up for a smallish business is about £27K. this relates to system restoration, hardware replacement, and the implementation of enhanced security measures. and doesn’t include financial loss from the actual data stolen, or whatever scam was perpetrated, and any fall out from compliance failures, such as fines from the ICO. And at least a third of organisations admit to losing customers post a data breach, highlighting reputational damage and a loss of customer trust.

If you take all that into account, you should be able to work out what the potential cost might be for you.

So, what questions should owners, managers and board members be asking?

I think many get bogged down in the technicalities of IT and don’t consider it in business terms. They don’t think about the business impact of cyber security, about what it is they’re trying to protect. It’s not your IT systems, it’s your data that is the crown jewels. IT systems can be replaced, that’s what your insurance is about, but once the data is stolen, then you are in very real trouble.

Risk Management

Talking of insurance, that’s perhaps how you should be viewing Cyber Security solutions. Don’t think tech, think protecting the business. First and foremost, the board members need to ask themselves if they have a good handle on their cyber risk. Have they identified their cyber assets? What is a cyber asset? Cyber assets are not just hardware and software, in fact those are the least of your worries. It’s the data, where it is and how it’s protected that is important. Have you assessed the risk to those assets? Have you assessed the training requirements for your staff, not just the techies but all staff? Think People, Process and then Technology.

Once you have done this, then you can consider what controls need to be put in place to reduce the risk to an acceptable level.

Below is some of the controls you will need to consider. This list is not exhaustive

1. User Access Control (Admin access is a whole other discussion)

This isn’t just about passwords. Yes, they remain important but on their own, they are no longer sufficient. Nonetheless weak passwords, password re-use and password sharing remain one of the leading root causes of a data breach. 123456 and, believe it or not, password, remain the most used passwords across the world!

It is imperative that you have a strong password policy, dictating not just the length of the password, but also its construction, ensuring that there is a good mix of upper and lower case characters, numbers and symbols, that together make things very difficult for password crackers.

On their own though passwords remain a potential weak spot. Multi factor authentication (MFA), sometimes referred to as 2FA, provides that extra layer of defence and can help to protect against brute-force attacks, phishing scams, key-logging and social engineering. MFA can be simply implemented on most email platforms and within various apps you are using. For those of you trying for Cyber Essentials or ISO 27K series, MFA is mandatory, so make sure it’s put in place.

2. Are you backing up your files?

This seems an obvious thing to do but you’d be surprised how often when trying to restore from a backup, it fails. This is often because the backup routine was set up back in the mists of time and has never been reviewed and even more dangerous, it’s never been tested to see if it works. Set up your backup regime, have it reviewed regularly and tested regularly to make sure it works. If you are backing up online, keep in mind that if a cyber-criminal gets access to your systems to, for example, carry out a ransomware attack, then they can probably get at your back up as well. So, belt and braces, consider having an offline backup as well as an online backup. The latter is more convenient but is vulnerable.

3. Do you train your staff in cyber awareness?

My favourite subject – cyber awareness training. Your first line of defence is your staff, but if not trained adequately, they can be your biggest weakness. It’s known in the trade as the insider threat, but it is caused mainly by human error, staff members doing something they shouldn’t, not maliciously but simply because they didn’t know they shouldn’t. It accounts for 88% of data breaches. Providing your people with training on the threats, current scams and basic cyber awareness reduces the chance of a cyber-attack. This really is the easiest and cheapest quick win any organisation can take in reducing their risk exposure.

4. Do your employees regularly travel or work remotely?

This brings us neatly to what Microsoft coined as the New Normal. Essentially this means remote working shared with in office working, known as the hybrid working model, or for some, moving to a totally remote working system. Totally remote is not as common as hybrid working but is becoming more normal with certain size businesses in certain commercial verticals. It’ll never work for everyone, but for those who have embraced it, it saves a considerable amount of expense. It does however require us to rethink our cyber strategy.

Work-from-home employees are at much greater risk than those in offices. Since home connections are less secure, cybercriminals have an easier entry into the company network. Furthermore, the explosion of various online tools, solutions, and services for collaboration and productivity tend to have the bare minimum of security default setting, and updates from third-party vendors can change security preferences and be easily overlooked.

Phishing becomes an even greater threat to home workers, often because, in an office environment, they have access to colleagues and managers, who they can approach for advice and guidance. This is much harder to replicate with remote workers, especially those who may not be particularly tech savvy and who may not wish to become ‘burdensome’ to their co-workers.

Ransomware also enjoys an advantage in the work-from-home model. If their connection to the company is blocked, it is more difficult for workers to get assistance from the right experts and authorities. And since trust levels are lower when working from home, some workers will be concerned that they have “done something wrong” and so may be more reluctant to seek help. While this risk can be addressed by increased training, as well as messaging that vigilance and involving IT support will be rewarded, it can still be an uphill battle.

We need to break out of the old ‘bastion’ security model of a network protected by firewalls and other technologies and think about solutions that are designed to protect your assets regardless of where your employees work from. They exist and aren’t hard to find.

5. Where is all your data stored and who has access to it?

Data tends to proliferate, especially when working remotely. Cyber awareness training helps here, but it also helps for management to have a handle on data storage. All organisations have this problem, but it becomes more acute for those businesses that hold large amounts of what is known as Personal Identifiable Information or PII. This is information that can identify a living individual and compromise their privacy in some way. Financial advisors, estate agents, solicitors etc, all share this issue. The data protection act, becoming referred to as UK GDPR, is not a suggestion, it is law.

One of the biggest issues we find with organisations of all sizes, is that they think they know where all their data is but get quite a surprise when they discover multiple instances of the same data set. This has become a real issue in that the new normal tempts users when working remotely, with possibly less than robust broadband, to copy data from cloud storage to their PC or laptop to ensure they can keep working on it. Then they upload it again when they’ve finished but forget to delete their copy. That’s just one instance but it is vital to understand where all this data is. What if for instance, you get what is known as a subject access request, where a client or other member of the public wants to know exactly what personal data you have on them, and why. I spoke to a financial advisor not long ago who told me that it took one of their partners off the road for 3 weeks, to discover where all the data was kept on just one person. But under the law, they had no choice but to bite the bullet.

There are several systems on the market which will help with this but what most need now is a system that works regardless of the location of the user and continues providing that cover when the user moves from one location to another. This is just a suggestion, but we’d be delighted to demo it to anyone who is interested. https://hah2.co.uk/gdpr-data-protection/

6. Disaster Recovery and Business Continuity

Business Continuity refers to the proactive strategies and plans put in place to ensure that essential business functions can continue in the event of a disruption or disaster. This could include natural disasters, cyber-attacks, power outages, or any other event that could disrupt normal business operations. Business Continuity planning typically involves identifying critical business processes, implementing redundant systems and processes, and developing communication plans to ensure that the organisation can continue to operate smoothly in the face of adversity.

Disaster Recovery, on the other hand, is focused specifically on restoring IT infrastructure and data after a disaster has occurred. This could involve recovering lost data, restoring systems and networks, and ensuring that IT operations can resume as quickly as possible. Disaster Recovery planning typically involves creating backup systems, implementing data recovery procedures, and testing these plans regularly to ensure they are effective.

Both are critical components of a comprehensive risk management strategy and should be integrated into an organisation’s overall resilience planning efforts.

Just like backups, which are a crucial part of Disaster Recovery, these plans can become very quickly out of date and useless, unless reviewed periodically and tested to see if they work.

7. Vulnerabilities and Threats

A vulnerability is a flaw or weakness in an asset’s design, implementation, or operation and management that could be exploited by a threat. A threat is a potential for a cybercriminal to exploit a vulnerability. A simple way to explain this is that a vulnerability is the inability to resist a hazard or to respond when a disaster has occurred. For instance, people who live on plains are more vulnerable to floods than people who live higher up. The threat is the flood itself.

IT risks and vulnerabilities are the potential threats and weaknesses that can affect the performance, security and reliability of your business function and processes. They can have serious consequences for your business goals, customer satisfaction, and competitive advantage.

Identifying vulnerabilities to your cyber security assets and then identifying the threat to those assets in terms of the vulnerability being exploited, informs your risk and enables you to assign a value to it. Financial value can be assigned to the risk score if you so wish. You then apply controls to bring the risk down to an acceptable level, starting with the Very High risks, and then bringing them down to whatever is acceptable to you. That acceptable level, known as the risk appetite, will vary business to business, risk to risk.

8. Supply Chain Security?

In short, a supply chain attack is a cyber-attack that seeks to damage an organisation by targeting less-secure elements in the supply chain.

An example of such an attack was published by NCSC and points out that many modern businesses outsource their data to third party companies which aggregate, store, process, and broker the information, sometimes on behalf of clients in direct competition with one another.

Such sensitive data is not necessarily just about customers, but could also cover business structure, financial health, strategy, and exposure to risk. In the past, firms dealing with high profile mergers and acquisitions have been targeted. In September 2013, several networks belonging to large data aggregators were reported as having been compromised.

A small botnet was observed exfiltrating information from the internal systems of numerous data stores, through an encrypted channel, to a botnet controller on the public Internet. The highest profile victim was a data aggregator that licenses information on businesses and corporations for use in credit decisions, business-to-business marketing, and supply chain management. While the attackers may have been after consumer and business data, fraud experts suggested that information on consumer and business habits and practices was the most valuable.

The victim was a credit bureau for numerous businesses, providing “knowledge-based authentication” for financial transaction requests. This supply chain compromise enabled attackers to access valuable information stored via a third party and potentially commit large scale fraud.

OK, it was over 10 years ago, but don’t think it won’t happen again.

NCSC also cited what is known as a watering hole attack, which works by identifying a website that’s frequented by users within a targeted organisation, or even an entire sector, such as defence, government, or healthcare. That website is then compromised to enable the distribution of malware.

The attacker identifies weaknesses in the main target’s cyber security, then manipulates the watering hole site to deliver malware that will exploit these weaknesses.

The malware may be delivered and installed without the target realising it (called a ‘drive by’ attack) but given the trust the target is likely to have in the watering hole site, it can also be a file that a user will consciously download without realising what it really contains. Typically, the malware will be a Remote Access Trojan (RAT), enabling the attacker to gain remote access to the target’s system.

If you are in someones supply chain, then you need to make doubly sure that your security protects your customer as well as yourself. And conversely, if you are connected electronically to someone who supplies you, are you sure that you are protected from any vulnerability they may have.

H2 provides affordable and flexible one-off and ongoing data protection and cyber risk protection services.

To learn more about the services we provide please click here https://www.hah2.co.uk/

Please feel free to give us a call or email.

Alternatively, you can book a slot using our Calendly link, https://bit.ly/3yoT0qi

T: 0800 4947478

M: 07702 019060

E: kevin_hawkins@hah2.co.uk

Trust H2 – Making sure your information is secure

All about H2

Introduction

All the information below is contained within the website but we thought it might be useful to summarise it in one post to make it easier for people who want to understand what we are all about.

About myself and H2

I like to start any discussion by saying that I’ve been in the cyber security game almost since before it was a game! I started in Information Security at the MOD at a time when IT and databases were in their infancy and got in on the ground floor. I subsequently went to work for the NHS, HP/HPE, CSC and Symantec, during which time I led many major cyber security projects in the public and private sectors, designing and commissioning the Security Operations Centre for the FCO, carrying out several projects for the MOD, leading the security team for the new online passport application, as well as several high street banks.

In 2013 I was asked to go to the middle east to set up a Cyber Security team covering the UAE, Bahrain, Saudi Arabia, and Qatar, growing the team from 3 people to 24.

On return my business partner and I set up H2 to serve the SME community. Sadly, my business partner did not survive the pandemic, and I am now the sole management of the company.

So why SMEs? Surely there’s more money in corporate security?

Well yes there is, but SMEs are at the heart of our ethos. During our time working in the corporate sector, it became clear that there was little to no support given to SMEs, either at the S, or the M end of the scale, and the big security companies and system integrators were content to leave that to their resellers ie those local IT support companies that resold their products.

Here at H2 we understand that the only real difference between an SME and a corporate organisation, in terms of cyber security, is that of scale. We have therefore scaled our services, the products that support them, and our pricing, to fit with an SMEs issues and

pocket. We like to say that we offer a triple A service providing solutions that are Appropriate (to you), Affordable and Accreditable (to standards such as Cyber Essentials).

Take a look at our Blog and social media posts. We try to inform and educate, placing a link between what we know, and what SMEs need to know but are rarely told.

Solutions Provided to SMEs

The first thing that we discovered is that SMEs have a very poor grasp of cyber security issues, although that is changing following the pandemic when many were forced to change their working practices almost overnight and have subsequently embraced a distributed working model. There is no doubt that the propensity for working from home, or other remote locations, since COVID has introduced some very difficult, or at least challenging, security vulnerabilities into SME networks. For instance, prior to the pandemic, when they were 100% office based (except perhaps some mobile salespeople), their local IT provider will have almost certainly set up what we called the bastion security model. Ie, like a castle, a bastion, you had a wall around you, and for belt and braces, you also had a moat. The gateway was robust, had a drawbridge and portcullis, or let’s call it a secure firewall and anti-malware system. Everything was locked up inside and nice and secure (in fact it probably wasn’t but that’s for another day).

Whilst Microsoft didn’t invent the term the ‘new normal’, they were the first, I believe, to apply it to IT, following the enforced change in working practices brought about by the pandemic. Many companies have embraced this new normal and have settled into some form of hybrid working. Of course, this is nothing new, it’s been ‘a thing’ for years now, certainly in corporate organisations. The real change came about in SMEs for whom it really was quite revolutionary. Corporate bodies will have spent a lot of money on a variety of remote access systems to keep their data secure, whilst SMEs not only had to rush unprepared because of the pandemic, but they simply didn’t have the budget to employ more secure connections.

What the pandemic has done is change that, or perhaps arguably, accelerated the change to a more distributed way of working, already underway in corporate organisations but now common amongst SMEs.

Our first challenge then was that of education. Changing the mindset of SMEs, moving them away from being simply technology focused, onto a more business oriented cyber

security focus. Cyber security is a business issue, not a technical issue and that is something that many SMEs fail to grasp. Any true cyber security professional takes a

risk managed approach, identifying the risks posed to their client, and then applying the principles of People, Process and then Technology, in that order. That risk managed

approach is equally applicable to all sizes of organisation in all sectors and has not changed since the advent of the internet.

Taking the services we provide as shown clearly on our website (where pricing is shown), www.hah2.co.uk, the first is that of Board Advisory, where we offer advice and guidance to our clients regarding their security. We often end up providing this advice for free as we are putting forward solutions to solve their issues but there is of course a limit to that. We also offer a Cyber Maturity Assessment (CMA), which is close to a full risk assessment but tries to keep the costs down to an order that an SME can afford. The CMA is fully described on the website, and we won’t reprint that here.

Another service we provide is Penetration Testing and Vulnerability assessment. Pen Testing is a point in time test ie the minute you finish it and have read the report, it’s out of date. It is however useful to do once a year or when you add a new feature to your systems, or take a new system into use. We use a fully qualified CREST team who can, if you wish, also carry out attack simulations.

Vulnerability assessments are carried out continuously via agents deployed on the network. The main difference is that as a Pen Test will find real issues, a vulnerability assessment will find things that you may be vulnerable to, but which haven’t necessarily been exploited and in fact, may not be a real issue once investigated. They are, however, continuous throughout the year and can be more effective.

We talked earlier about People, Process and then Technology. Arguably your first line of defence is your people. They can also be your weakest link. Data leaks often occur inadvertently, due to a lack of awareness rather than malicious intent. We offer cyber awareness training designed to equip your team with the knowledge and skills to safeguard sensitive information.

This training can be delivered in one of 2 ways. The first is classroom based, either on site or over a remote connection such as Zoom or Google Meet. The second is online training provided via another of our solutions which will be described below and allows

staff to pick when they will take some time to undertake the training which is delivered in a modular fashion, taking up very limited time which won’t take staff away from their desks to too long.

Another very important service which we provide online, cloud based, using a SaaS solution, is aimed at Data Protection. Clients with large amounts of sensitive data that they wish to protect, use this solution. It is essentially a data loss prevention system

that is designed and priced for SMEs, using state of the art file level encryption. This system comes with a 30-day free trial so that clients can see it for themselves.

Based on Actifile it is tailored to the unique needs of the modern business which often sees its staff work remotely as well as in the office. It protects the valuable data you hold and reduces your risk, without breaking the bank. It covers:

Insider Threat Detection: Protect your business from internal threats posed by employees
Ransomware Protection: Safeguard your data from ransomware attacks that can cripple your operations
Data Leakage Prevention (DLP): Prevent confidential information from falling into the wrong hands
Data Privacy and Compliance: Ensure you meet GDPR requirements and avoid costly fines
Automated Encryption: Protect sensitive data with encryption that’s easy to manage.

In the dynamic world of cybersecurity, staying ahead of evolving threats requires a comprehensive approach that adapts to the ever-changing landscape. At H2, we recognise that one-size-fits-all solutions often fall short, which is why we’ve developed a flexible and scalable cybersecurity solution powered by Guardz, to address the needs of our clients.

Our approach is grounded in sound risk management principles, ensuring that our solutions are aligned with your specific cybersecurity requirements. Whether you need one or more of our products woven into a solution, we can tailor that solution to meet your exact needs and budget.

This complements the data protection solution whilst remaining capable of standing alone. Especially devised and priced for SMEs, it maintains our commitment to affordability and accessibility which is reflected in our incredibly competitive price of

£12 per seat, which includes no hidden charges, add-ons, or expensive infrastructure costs. The solution comes with a 14-day trial to give you hands-on experience with our solutions and assess their impact on your business.

This solution comes with a fully loaded Cyber Security Awareness training course, and a Phishing simulation capability.

You should note that we have bundled the 2 managed services together and offer them at a price reduced by £3 per seat per month.

Finally, we offer certification in Cyber Essentials and Cyber Essentials Plus which provide robust defences, endorsed by UK government to guard against common cyber-attacks. They are required certifications to work with public sector entities, and achieving certification signals a commitment to securing client data.

We now offer different pricing options to our clients. For Cyber Essentials we offer:

Our Supported Package whereby we guide you during yourself assessment ensuring that you achieve certification first time, can be purchased at a one-off price which we are happy to quote for or a monthly subscription from £61 per month.

If you are short on time or not too sure what to do, try our Turnkey Package whereby we carry out the assessment for you in total, once again ensuring that you achieve certification first time. This can also be purchased as a one off at a price which we are happy to quote for or there is a subscription price which starts at £120 per month.

We can offer consultancy around ISO 2700X if it is considered desirable or appropriate. We can advise on that.

HOW DO HACKERS HACK?

You’ll have to forgive me for a somewhat provocative title and allow me some poetic licence, because in fact, different hacking groups do things differently, although they have much in common. Personally, I don’t like the term hacker, much preferring cybercriminal, because anyone who accesses a system without the owners’ permission, is by definition, a criminal. But I suppose hacker is less of a mouthful.

So, what is hacking? Hacking involves exploiting vulnerabilities in systems, software, or networks to gain unauthorised access or manipulate data using a variety of techniques and methods, which tend to combine technical tactics and social engineering.

One of the first things a hacker, or criminal group, will do, is to profile your organisation and your people. Favourite open sources of information include:

Social media: Information about hobbies, job roles, family, and schedules shared on platforms like LinkedIn, Facebook, and Instagram. Do you have a social media policy in your company? Do you lay down what an employee can and cannot say about your company on their personal social media pages? Do you have a designated person in the company who handles your company’s profile on social media?

Company Website: You’ll want to give prospective clients contact information of course, but you should not give out individual email addresses and limit profiles published. I do give my personal profile on my website but don’t give information about any other position, leaving it to a generic phone number and email address.

Professional Profiles: LinkedIn is a favourite for targeting businesses, as it provides details about an individual’s role, connections, and organisational structure.

Personal Websites or Blogs: These may reveal contact details, interests, or sensitive information inadvertently. The same issues that appertain to social media apply here.

Data Brokers: Cybercriminals can purchase detailed dossiers on individuals from data aggregator sites.

Another favourite is phishing and pretexting.

Phishing Emails: We all know, or at least I hope we know, what phishing is. Attackers send emails designed to extract more information, such as login credentials, by posing as a trusted entity. In this context, it could be as simple as the attacker wanting to verify information by perhaps sending an email to a discovered address but wanting to confirm that individuals position in the company. That just requires a response showing a signature block, so the phishing email might seem very innocuous.

Fake Surveys or Job Offers: These can be used to obtain detailed personal or professional data.

There are a variety of reconnaissance tools used by attackers, including open-source intelligence (OSINT) tools, WHOIS lookups and scanning misconfigured systems using commercially available tools such as Nmap and Nessus, which identify open ports, services and weak configurations. This is why it’s essential to regularly scan your network for these weaknesses. Ports can be opened for a particular reason and never closed again. It’s a common fault.

Here at H2 we scan the dark web daily looking for leaked credentials, particularly email credentials. When we on board a new client we nearly always get hits with sometimes up to 20+ compromised email addresses including passwords. You might ask why they’d be on the dark web – simple, they are often up for sale on dark web marketplaces.

In terms of cybercrime, who’s heard of psychological profiling? Cybercriminals analyse:

Behavioural Patterns: Regularity in actions, such as times a person is online, financial habits, or common purchases.

Weaknesses and Triggers: Examples include a recent job loss, major life changes, or emotional vulnerabilities, which they exploit through spear-phishing or scams.

I’ve often argued on these pages, that your employees are both your first line of defence and your greatest weakness, and that a good cyber awareness programme is worth its weight in gold. Cybercriminals often focus on employees in specific departments (like HR, finance, or IT).

LinkedIn and Organization Charts: Identify individuals with access to sensitive data.

Impersonation: Pretending to be a senior executive to trick lower-level employees (e.g., through Business Email Compromise attacks – I’ve written about the CEO scam a lot).

Technical Probing: Use of phishing or malware to breach a target’s employer.

In conclusion, what I’ve tried to do here is give you a flavour of what you may be up against, and I hope, I’ve shown you that for all the reasons shown above technology comes last after people and process. All the tech in the world won’t prevent issues arising from the above and is just one part of an integrated defence in depth required to prevent disaster.

Remote Working and Encryption

This is a subject that I tend to jump on every so often, because it’s one that people just don’t seem to get. Whether it’s working from home, from a coffee shop, airport, railway station etc, there is this perception that it’s safe because you’re connected via VPN, or perhaps some other form of application which encrypts data in transit. Well, let’s explore this subject a bit further.

There is no doubt that the propensity for working from home, or other remote locations, since COVID has introduced some very difficult, or at least challenging, security vulnerabilities into your network. For instance, prior to the pandemic, when you were 100% office based (except perhaps some mobile salespeople), your local IT provider will have almost certainly set up what we called the bastion security model. Ie, like a castle, a bastion, you had a wall around you, and for belt and braces, you also had a moat. The gateway was robust, had a drawbridge and portcullis, or let’s call it a secure firewall and anti-malware system. Everything was locked up inside and nice and secure (in fact it probably wasn’t but that’s for another day).

Whilst Microsoft didn’t invent the term the ‘new normal’, they were the first, I believe, to apply it to IT, following the enforced change in working practices brought about by the pandemic. Many companies have embraced this new normal and have settled into some form of hybrid working. Of course, this is nothing new, it’s been ‘a thing’ for years now, certainly regarding corporate organisations. The real change came about in SMEs for whom it really was quite revolutionary. Corporate bodies will have spent a lot of money on a variety or remote access systems to keep their data secure, whilst SMEs not only had to rush unprepared because of the pandemic, but they simply didn’t have the budget to employ more secure connections.

What the pandemic has done is change that, or perhaps arguably, accelerated the change to a more distributed way of working, already underway in corporate organisations but now common amongst SMEs. What does that mean for us? Firstly, we have to re-think how we are going to work. We start from a position where we still have preexisting tech, such as VPNs and whole disk encryption, to tackle modern and evolving issues.

So, what about VPNs? What are they? A VPN, or Virtual Private Network, is a service that creates a secure, encrypted connection between your device and the internet. This private “tunnel” protects your data and hides your IP address, effectively masking your online identity and activity. It works by allowing you to connect to the internet via an encrypted tunnel to a VPN server, which then forwards your requests to the website or service you’re accessing. The benefits are that it protects your data from being accessed by hackers or eavesdroppers, especially on public WIFI. It masks your IP address and replaces it with one from the VPN server, so it’s harder for websites, advertisers, or even your ISP (Internet Service Provider) to track your online activity. It’s particularly useful when working from insecure public WIFI but should also be used when working from home.

VPNs are available as standalone apps and more often now, incorporated into other applications, particularly those used to connect to cloud services.

All good, right? Well yes, anything that helps secure your data is a good thing. But like all good things it has some downsides. A VPN does help protect data in transit over an insecure WIFI connection by encrypting the data you send and receive over the internet. This means that if you’re connected to an insecure WIFI network (like in a coffee shop or airport), the VPN will prevent anyone from intercepting and reading your internet traffic.

However, a VPN does not protect data stored locally on your laptop. Files or personal information saved directly on your hard drive are not protected by the VPN. To secure the data on your laptop, you may want to consider using additional protections such as some sort of full disk encryption (BitLocker for Windows or FileVault for macOS are standard with the operating systems) to protect data at rest. And you should be using strong passwords and multi-factor authentication.

So, what I’m saying here is that should someone manage to gain access to your end point ie your laptop, desktop, even your phone, then your VPN is not going to protect you.

Let’s now talk a bit more about Bitlocker and FileVault. BitLocker, Microsoft’s disk encryption tool, provides robust security when configured properly (but I make the point here that it’s often not only incorrectly configured but isn’t even in use, making it pointless). And, like all encryption systems, its security depends on several factors, including the version of BitLocker, implementation practices, and potential vulnerabilities in the system environment. Bitlocker uses strong encryption, either AES 128 or 256 Bit, both of which are considered secure.

FileVault is the MacOS equivalent of Bitlocker (roughly) and is considered secure and built into the MacOS and is very easy to switch on. It too offers full disk encryption using AES 128 or 256 Bit. Once again though it is often not in use by Mac users, many of whom don’t even know it exists.

Are there any drawbacks to whole disk encryption? Will it protect me against things like ransomware? Whole disk encryption is designed to secure data at rest by preventing unauthorised access to data on a physical storage device (e.g., in case the device is lost or stolen). The problem is that once the machine is booted up, using the correct authentication, the disk is unencrypted, allowing you access to the data. So, the answer to the specific question re ransomware is that such an attack is typically not mitigated by this kind of encryption because:

Ransomware Operates at the OS Level: Once a device is booted up and the encrypted disk is unlocked (usually via user login), ransomware can interact with files just like any other software. Since the operating system has access to the data, the ransomware does as well.

Ransomware Encrypts Data Independently: Ransomware generally works by encrypting the contents of individual files or directories (not the entire disk), effectively “locking” them within the already-decrypted environment. BitLocker, or any full disk encryption, won’t stop ransomware from doing this, as it doesn’t interfere with file operations once the system is unlocked.

No Version Control or Rollback: Whole disk encryption solutions don’t provide a way to revert to previous file versions or recover from ransomware encryption. This is where regular backups (stored separately from the network) play a critical role in protecting against ransomware.

You’re being careful, you have a VPN, and you have Bitlocker configured on your laptop. You’re feeling nice and secure and have no issues using the local Coffee Shop or your home WIFI. Your connection to your cloud service is secure and all your data in transit is encrypted. Even your email is going via a secure tunnel. All is good with the world. Except of course that as soon as you logged on your whole disk encryption is switched off and your data is vulnerable even before you transmit it. Any data you download to work on likewise becomes vulnerable as soon as it lands on your laptop.

Earlier I argued that VPNs were old tech being used to combat modern threats and a different way of working. Does that mean that I think the VPN is no longer useful and is going out of style. No of course not, VPNs have a very real place in our security architectures and that won’t go away anytime soon. But they, like the vulnerabilities they are trying to mitigate, have to evolve and keep pace with present day and future realities.

VPNs, whether stand alone, or incorporated into another technology are great at securing data in transit. What about your data at rest? The best VPN in the world won’t protect you from someone who is determined to get in and steal your data or install ransomware. The problem for SMEs is the same that it pretty much always has been. Cost. Can they afford a system that will protect their data and stop it being lost, stolen or ransomed.

What has long been needed is a simple, flexible and intuitive security solution. We believe we have found such a system that protects your company against all known threats, and puts you firmly in control of your data, working automatically 24/7 to identify and safeguard your sensitive information.

Delivering multi-level protection, it provides real time control over all sensitive data. You can identify and solve every problem with a single click of your mouse! Instead of whole disk encryption, which is decrypted as soon as you log on, it provides file level encryption which allows authorised users access but no one else. But it does more, it locates all your data, allows you to decide what is, and what is not, sensitive, and provides subscription pricing for a fully managed solution.

It’s a system that is designed specifically for SMEs and is therefore appropriate to you, and affordable. To prove that we offer a 30-day free trial so that you can see it for yourself. Check it out at https://hah2.co.uk/gdpr-data-protection/.

Is Protective Monitoring Necessary for an SME?

I’ve talked about protective monitoring in the past but there is still some misperceptions about it, particularly amongst SMEs. Probably first and foremost is that it is way too expensive, which leads to thinking that it’s not for them and is much more of a nice to have than a necessity. I thought I’d take a bit of a deeper dive into this.

So, what is it?

Protective monitoring in cyber defence is a systematic approach to continuously observing and analysing an organisation’s digital environment to detect, prevent, and respond to security threats. It involves gathering and analysing data about network traffic, system activity, and user behaviours to identify potential vulnerabilities or malicious activities. Here’s a breakdown of its key components and purposes:

For a small or medium-sized enterprise (SME), implementing cyber protective monitoring is crucial for a variety of reasons. This proactive approach can be the difference between quickly identifying and mitigating threats or facing significant damage from a cyber-attack. Here are key reasons why SMEs should consider cyber protective monitoring:

1. Protection Against Data Breaches

SMEs often hold sensitive data like customer information, financial records, and intellectual property. Companies like law firms, financial advisors and estate agents, will hold years worth of personal identifiable information as defined by the Data Protection Act, or UK GDPR if you prefer. Protective monitoring helps identify unusual activity within their network, such as unauthorised access or data exfiltration attempts, allowing for swift action to prevent breaches.

This is especially important as SMEs can be perceived as easier targets by cybercriminals compared to larger enterprises with more robust defences.

2. Regulatory Compliance

Many industries have strict regulations around data privacy and cybersecurity, such as GDPR and PCI-DSS. Protective monitoring helps SMEs stay compliant by providing visibility into how data is accessed, used, and secured.

It allows them to maintain audit trails of activity, which are often required to prove compliance during an audit or investigation.

3. Early Threat Detection

Cyber threats are constantly evolving, and attackers are often inside a network for days or weeks before launching an attack (such as ransomware). Protective monitoring enables the detection of anomalous behaviour that could indicate a security threat before it becomes critical.

This helps minimise damage by enabling a faster response to potential threats like malware infections, unauthorized access, or network vulnerabilities.

4. Cost-Effectiveness in the Long Run

While some SMEs may view cyber protective monitoring as an additional cost, it is often more cost-effective than dealing with the fallout of a cyber-attack. The financial impact of a breach includes legal fees, loss of business, damage to reputation, and potential fines from regulatory bodies.

By investing in monitoring, SMEs can save significantly on these potential costs, making it a smart investment, especially now that there are systems specifically designed and costed for SMEs.

5. Building Trust with Clients and Partners

Customers and business partners expect their data to be handled securely. An SME with strong cybersecurity practices, including protective monitoring, can build trust and demonstrate its commitment to data security.

This can serve as a competitive advantage, especially when dealing with larger enterprises or industries that prioritise security.

6. Rapid Incident Response

When a security incident occurs, the speed of the response is critical. Cyber protective monitoring provides real-time alerts when suspicious activities are detected, enabling SMEs to quickly isolate affected systems and take necessary actions.

A rapid response can help contain potential damage, maintain business continuity, and limit operational disruptions.

7. Mitigating Insider Threats

Not all cybersecurity risks come from outside the organisation. Insider threats, whether malicious or accidental, can cause significant damage. Protective monitoring can help detect unusual behaviour from employees or contractors, such as unauthorised access to sensitive data or suspicious data transfers.

This allows SMEs to address these issues before they lead to data leaks or other security incidents.

8. Scalability and Adaptability

As SMEs grow, their digital footprint and potential vulnerabilities expand as well. Cyber protective monitoring solutions can scale alongside the business, ensuring that security measures remain effective even as new systems, networks, and applications are added.

This adaptability makes it easier for SMEs to adjust their cybersecurity strategy as their needs change, without a complete overhaul of their security infrastructure.

9. Insights for Better Decision-Making

Beyond just identifying threats, protective monitoring can provide valuable insights into network usage and performance. SMEs can leverage this data to make better strategic decisions regarding their IT infrastructure, such as identifying redundant systems or optimising network resources.

It can also highlight areas that require further security investments, helping prioritise spending on cybersecurity.

10. Improving Overall Cybersecurity Posture

Cyber protective monitoring is a key part of a broader cybersecurity strategy. By continuously monitoring and analysing network activities, SMEs can better understand their vulnerabilities and areas for improvement.

This helps create a culture of security within the organisation, where cybersecurity is not just an afterthought but an ongoing priority.

Overall, cyber protective monitoring provides visibility, control, and peace of mind for SMEs, helping them navigate the complex and ever-changing landscape of cyber threats. By taking a proactive stance, they can protect their assets, maintain customer trust, and ensure long-term resilience against cyber-attacks.

Protective monitoring is not just for corporate organisations, but is for everyone, especially now that there are systems and services designed especially for SMEs and priced accordingly. Don’t leave it until it’s too late. Playing catch up and fixing problems after the event, is always much more expensive that taking a pro-active stance.

To learn more about the protective monitoring managed solutions we provide please click here https://www.hah2.co.uk/

Can Remote Working be Dangerous?

Well frankly, yes it can be dangerous. There is a myriad of issues which have sprung out of remote working since COVID, with many SMEs, now operating a hybrid working scenario, although in my experience, certainly amongst my customer base, there are very few going 100% remote.

Businesses of all sizes have been forced to transform their operations to support remote work and by and large have done well, but not without many challenges—including video conferencing burn out, (along with wishing they’d taken out shares in Zoom!!), and a yearning to work together in person again, someday. We all realise that group working, face to face, is often necessary not just for efficiency, but because we are social animals. Experience has taught many businesses many things, but strangely, to my mind at least, many have simply not grasped the potentially dire consequences in terms of cyber security and data protection.

A distributed work environment i.e., personnel spread around various locations, office, home working, even the local coffee shop, creates critical challenges and new security threats as a result. The speed with which this has happened has meant that many simply did not take this into account and if they did, thought, well, this is temporary, and it won’t matter in the long run. Well perhaps, but as many are now finding, there have been advantages to home working, not least a lowering of costs in terms of how much office space is needed to carry out the business function. Many are now looking at Hybrid working i.e., from home with a day or two in the office during the week. There are pros and cons to this outside of the scope of this article, and businesses will have to make their own judgements, but one thing is clear and that is that businesses need to understand the risks now inherent in distributed work and need to get better at cyber security and data protection, in those environments.

Employees when remote working, are at much greater risk than those in offices. Since home connections are less secure, cybercriminals have an easier entry into the company network. Furthermore, the explosion of various online tools, solutions, and services for collaboration and productivity tend to have the bare minimum of security default setting, and updates from third-party vendors can change security preferences and be easily overlooked.

Phishing becomes an even greater threat to home workers simply because, in an office environment, they have access to colleagues and managers, who they can approach for advice and guidance. This is much harder to replicate with remote workers, especially those who may not be particularly tech savvy and who may not wish to become ‘burdensome’ to their co-workers.

Ransomware also enjoys an advantage in the remote working model. If their connection to the company is blocked, it is more difficult for workers to get assistance from the right experts and authorities. And since trust levels are lower when working from home, some workers will be concerned that they have “done something wrong” and so may be more reluctant to seek help. While this risk can be addressed by increased training, as well as messaging that vigilance and involving corporate IT will be rewarded, it can still be an uphill battle.

One of the biggest dangers I still see day to day is the dangers inherent in working from the local coffee shop. This is a subject that I tend to jump on every so often, because it’s one that people just don’t seem to get. Whenever I drop into a coffee shop for my caffeine infusion, there are usually at least a couple of people with their laptops open, working away on business issues. I could see open spreadsheets (and easy to read if you were sitting behind them), and all have their email open. They are often on a video call, and I can often hear all their side of the conversation, annoying enough for other café users but they are oblivious of the data being released into the wild.

If you are among those free Wi-Fi lovers, there’s bad news for you… your online privacy and security is at risk, if you rely on the weak to non-existent Wi-Fi security protocolsat coffee shops. This means that you could be exposed to various threats such as identity theft which has over 15 million cases each year, data theft/breaches, introducing malware to your business network and that of your customers/suppliers. This list is not exhaustive.

Free or public Wi-Fi’s are hotspots for hackers and data snoopers who want to steal your private data or financial information. It is easy for hackers to do that nowadays. You will be surprised to know the different ways hackers can compromise your device or your private information and why you shouldn’t rely on Wi-Fi security at coffee shops as they come with a lot of risk.

Unencrypted Data Exposure: If the Wi-Fi network is not encrypted, your sensitive information (e.g., passwords, emails, and financial data) can be intercepted by hackers using packet-sniffing tools.

Man-in-the-Middle Attacks: Hackers can position themselves between you and the network, intercepting and potentially altering the communication between your device and the server, leading to data theft or manipulation.

Fake Hotspots (Evil Twin Attacks): Cybercriminals may create a rogue Wi-Fi network that mimics the coffee shop’s legitimate network. If you connect to it, they can access all the data transmitted over the connection.

Malware Injection: Open networks can allow hackers to inject malware or viruses onto your device, which can lead to long-term breaches of your data or systems.

Session Hijacking: Attackers can intercept your session cookies, giving them access to your accounts, even if you’re using secure websites.

To mitigate these risks, use a VPN, avoid sensitive transactions, and ensure your firewall and antivirus software are active. Although a VPN may not save your data if it’s stored on your laptop.

We are huge supporters of Cyber Awareness training for managers and staff, arguing that this is no longer a ‘nice to have’ and is now very much a necessity. In fact, it is arguably the biggest quick win, giving the greatest potential return on investment that there is. Of course, this means that companies must understand what their threats, vulnerabilities and risks are, to assess exactly what training is going to be the most effective.

But that alone won’t save you from a dedicated hacker. We need to look at some more technical solutions to help you beat attacks. Here at H2 we have researched and developed services using Software as a Service (SaaS), which, being cloud based, work wherever you are, office, home or coffee shop, and encrypts your most sensitive data whether on your machine, or in transit.

If you feel a no obligation chat about this would be helpful, give us a call.

How are Mid-Market Businesses Faring Regarding Cyber Security

Mid-sized businesses are under as much pressure to keep the organisation secure as are the larger corporates but without the deep pockets that those larger corporates have. Because of this they are also fast becoming the easy target that we often view small businesses as being, but with a larger payload for the cyber-criminal. In fact, in 2023, 59% of medium sized businesses suffered a cyber-attack or data breach in the UK.

The biggest issue facing mid-market organisations is balancing limited resources with the growing complexity and volume of cyber threats. The lack of resources is compounded by an overall dearth of cyber-security skills in general, and a real lack of skills in mid-sized companies and the IT companies they often outsource to. Key aspects of this challenge include:

1. Resource Constraints: Mid-market organisations typically lack the budget and personnel to implement robust, enterprise-level cyber-security solutions. They may not have dedicated security teams, forcing IT departments to manage cyber-security alongside other duties. This dilutes skills and leaves them vulnerable to sophisticated attacks.

2. Rising Threat Sophistication: Cyber-criminals are increasingly using advanced tools and techniques, such as ransomware, phishing, and supply chain attacks, now enhanced with AI, which often outpace the security capabilities of mid-sized businesses. These organisations are prime targets because they are often seen as less protected than larger enterprises but more valuable than small businesses.

3. Compliance and Regulatory Challenges: As regulations like GDPR, FCA, and industry specific mandates grow, mid-market companies struggle to meet compliance requirements without the same level of support and infrastructure that larger organisations can afford.

4. Lack of Cyber security Awareness: Employees at mid-market organisations may not have adequate training on cyber-security best practices, making them vulnerable to human error, such as falling for phishing scams or weak password practices.

5. Third-Party Risks: Mid-market companies often rely on third-party vendors for various services, but they may lack the resources to thoroughly vet these vendors’ security postures, leading to vulnerabilities in their supply chain.

Addressing these issues requires mid-market organisations to prioritise cyber-security despite resource constraints, invest in scalable security solutions, and foster a strong security culture throughout the organisation.

There is a very real difficulty in breaking out of this cycle. The mind set of most board members is to focus on the core business and keep costs to an absolute minimum. Costs are important in a mid-sized business, especially one where margins may be tight. IT budgets will focus on items, both hardware and software, that are required to keep the revenue flowing and its cyber-security solutions, including data protection solutions, are often seen as nebulous because there is no obvious return on investment. CIOs/CISOs/IT Directors are often left trying to prove a negative, ie we haven’t had any security issues because we have protections in place, as opposed to we haven’t had any security issues therefore we don’t need to budget for protections. It’s a years old argument that never seems to have a resolution.

However, breaking out of this cycle, this thought process, is very important. Cyber threats, what we refer to as the threat landscape, are evolving at a frightening pace, often enhanced using AI. This will further compound any argument about budget simply because there is this need to keep pace with the cyber-criminal, and those of us in this industry know that we have always been playing catch up.

So how do we do it? Not an easy answer but one way that some mid-sized organisations are now looking at is managed security solutions. The provision of SOC (Security Operations Centre) solutions, in a shared way, as we do with cloud services for example, makes managed security more affordable. Many of the large enterprise organisations also make use of managed security solutions for the reasons of cost. On site solutions are not just expensive in terms of hardware and software, but also staffing costs, training etc, can be exorbitant. So, sharing those costs becomes very attractive.

Of course, there is no one size fits all solution and most managed service providers will have a set of services it provides, and do not tailor their services simply because it would make them too complex and expensive to provide, somewhat obviating the whole reason for doing it in the first place.

To make sure that you have the level of protection that you need, then you must do some up front work, maybe getting some consultancy that will save you money in the long run, by getting the protections and levels of service in place that you actually need.

There are several solutions around and organisations that provide them, and I do recommend that you shop around. Some are better than others and the CrowdStrike issue hasn’t done the reputation of managed services much good. Here at H2 we offer solutions for both monitoring your technical estate, your user actions, email, cloud services etc, as well as your data protection issues providing monitoring of any compliances that you may need, including UK GDPR, PCI DSS as an example.

If in doubt give us call, we’d be delighted to chat it over, offer a demo and a FREE trial lasting up to 30 days for the data protection solutions and 14 days for the more technical solution.

Is Cyber Security about Tech or the Business?

It’s simply a fact that many owners, managers, directors etc, believe that cyber security is a technology issue and is best left to those guys in IT who understand that stuff. Here at H2 we spend a lot of time and effort trying to educate C level people, that it really is a business issue, although it has significant input from the techies. It’s a business issue because breaches can have a significant financial and reputational impact. It’s also an IT issue because it involves implementing technical measures to protect systems and data. Effective cyber security requires a collaboration between business leaders and IT professionals to address both the strategic and technical aspects of security.

The crux of the issue though, is that it must be led by the business, and at board level. It requires a strategy to be followed, which is laid down at board level and which is focused on the goals and aspirations of the business, especially when your IT is outsourced. You can outsource your IT, but you can’t outsource your responsibility.

A valid argument is that the proliferation of security tools creates an illusion of safety. Organisations, large and small, often believe that by deploying a firewall, antivirus software and maybe some other tools, such as intrusion detection systems, they are adequately protected. This ignores the fact that such tools are controls put in place to mitigate risks identified and qualified in terms of importance, in a risk assessment and unless the benefits they bring are properly identified, and the solutions placed and configured correctly, they may well not be doing what you think they are doing. This thinking can also introduce significant third-party risks into your domain. The most recent example of this is the CrowdStrike issue which caused so much chaos throughout the globe.

To be fair to most companies in the smaller and mid-market arenas, their focus is on obtaining IT solutions as cost effectively as possible, and with the minimum of support costs. Cost control is vital to most. This means that they are extremely reluctant to spend money on what they see as not being part of their core business. Of course, if they get a cyber-attack or scam, or worse a data breach attracting the attention of the ICO, then their costs trying to fix the issue can easily outstrip any costs in prevention. Unless they have a well thought out risk managed strategy, they are wide open to slick sales pitches which push products. The rub is that in order to have that well thought out strategy, it means spending on what they see as expensive services that can seem somewhat nebulous, not something they can see and feel, and there is that vague feeling that they are being led to do something that really isn’t all that important.

The approach most take is to trust their IT provider to give them the protections they need. Most of these IT providers are what is known as re-sellers, ie they sell other people’s products and will push those products because that’s their business model. What they won’t do is take a risk managed approach which is essential in ensuring that any limited spend on security, limited because of cost constraints, is targeted where it’s needed and will be most effective. In other words, the technological approach taken by most IT support company’s will do half a job at best.

In essence then, if you don’t understand the risks you face, how can ensure that your cyber security strategy and protections are fit for purpose? Risk management is all about helping us to create plans for our future in a deliberate and responsible way. This requires us to explore what could go wrong in an organisation, on a day-to-day basis.

A quote from Bruce Schneier, Fellow at the Berkman Center for Internet & Society at Harvard Law School, goes like this:

‘If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology’.

How do we approach this then? First and foremost, you need to identify the risks that you face. How can you identify that risk and then mitigate it? Taking risks is a part of business. You assess risk every day when doing business. Do you want to do this deal? What happens if it goes not as expected? Do I want to take this person on? Whether you formally undertake a risk assessment or whether you assess that risk informally, you are working out what is appropriate to a level that is consistent with the risk that your organisation is prepared to take. Failure to do that will almost certainly be damaging to your business, perhaps fatally so.

The difference between assessing day to day business risk and assessing risk to cyber assets, is one of understanding. What is a cyber asset? In this context insert the word ‘information’ instead of cyber. It is the information contained within the IT system that is the important asset, not the piece of hardware it is sitting on. You understand your business risk, after all it is your business, but do you understand information risk? Do you have a clear idea of what information assets you have and where they are? Before you answer that think it through. Do you really know where all the data is? OK, you know that you have a server or servers probably in a cloud somewhere (cloud storage and access is a whole other subject) and that somewhere in those servers there is a bunch of data which runs your business. How much of that data has been saved onto staff workstations when they needed it to carry out some work? How much has been copied off somewhere else for what was probably a very good reason at one point? How well is your firewall functioning? Can malware work its way onto the network because the firewall does not have Universal Threat Management installed and can therefore be probing the servers and workstations. And we haven’t even thought about changes in working patterns. How many of your staff now work remotely some or all of the time. I could go on.

How can we be sure where all this information is and how important each bit is to the business? How can we assess this risk to the business, if information is lost or otherwise compromised? What about ransomware, phishing scams etc? The good news is that some of this can now be automated and managed for you at an affordable price and you can even arrange a 14 day totally free trial to assess its effectiveness.

New Cyber Threats and Innovations

Cybersecurity is an ever-evolving field, with new threats and innovations emerging regularly. Not all these threats will apply to everyone, the trick is, and has always been, identifying the threats that apply to you, working out how vulnerable you are too those threats, and applying controls to bring those down to an acceptable level. That acceptable level will change, not just from company to company, but also asset to asset. Don’t waste valuable time and energy trying to achieve a zero-threat level. It doesn’t exist. You need to understand clearly what your appetite for risk is, ie what is an acceptable level of risk for you, and then go for it.

But what emerging threats are there that you just might have to combat in your daily business life. These trends highlight the ongoing innovation in both cyber threats and defences, driven by the growing reliance on digital infrastructure and the rapid evolution of technology.

Here are some suggestions and trends in cybersecurity as of late 2024:

1. AI-Powered Cyber Attacks and Defences

Threats: Cybercriminals are increasingly using AI to launch more sophisticated attacks, such as AI-driven phishing campaigns, automated hacking attempts, and machine learning-based malware that adapts to security measures. We’re seeing AI powered social engineering, phone calls mimicking voices of managers, and similar. Like with just about all AI usage, what it does it make things much easier by reducing human effort. So, attacks can be set up using AI and become almost fire and forget, just letting it get on with it in the background.

Defense: Organisations are countering this with AI-based threat detection systems, anomaly detection, and predictive analytics to identify potential breaches before they occur. What about your defences? Are they keeping up with these types of threat. What about mobile workforces, are your staff covered once they leave the office; do you have a hybrid or even fully remote workforce? If so, are your defences up to the job? Check out https://hah2.co.uk/

2. Ransomware Evolution

Ransomware continues to be a major threat, but it’s evolving with more advanced encryption techniques, and multi-stage attacks where attackers exfiltrate data before encrypting it. They then threaten to publish the stolen data unless a ransom is paid. I recently heard of a company that had been infiltrated through its website which was transactional, ie it sold stuff via the website and the website was connected to their database of products and sales order processing system. The web developer didn’t have sufficiently robust security in place. A good example of an SME being exploited via their supply chain.

Double extortion and Ransomware-as-a-Service (RaaS) have become more common, where hackers sell ransomware kits to other criminals.

3. Zero Trust Architecture

Zero Trust has moved from a buzzword to a mainstream security model. Organisations are adopting a “never trust, always verify” approach, assuming that every user and device, both inside and outside the network, could be compromised.

Implementing least privilege access, micro-segmentation, and continuous authentication are key features of this approach. And no, this doesn’t have to be cost prohibitive.

4. Supply Chain Attacks

Attacks targeting third-party vendors and software providers have increased. By compromising trusted suppliers, attackers can infiltrate many organisations through a single breach.

Notable Examples: The SolarWinds and Kaseya attacks were significant instances that highlighted the dangers of such supply chain vulnerabilities. The attack on the NHS via a contracted service provider, is also a good example but it doesn’t just affect the big organisations. See above for an example of how an SME was attacked via a third-party web designer.

5. Post-Quantum Cryptography

With quantum computing on the horizon, there’s increasing focus on developing encryption algorithms that can resist quantum attacks. Post-quantum cryptography is becoming a hot topic as organisations prepare for the future of computing.

Even without quantum computing, many organisations do not use encryption, even for their critical data. If you are subject to a data breach, but that data is encrypted, you could save yourself a lot of money and reputational damage.

6. Cloud Security and Misconfiguration

As cloud adoption accelerates, the security of cloud environments remains a top concern. Misconfigured cloud settings continue to expose sensitive data, while cloud-native security solutions (e.g., CSPM, CWPP) are becoming more prevalent.

Securing multi-cloud environments and addressing shared responsibility models are critical challenges.

7. Cybersecurity for IoT and OT

The Internet of Things (IoT) and Operational Technology (OT) are becoming frequent attack targets. Securing connected devices, industrial systems, and critical infrastructure from cyber threats is a growing concern, especially as they are often lacking in adequate security protocols.

This is becoming more critical as home working becomes more and more popular. Employees connecting to your company cloud and systems using home broadband and WIFI, are also de fact connecting to any IOT devices that they are using in the home, potentially opening up back doors into your system.

8. Data Privacy Regulations and Compliance

Data privacy is a key focus as more countries introduce stricter regulations like the Data Protection Act 2018, now becoming known as UK GDPR (General Data Protection Regulation). There are other compliances such as FSA regulations and other industry bodies, that many need adherence to. Data breaches can produce fines from regulatory bodies, law suites from those affected, and quite severe reputational damage.

9. Cybersecurity Automation and SOAR

Automation is becoming critical in cybersecurity due to the sheer volume of threats. Security Orchestration, Automation, and Response (SOAR) tools help streamline incident detection and response, freeing up analysts to focus on complex tasks.

Do you have anything in place to automate your defences? Do you monitor your systems for threats?

10. Identity and Access Management (IAM)

Identity theft and credential stuffing attacks are rising, making IAM solutions more important than ever. Multi-factor authentication (MFA), password less authentication, and biometrics are seeing widespread adoption to prevent unauthorised access.

Are we failing in our cyber resilience?

The fallout from the CloudStrike sensor failure, which caused severe outages throughout the globe, is still being felt and will be felt for some time to come. The emphasis has been on recovery but that will start to change, as we focus more on why it happened, and what can be done to mitigate further failures of this kind. I’ve said already, in a piece I wrote last week (https://hah2.co.uk/you-can-outsource-your-it-but-you-cant-outsource-your-responsibility/ ), that we appear to be becoming too reliant on our IT providers, particularly managed services, to ensure that we remain safe and our services can continue, and we aren’t looking too hard at ensuring resilience is built into our systems. It begs the question, is business continuity planning no longer in fashion.

Alexander Rogan of Abatis also wrote a piece that’s worth reading (https://www.linkedin.com/pulse/billions-lost-chaos-lessons-from-crowdstrike-microsoft-rogan-abxde/}. In his article Alexander emphasises the importance of zero trust architecture and processes. What this essentially means is that we cannot afford to trust anyone other than ourselves. Suppliers are there to help and as such they should ensure that their own processes are robust and include thorough pre-production testing, controlled roll outs and good baseline security measures. Where CrowdStrike falls in this regard, will I’m sure, get thoroughly tested in the not too distant future.

The UK Government is also questioning the resilience of business in the UK to cyber threats (https://amp.theguardian.com/uk-news/article/2024/jul/29/uk-desperately-exposed-to-cyber-threats-and-pandemics-says-minister), and in this case a cyber threat is not necessarily confined to security, it can also mean a crash due to a technical or process failure.

In the cyber security industry, there has long been a running war between those that sell products and those of us concerned more with services. Having been in the industry for 30 years, I have seen this time and again and the product sales nearly always win. Why? Simply because services are a hard sell with a long timeline whereas product sales are easier and quicker to achieve. Why would that be? Again, simple, people like to be able to quickly demonstrate a return on investment. They like to see a product, doing its stuff, even when often, they don’t realise how it’s doing what it’s doing, or if it’s the right product in the right place at the right time.

The risk managed approach is the way to go every time. That has not changed at all in the 30 years I’ve been plugging away at it. It’s all about People, Process and then Technology. I often quote Bruce Schneier, a US scientist on the Harvard Faculty, and a thought leader in this space. He says, ‘If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology’. Breaking this down, what he’s getting at is that first and foremost, you must understand the risks that you face and to do that, you have to identify your cyber assets. By that we don’t mean hardware and even software, what we are talking about is your data and the ability to keep your systems online and accessing what your staff and/or customers need to access, when they need to access it. Once you identify your assets, you then need to identify the threats to those assets and how vulnerable you are too those threats. Threat and vulnerability = risk. And by that we mean the risk to the business if it all goes pear shaped.

Once that’s done, we can then allocate a risk score to each asset with the aim of managing that risk down to an acceptable level, known as the risk appetite. That will change business to business, even asset to asset. You wouldn’t for example allocate the same level of risk [to the business], to a revenue earning system, as you would to perhaps a purely admin system that contains no personal data.

This all sounds terribly difficult and expensive, and that’s why many companies simply don’t do it, or maybe they do a subset of it. But unless you do, then it can be very difficult to know for sure that you are spending your limited budget on the right protections, in the right place. In the long run, it can save you a lot of money. This same assessment applies equally to the CrowdStrike problem, or for that matter, any other company that you have in your supply chain. You need to assess what damage they could do to you if they fail, and what you can do to mitigate that damage. It’s very well and good reaching for the nearest lawyer when it’s all gone to hell, how much better to stop it, or mitigate it, before you get there.

Security Tools