Security Tools Archives - Page 2 of 4 - H2 Cyber Security for SMEs

PROACTIVE CYBER SECURITY

Proactive security, protective monitoring, security operations – all pretty much means the same thing in terms of cyber, at least in the corporate world and the larger, more sensitive Government organisations. I’ve been involved with the design and commissioning of security operations centres for a long time. I designed the first for the FCO, under contract to HP, ran the security team for the Identity and Passport Service which included a security operations centre, amongst others. But the one thing I knew, was that it was too complex and expensive for an SME, even though it would bring them great benefits.

I’ve been talking and posting a lot recently about this subject because I think it’s extremely important and hasn’t, in the past, resonated with SME owners and management simply because it was considered by many to be purely in the province of the corporate world and was way too expensive for an SME to even consider. Well, that cost issue is no longer the case and there is a system, which we use to provide a managed service for SMEs, that is very affordable. So that leaves us to consider whether it is something that an SME would consider as an essential element of their cyber defences, now that it is affordable.

Typically, an SME would generally want such a solution that balances strong security coverage with affordability, simplicity, and minimal disruption to daily operations. Here’s what I think they would like to include if they could afford it.

Comprehensive Threat Visibility

Log collection from key systems (servers, endpoints, cloud services, firewalls, applications).
Real-time monitoring for suspicious activities (e.g., failed logins, privilege escalation, data exfiltration).
Ability to spot both external attacks (phishing, malware) and insider threats.

Actionable Alerts, Not Noise

Intelligent alert prioritisation to avoid alert fatigue.
- Context-rich notifications so the SME knows what happened, why it matters, and what to do next.
- Possibly AI-driven correlation of events to detect patterns.

Ease of Use & Low Overhead

Simple dashboards that non-experts can navigate, or more likely, a managed service as an SME will have little or no resource to give to this.
Minimal in-house expertise required to operate.
Fast onboarding and configuration.
Reporting

Reports that are east to read, management focused and not full of jargon.
Audit trails for investigations.

Incident Response Integration

Clear escalation paths (automated and manual).
Integration with existing tools (ticketing systems, email, Slack/Teams).
Ability to block malicious IPs or disable compromised accounts quickly.

Affordability & Scalability

Pricing that fits SME budgets (no enterprise-only costs).
Scales up with business growth without a full rip-and-replace.
Easy and flexible deployment.
Coverage regardless of where your staff work, in the office, remote or on the move.

Resilience & Reliability

Works even if parts of the infrastructure are down.
Secure storage and backup of monitoring data.
Regular updates to threat detection rules.

In short: An SME doesn’t just want raw data — they want reassurance, clarity, and quick guidance so they can protect their systems without hiring a large security team. And that’s what we are offering, assurance. There’s no such thing as 100% security, so if you’re looking for that, then we can’t help you. Using this system our managed service plays the percentages by monitoring your defences, telling you in no uncertain terms where your defences aren’t up to the job, alerting you to problems and providing advice and guidance on how to fix stuff.

So, what exactly are we offering. Well, it’s a 24/7 service which provides a manned interface between you and us, on the end of the phone or by email in working hours, and an automated response service in silent hours. Doing it that way you don’t have to pay for expensive night shifts. The staff on duty don’t just monitor your systems but provide advice and guidance as well, giving you a cyber security resource on tap.

Specifically, we are covering off:

Email Security – Stay ahead of potential email threats with our user-friendly, API-based active protection.

Endpoint Security – Safeguard laptops and desktops against cyber threats like malware and ransomware.

Cloud Data – Enable cloud data protection for secure collaboration with external users.

Secure Browsing – Keep your browser secure with a provided extension, protecting you from viruses and malicious sites.

Awareness Training – Empower employees to be the first line of defence against the ever-evolving landscape of cyber threats.

Phishing Simulation – Regularly simulate cyber-attacks, including phishing emails, to identify vulnerabilities and educate staff to the dangers of Phishing.

External Risk – Obtain actionable insights on external threats by scanning your digital footprint and exposed vulnerabilities. This includes regular scanning of the dark web looking for compromised email addresses and credentials.

Insurance – Mitigate the cyber risk associated with evolving threats through tailored coverage at the right price (optional; aligning your premiums with your security posture can lower those costs).

Here are some questions to ask yourself and if you answer yes to most of them, then you might be a fit for this service:

Do you employ around 1-250 staff members?
Does falling victim to cybercrime worry you?
Could you continue to operate your business without your IT systems?
Is a recent cyber scan of your public domain on your radar?
Are you aware of the constantly evolving cyber threats and tactics?
Does your business need protection against these advancing cyber threats?
Are you looking for coverage under a cyber insurance policy?

Keep your eye out for a webinar that we will shortly be doing which will provide a full demo of the system, or if you prefer, contact us and we will give you a one-to-one demo, with no obligation. You can follow this with a totally free 14-day trial covering your whole estate, again with no obligation.

If you wanted this system, you might still think it’s too expensive for you, well, it’s only £14 per user per month, so if you only have 10 IT users amongst your staff, that would be £140 per month on a rolling 30-day contract i.e. you can quit with just 30 days’ notice.

A Guide to Cyber Security for SMEs

There’s a continual stream of blogs and posts about cyber security and the sometimes catastrophic effects of getting it wrong, but there is very little that tells SMEs what they should be doing, and it’s generally left to local IT management companies and VARs (Value Added Resellers – i.e. those who sell various products and add value by configuring and managing them). I’m not knocking those companies; they have a very valid business model. But what they aren’t are cyber security professionals and generally their security expertise is focused on the products that they sell. For instance, they will have good skills in installing and configuring security products such as anti-virus and firewalls but there is generally no knowledge of cyber risk management and assessment, thereby ensuring that you have the right defences in the right place, providing the best value for your limited spend, and ignoring the non-technical solutions that are often a better bet than a piece of technology.

SMEs generally have very little budget to allocate to this and that means that what budget they have needs to be effectively targeted at what is important. They need to be aiming for a situation whereby when a potential attacker targets them, they appear to be a more difficult nut to crack than other organisations in their space and their size. Attackers want things to be easy, not difficult, and they will often move on if things get difficult. A criminal is in the game of getting easy money.

Let’s take a look at what cyber security is all about, and more importantly, why you need it? Let’s tackle the first question – what is cyber security? One definition is as follows:

Cybersecurity is the practice of protecting computer systems, networks, software, and data from digital attacks, unauthorised access, damage, or theft. It involves a range of technologies, processes, and practices designed to:

Prevent cyberattacks
Detect breaches or suspicious activity
Respond to security incidents
Recover from damage or loss caused by attacks

The problem is of course that each bullet point there covers a multitude of issues that need to be addressed. The question is understanding what those issues are, how they affect you and what is the priority i.e. what are the most important things that you need to protect, and what comes next, all managed within whatever budget you can allocate to it. It’s not easy and you might feel that you don’t need to do everything but that you need to cover off the most important issues. That means of course that you need to know what those issues are.

The first thing you need to do is to identify your cyber assets. Assets are not confined to hardware and software, far from it. A cybersecurity asset is anything of value that requires protection in a digital context. Identifying and classifying these assets is a foundational step in building a strong cybersecurity posture. Assets will change from company to company, depending upon how you’re organised and what business you are in, but generally:

Hardware Assets

Servers, routers, laptops, mobile devices, firewalls
Why it matters: Physical devices are entry points for attackers and must be secured.

Software Assets

Operating systems, applications, databases etc
Why it matters: Vulnerabilities in software can be exploited to gain unauthorised access.

Data Assets

Customer records, financial data, intellectual property, source code
Why it matters: Data breaches can lead to regulatory fines, reputational damage, and financial loss.

Network Assets

VPNs, switches, IP addresses, subnets
Why it matters: Networks facilitate communication and, if not protected, can be avenues for lateral movement by attackers.

People Assets

Employees, contractors, system administrators
Why it matters: Human error is a leading cause of breaches, so training and access control are crucial.

Cloud and Virtual Assets

Virtual machines, containers, cloud storage (e.g., AWS S3, Azure Blob Storage)
Why it matters: Cloud environments introduce new attack surfaces that must be monitored and managed.

An example could be a customer database, maybe on the cloud or via an app, or even an onsite server. You class this as high value because it contains personally identifiable information (PII) and of course all your interactions with those customers and the value they have to you. Lose that and you might be out of business. You decide to encrypt it and use multi factor authentication and have daily backups, not kept online.

Identifying the assets is the first step in defining what protections you need. You then have to categorise those assets and decide how important they are to the business before you can decide what levels of protection they need.

Having categorised your assets, you then need to assign a risk score to them. Now, this can be done formally via a formal risk assessment, but I accept that many SMEs can’t afford to have that done, and, given the size of the company and the amount/types of information held, it might be relatively easy, when compared to a corporate body, to assign a risk score to each asset.

The next step then is to apply a risk score to the assets in accordance with how you have assessed them, this in turn informs you of the importance of each asset and how you will need to protect them. In other words, you are now targeting your spend to where you know it will be most effective.

We then need to identify the vulnerabilities and the threats and that is where most organisations require help.

Here at H2 we use our considerable experience in doing this for corporate level organisations, and translating that into doable chunks for SMEs, carving up what is needed into priorities and working with clients to decide what those priorities are. We do this keeping in mind the principle of People, Process and then Technology, keeping in mind that many protections, or controls as we term them, are actually not technical but are procedural, based on sound policy and process, and therefore costing very little.

We take a phased approach:

The first phase works with the client to decide where they are now, on a scale which we take from the Carnegie Melon cyber maturity model. Most SMEs come out at around 1 to 2 on the scale and aim to get to 3 to 3.5. The scale goes up to 5 but, as you can see from the phased approach above, this tends to be not necessary for an SME and is often too expensive anyway.

Once we know our starting point, we identify quick wins to tighten up security. As a rule, that will include things like cyber awareness training for staff, ensuring that all access is controlled using MFA of some sort and making sure that Admin rights are strictly controlled. Depending on the company and what it does, it might mean instituting some form of identity management.

As part of the Quick win phase, we also look at policies and processes. Is there a process for allocating and removing rights? Is there a policy and process about on and off boarding staff etc. Other policies we might need to look at include:

Top-level policy issued by the board
Starters and Leavers Policy
Access Control Policy
Magnetic Media Policy
Mobile Working Policy
Password Policy
Email Policy
Acceptable Use Policy
Data Protection

That done we move on to Phase 2 which is where we might recommend encryption both at rest and in transit, for critical data assets. We will discuss back up procedures and processes which will ensure that backups are securely stored and that restoring from backups is practiced and works. We will discuss incident handling procedures and business continuity planning. Finally, we will discuss monitoring and audit, two things that until quite recently tended to be out of the price range of SMEs. However, there are now systems and services on the market which are affordable.

This all seems a bit daunting, but if taken in chunks and phased over perhaps several budgetary periods it is doable, and you really need to consider it.

Do CISOs have a role in the Small to Medium Enterprise?

A Chief Information Security Officer or CISO, is a post you almost never find in an SME, even those at the top end of that sector. This has contributed to the growth of what is known as fractional appointments i.e. appointments that are not full time with the incumbents often taking roles in more than one organisation, thus the term Fractional.

Anyone taking any role in an SME management team will need to be pragmatic, practical and bring cost effectiveness to their discipline. The CISO role is no different and is all about managing risk, enabling the business and ensuring trust in a very cost sensitive environment.

The CISO can play a crucial role in an SME by ensuring that the organisation’s information and data assets are secure. While the CISO role in a large corporation may be more siloed or focused on strategy, in an SME the CISO often wears multiple hats, balancing strategy, operations, and hands-on technical work.

Challenges Unique to SMEs

I’ve often talked about the challenges that SMEs face, focusing as I do on cyber security. Let’s just have a quick recap looking at where the CISO fits in with these unique challenges.

Limited budget and staff: This is the main reason why SMEs will not employ a full time CISO, they simply can’t afford it. The other being that an SME probably doesn’t require a full-time resource anyway. Because of this lack of resource the CISO may also act as a hands-on security engineer or IT lead, perhaps liaising with a contracted IT outsourcer.
Lack of security culture: Many SMEs don’t prioritise security until after a breach. The CISO will be able to raise awareness and provide advice and guidance before the fact.
Rapid growth and change: Scaling securely is a key challenge as SMEs expand and there are often gaps left because of overlooking the need to embed security at the design stage. The CISO can plug that gap.

Let’s take a look at the potential elements of a job description for the role of a CISO, or a Fractional CISO, in an SME. Of course, these may not fit everyone and it’s more of a menu for SMEs to choose from:

Developing and Leading the Cybersecurity Strategy
Define the overall information security roadmap aligned with the SME’s business goals.
Balance security with business agility, in other words making sure security does not get in the way of business and keeping in mind budget constraints typical in SMEs.
Ensure the strategy addresses risk management, compliance, and data protection.

Risk Management and Assessment
Identify and assess cyber risks relevant to the SME (e.g., phishing, ransomware, insider threats).
Conduct regular vulnerability assessments and penetration tests.
Prioritise risks based on business impact and likelihood.

Policy and Compliance Management
Develop and enforce security policies, standards, and procedures.
Ensure compliance with relevant regulations (e.g., GDPR, PCI-DSS etc depending on industry).
Prepare for audits and provide documentation to demonstrate compliance.

Security Awareness and Training
Conduct regular security awareness training for employees.
Create a culture of security by promoting best practices (e.g., strong passwords, phishing awareness).

Incident Response and Business Continuity
Develop and maintain an incident response plan.
Lead the response to security breaches and minimise damage.
Ensure business continuity and disaster recovery plans are in place and tested.

Technology Oversight and Vendor Management
Evaluate and implement cybersecurity tools (e.g., firewalls, endpoint protection etc).
Manage relationships with third-party vendors, especially cloud providers and MSSPs.
Ensure that vendors comply with the SME’s security requirements.
Ensure the SME itself is not in conflict with any security requirements of larger organisations if it is in that organisations supply chain.

Board and Executive Communication
Translate technical risks into business language for senior management.
Report regularly on security posture, incidents, and needs.
Advocate for security budget and resources in line with organisational risk appetite.

I hope that gives a feel as to why an SME might want to consider a Fractional CISO or Board Advisor. Cyber-attacks are becoming more sophisticated, faster and harder to repel. It is no longer just the corporates who are in the firing line. Modern, often AI driven attacks have put everyone in the sights of the modern cyber-criminal and even from those criminal organisations that are nation state funded. It’s never been more crucial to have professional advice and guidance on tap.

DO YOU HAVE A HANDLE ON CYBER SECURITY?

Over the years I’ve had some very interesting conversations with several people from multiple different verticals, many fitting comfortably within the SME bracket, around Cyber Security. The conversations tend to take a very familiar turn. The cry of, ‘I’m covered, my IT support company has put in a firewall and some anti-virus. They tell me all is good’. Slightly depressing but hardly surprising.

So why surprising? A lot of IT Support Companies providing managed services do a very good job of supplying and implementing networks and providing hardware and software. The Cyber Security field is one where resources are scarce and expensive. Cyber Security professionals take a very different view than IT support companies and come at security from the risk managed view and recognise that it is not just about technology and in fact, it’s about people, process and then technology. More about this below.

As we travel around and visit clients or potential clients, it is common to find that they have the view that adequate security is provided by technology. They rely on their IT provider to provide the guidance they need which tends to involve firewalls, anti-malware software and perhaps a backup regime. All well and dandy. I use a quote from Bruce Schneier, Fellow at the Berkman Center for Internet & Society at Harvard Law School, quite a bit, it goes like this:

‘If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology’.

A common misperception is that IT Security is the same as Cyber Security. That surprises a lot of people, so let’s explore it a bit. There is clearly a close symbiotic relationship between the two disciplines. I would argue, and I know this might meet with some disagreement, that IT security refers to traditional IT security methods which are technology based. Such as firewalls, anti-malware, end point protection etc. Whilst Cyber security is based very much on risk management which combines controls which are both non-technical and technical, following the principles of People, Process and Technology. A good cyber security professional will have a good handle on both approaches.

Even though cyber security and data protection have leapt to the top of many people’s agenda in recent years it is still common amongst many SMEs to believe that it is an IT problem, a technical problem rather than a business issue, even when recognising that the risk of a cyber intrusion or a data breach, impacts the business, the bottom line.

Since I first wrote about this, we now have the changing landscape of working practices. Many SMEs have adopted a more flexible approach to work and are utilising a more hybrid working pattern with some working from the office, some from home and other places. This does have financial advantages for an SME but brings with it a lot more security issues which many are either parking or outright ignoring.

The National Cyber Security Centre (NCSC), a department of GCHQ Cheltenham, estimated, before the hybrid working pattern starting to bed in, that if you are an SME then you have around a 1 in 2 chance of experiencing a cyber security breach. For the small business this could result in costs of around £1400, for the medium business, considerably more. One has just been hit for around £30000, which I am sure you will agree, can be extremely damaging to the bottom line of businesses operating under tight margins. And of course, it’s not just financial penalties but the reputational damage should your customers data and assets be affected as well.

Within the SME world there is an almost total reliance on third party IT providers. Is that a good thing, after all that’s in the IT providers area of expertise and responsibility, isn’t it? And here comes the controversial bit. Third party IT providers, particularly in the SME space, are pretty much exclusively value added resellers or VARs, i.e., companies that sell other company’s products. Now I’ve no problem with that per se, but it comes with issues. Notable amongst them is that these companies will have skill sets that are very much limited to the products they sell. Ie they are proficient in the installation and configuration of those products and their clients are offered those products whether they are best in class, or more importantly, whether they are the most appropriate for the task. Before I get a social media pile on, I know that some of the bigger VARs do sell multiple vendors products, but they are in a minority.

Before we go any further, let’s briefly explore some issues that are common amongst SMEs. Some common myths first:

Small to medium size businesses are not worth attacking.
Cyber Security is an IT Issue.
Technology will keep me safe.
My policies and procedures are up to the job.
My staff are young and have been brought up with IT. They know the score.

Now let’s look at some of the more common issues that we see often amongst SMEs:

Lack of awareness around the current real-world cybersecurity risks
False sense of security, with a heavy reliance and dependence on an external IT third-party provider
Lack of cybersecurity knowledge and understanding
Poor cybersecurity maturity and posture within their businesses
Lack of staff training (at all levels) – just like Health & Safety, cybersecurity is everyone’s responsibility.

Here at H2 we offer a cyber maturity assessment that is designed specifically for SMEs. It is a comprehensive evaluation of an organisation’s cybersecurity capabilities and readiness to effectively mitigate and respond to cyber threats. It involves a detailed analysis of the organisation’s cybersecurity policies, procedures, technologies, and practices. The assessment aims to identify potential vulnerabilities, weaknesses, and areas for improvement in the organisation’s cybersecurity posture.

During the assessment, cybersecurity experts typically examine various aspects, such as:

Governance and Management: Reviewing the organisation’s cybersecurity policies, risk management frameworks, and leadership’s commitment to cybersecurity.

Security Awareness and Training: Evaluating the level of cybersecurity awareness among employees and the effectiveness of training programs.

Technical Controls: Assessing the implementation and effectiveness of security technologies, such as firewalls, intrusion detection systems, antivirus software, and encryption mechanisms.

Incident Response and Recovery: Analysing the organisation’s incident response plan, including procedures for detecting, reporting, and responding to cyber incidents.

Security Risk Management: Evaluating how the organisation identifies, assesses, and manages cybersecurity risks.

Third-Party Risk Management: Assessing the organisation’s approach to managing cybersecurity risks associated with third-party vendors and partners.

Compliance and Regulations: Verifying the organization’s compliance with relevant cybersecurity regulations and industry standards.

The results of the Cyber Maturity Assessment provide valuable insights to the organisation, enabling them to enhance their cybersecurity defences and establish a more robust and resilient security posture. It helps organisations prioritise their investments in cybersecurity, address vulnerabilities, and strengthen their overall cyber resilience and provides a road map to reach a standard agreed with the management, taking full account of that managements risk appetite.

WHAT DO SMES REALLY NEED TO KNOW ABOUT CYBER SECURITY

Maybe I should have titled this ‘What do SMEs WANT to know’ rather than need to know. That’s because all too often they want a very cut down version of what they need, because simply put, they don’t have the budget or expertise to get into too much detail and will often look for the easy way out. That’s becoming more and more of a problem given the concerted effort by cyber criminals to attack all sizes and types of business, here in the UK. I posted a bit about this earlier, you can read it here. Do SMEs really need a cyber strategy and if so, what exactly does that entail.

What is a Cyber Security Strategy?

A cyber security strategy is a plan that outlines an organisation’s approach to protecting its information systems and data from cyber threats. This strategy typically includes measures such as implementing security controls, conducting regular risk assessments, training employees on security best practices, monitoring network activity for suspicious behaviour, and responding to security incidents in a timely manner. The goal of a cyber security strategy is to minimise the risk of cyber-attacks and protect the confidentiality, integrity, and availability of an organisation’s sensitive information.

Do I really need that – I’m an SME and not really a target, am I?

Well yes, you are a target and there are a ton of statistics available which shows that SMEs globally are a very real target for cyber-attacks and can in fact, be very profitable for cyber criminals. There are a lot of reasons for that but one of the top reasons is that typically, SMEs spend very little on cyber defence and generally have very weak defences. Add to this that they don’t tend to carry out cyber awareness training for their staff, have limited resources and generally don’t have a good grasp of the issues.

Not their fault. Most are focused on their core business, trying make a quid or two and are pressed for time. They tend to rely on whatever company, usually local, that supplied their network, hardware and software, generally on a retainer. The problem is that those companies don’t really have a good grasp of the issues either, concentrating on technology, and then, not necessarily the right technology.

The real trick here is in devising a strategy that works whilst staying within budget and having the resources to make it work. Not an easy path to tread but one that is very definitely a must.

Secure by default and design

Now that’s an interesting title, but what does it mean? Secure by default and design means that a system or product is inherently built with security measures in place from the start. This ensures that security is a priority throughout the development process and that users can trust that their data and information will be protected. It also means that security features are enabled by default, reducing the risk of vulnerabilities or breaches. This approach helps to create a more robust and resilient system that is better equipped to withstand potential threats.

It applies as much to your network and systems as it does to software development and possibly more importantly to you, it is a legal requirement under the Data Protection Act 2018, or as it is becoming known, UK GDPR.

The first problem many people come up against is that they already have a network, probably connected to the cloud of some sort, very possibly for SMEs, MS365, but when the design was done, there wasn’t a full risk assessment undertaken which is a requirement to underpin that design. In other words what we in the cyber security industry refer to as Security Architecture Design (SAD), wasn’t a prominent consideration.

Not unusual and the common technologies were probably set up, firewalls and anti-virus, but not much else. And that is where a well thought out strategy comes into play.

What should I be considering in my Cyber Security Strategy

We’ve already said you are an SME, so do you need the sort of comprehensive cyber security strategy that we would see in a major corporate? No, but it should still cover off the major points and should continue to be reviewed alongside things like your Health and Safety policy and other industry standards that are required to be reviewed for you to stay in business, usually annually. I know, it’s a pain and you’ve got enough to do without increased paperwork. But this isn’t red tape, this is designed to keep your business protected and can save you a lot of money, time and trouble.

You need to be thinking about the key components needed to effectively protect an organisation’s digital assets and data. These components may include:

Risk assessment: Assessing potential cybersecurity risks and vulnerabilities to identify areas of weakness and prioritise areas for improvement.

Security policies and procedures: Establishing clear and enforceable policies and procedures for data protection, access control, incident response, and other security-related activities.

Employee training: Providing ongoing training and education to employees on cyber security best practices, such as password management, phishing awareness, and safe browsing habits.

Security tools and technologies: Implementing robust security tools and technologies, such as firewalls, intrusion detection systems, encryption software, security monitoring tools and data protection tools, and endpoint protection solutions.

Incident response plan: Developing a detailed incident response plan that outlines the steps to be taken in the event of a security breach or cyber-attack, including communication protocols, containment measures, and recovery strategies.

Regular audits and testing: Conducting regular security audits and penetration testing to assess the effectiveness of existing security measures and identify any vulnerabilities that need to be addressed.

Collaboration with external partners: Establishing a partnership with cyber security company that understands the issues that affect SMEs and who themselves can establish a solid working relationship with the IT provider that is providing and administering your network and IT resources, will enhance your protections, significantly improve your employee and managerial awareness of the issues, and provide you with the peace of mind you need, allowing you to concentrate on your core business.

So, to wind this up, everyone needs a strategy that is tailored to them and covers off their needs. In order to make sure that your cyber, or if you prefer, your information assets, are secured, you need to understand what they are and how vulnerable they are to attack. Only then can you start to put in place protections that are appropriate to you, and affordable, making sure that your budget is spent wisely. Don’t be put off by all the stuff above, some of it, or perhaps much of it, won’t apply to you, but some of it definitely will. Don’t be afraid to take advice from those who know what they are talking about.

Cyber Attacks on SMEs

We’ve posted a few pieces recently on why setting a realistic budget for cyber security is so important and we thought we’d follow that up with some real-life examples.

Small and medium-sized enterprises (SMEs) are increasingly being targeted by cybercriminals in 2025 and are facing a range of sophisticated threats that exploit limited resources and evolving technologies. Here’s a quick look at some of the most pressing cybersecurity incidents and trends that have affected SMEs so far this year:

Major Cybersecurity Incidents Impacting SMEs

Co-op Supermarket Chain Cyberattack (UK)

A “highly sophisticated” cyberattack disrupted Co-op’s IT systems, leading to customer data theft, contactless payment failures, and empty shelves in Scottish stores. The breach also affected other major retailers like Marks & Spencer and Harrods, with investigations pointing towards hacker groups such as Scattered Spider and Lapsus$.

Lockbit Ransomware Group Breach

The notorious ransomware gang Lockbit was itself hacked, resulting in leaked communications that revealed aggressive targeting of small businesses for extortion. This breach has temporarily disrupted Lockbits operations and exposed their tactics.

Berkeley Research Group (BRG) Data Breach

A cyberattack on BRG compromised sensitive data related to Catholic Church sex-abuse cases. The attacker used impersonation tactics via Microsoft Teams to deploy Chaos ransomware, leading to concerns over the exposure of victims’ identities.

Emerging Cyber Threat Trends for SMEs

AI-Powered Phishing and Deepfake Attacks

Cybercriminals are leveraging AI to craft convincing phishing emails and deepfake audio impersonations of executives, deceiving employees into authorising fraudulent transactions.

Ransomware-as-a-Service (RaaS)

The availability of RaaS platforms has lowered the barrier for launching ransomware attacks, making SMEs prime targets due to their valuable data and often limited security infrastructure.

Supply Chain Vulnerabilities

Attackers exploit weaknesses in third-party vendors to infiltrate SMEs’ systems, as seen in incidents involving compromised software packages on platforms like NPM.

Business Email Compromise (BEC)

Scammers use AI to mimic emails from corporate partners and managers, leading to fraudulent financial transactions. In Australia, BEC attacks have increased by 7% year-on-year, with SMEs being particularly vulnerable.

Proactive Measures for SMEs

To mitigate these threats, SMEs should consider the following actions:

Implement Multi-Factor Authentication (MFA)

Enhance account security by requiring multiple verification methods.

Regular Employee Training

Your staff are your first line of defence and need to be educated on recognising phishing attempts and social engineering tactics.

Secure Supply Chains

Vet third-party vendors for cybersecurity compliance and monitor for unusual activities. Are you in a supply chain for a major company? Are you facilitating a back door into their systems?

Invest in AI powered security tools

Utilise advanced solutions capable of detecting and responding to sophisticated threats. H2 has a couple of suggestion here that are affordable to SMEs.

Protective Monitoring

How do you know that your expensive solutions are protecting you? Do you know if you’ve suffered a stealth attack where the attacker has built a back door into your systems? Do you know if you’re hard-earned cash is being siphoned off? How vulnerable are you to an attack? A monitoring solution for SMEs is now available at an affordable price.

Data Loss Prevention

Are you sure you know exactly where all your data is? Are you sure that documents attached to emails aren’t still sitting on your email server? Do you know if other documents have been downloaded from your cloud storage whilst your staff work from home, and then uploaded but a copy is still sitting on their laptop? Data proliferation over time is almost a given. Can you encrypt your sensitive data so that even if it’s stolen, it’s useless to the thief? An affordable solution now exists.

Develop an Incident response and business continuity plan

No matter how well you protect yourself, you still need to prepare for potential breaches with a clear strategy to minimise impact and recover operations swiftly.

HONEYPOTS

I seriously doubt if any of my clients would find a honeypot of any use, if only because they take a lot of time, effort and expense, but I thought I’d do a piece on them because they do exist and might be of interest, if only to understand what’s out there.

What is a Honeypot, in terms of cyber security that is? Well, we’re not talking about a seductive member of the opposite sex, using their wiles to wheedle info out of you. In this instance honeypots are cybersecurity tools designed to look like an attractive target, that act as decoys to attract and study cyberattacks. They mimic real systems or resources, but are isolated and monitored, allowing security teams to observe and analyse attacker behaviour without risking real data or systems. This information helps organisations improve their defences against malicious activity. They can also be used to attract an attacker to the honeypot and away from your actual crown jewels. Although this latter has fallen out of favour in recent years.

How Do They Work?

The honeypot is configured with vulnerabilities that are designed to lure attackers, leading them to believe they have successfully accessed a real system. Meanwhile the security team monitors the honeypots activity to track the attackers’ movements, tools, and techniques. Once the information is gathered it is used to understand attacker motivations, vulnerabilities in the organisation’s systems, and emerging threats. The knowledge gained helps organisations strengthen their defences, identify potential blind spots, and improve their overall cybersecurity strategy.

Types of Honeypots

Low-interaction honeypots – These are simple, basic decoys that provide limited interaction with attackers, allowing them to study the attacker’s initial steps.
High-interaction honeypots – These are more complex, providing a more realistic experience for attackers, allowing for detailed analysis of their behaviour and techniques.
Research honeypots – These are used specifically for studying and analysing attacker behaviour, often in a sandbox environment.
Production honeypots – These are deployed in live networks to monitor and deflect real-world attacks.

A simple low interaction Honeypot

Benefits

I started this piece by saying I doubt if any of my clients would set up a honeypot. They are expensive and resource heavy, but there are benefits:

Deflecting attacks – Honeypots can divert attackers away from valuable production systems, protecting critical assets.
Threat intelligence – They provide valuable information about attacker tactics, techniques, and procedures, helping organisations prepare for future threats.
Vulnerability assessment – By observing attacker behaviour, organisations can identify potential weaknesses in their security infrastructure.
Improved security posture – The knowledge gained from honeypots helps organisations strengthen their security defences and improve their overall security posture.

Who is likely to use a Honeypot?

Primarily honeypots are used by cybersecurity researchers and government agencies to monitor the latest threats and cybercriminal activities and methods, to improve defences. This is especially true of companies that produce threat intelligence for their customers, and threat reports.

However, they might also be used by businesses to identify and analyse attacks targeting their production networks, helping them understand attack methods and improve their security posture. They can be used to distract attackers from critical assets and provide an early warning system for potential attacks.

What is a Honeynet?

Research organisations might also utilise a honeynet. A honeynet is a decoy network that contains one or more honeypots. It looks like a real network and contains multiple systems but is hosted on one or only a few servers, each representing one environment. For example, a Windows honeypot machine, a Mac honeypot machine and a Linux honeypot machine.

I hope you have found this brief introduction to honeypots interesting, if not particularly pertinent to you. We do like to educate and spread the word in regard to cyber security.

Cyber Security is a Business Issue

I know that I tend to include the statement in the title, in many articles and posts that I produce, but I haven’t really expanded on it and explained in more detail why I say that this is a business issue and one that owners and boards need to fully embrace if they are to stay safe.

We still see many ‘tick in the box’ exercises happening when we talk to SMEs, particularly when they have encountered an issue and tell us that they have taken precautions which, when examined, aren’t doing what the company thought, or perhaps hoped, they were doing. Compliance and auditable solutions need to underpin what precautions you are taking. If you can’t check and make sure that everything is up to scratch, and do it easily and often, then you have wasted your money.

Far too much money is spent on one size fits all solutions and those that are reactive to one off threats, which produces a firefighter mentality that is at odds with the holistic preventive protection that is required to combat the current and emerging threat landscape.

This is not just a technical issue

A great quote which I use a lot comes from Bruce Schneier, an American scientist and

information security thought leader. He says:

If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology.

And there’s a lot of truth in that statement, particularly when it comes to SMEs, simply because they don’t understand the technology, and leave it to the IT management company that looks after their network, who mainly focus on technology, because that’s their comfort zone and selling licenses is a big part of their business. And neither the SME nor the IT Management company have a handle on the emerging threat landscape.

Another good quote comes from the Chair of the Australian Securities and Investments Commission. He says, ‘If boards do not give cybersecurity and cyber resilience sufficient priority, this creates a foreseeable risk of harm to the company and thereby exposes the directors to potential enforcement action by [insert here your regions governance requirements] based on the directors not acting with reasonable care and diligence.’

Cyber security needs to be flexible and adaptable to the changing threats as they occur, because once they have become prevalent, it’s often too late to play catchup. This means a holistic strategy that encompasses technology but also process, personnel, compliance and audit. Don’t be complacent. If you stand still, you will as they say, come a cropper.

Keep saying – PEOPLE, PROCESS and TECHNOLOGY – in that order.

Is there a Misleading Message Coming from the Technology Industry?

Perhaps, because there is a considerable amount of what we call FUD, fear, uncertainty and doubt, doing the rounds constantly. It concentrates people on thinking about specifics, instead of looking at the bigger picture. Whilst there is no doubt that phishing, ransomware, and other scams have certainly concentrated the mind somewhat, and these attacks are most definitely not confined to the large enterprise businesses, but have been attacking, with a lot of success, the small to medium business market, this causes vendors to try and exploit the issues around that and push their technology solutions and of course, SMEs rarely, if ever, have the expertise to judge whether or not a particular product will actually give them the protection they need. We now must add into the mix AI and its capacity for increasing cyber-attacks at all levels, making the production of malicious code so much easier and making it available to those perhaps less skilled than heretofore.

Another problem is that the advertising tends to give the impression that Cyber security is something new when in fact it’s just an evolution of the physical security issues that existed when information was all on paper. Think of it like that and you’ll realise that it’s been around for a very long time and that what you are trying to protect is information of all kinds. It’s information that makes your business work efficiently. The very word Cyber brings with it the illusion that it’s something modern and/or futuristic, when in fact that word is essentially meaningless and the old description of Information Security or Infosec, is far more accurate and descriptive. Cyber is a blatant attempt to push the technological aspect of information security.

Risk Management

I’m going to slip in a link to a short video on risk management as it pertains to Cyber (yes, I’m using that word because it’s sadly become de facto). This video describes the process at a high level.

https://bit.ly/3FdZ6x0

Technology can be an essential part of your protection, but it must be targeted in the right way, which not only means you have the right piece of kit doing the right thing, but that you are targeting your IT spend to support your business goals and give a maximum return on investment (ROI). It should also be married to good policies and processes that are enforceable and auditable and fully understood by your work force. To do this you have to understand exactly what your risks, vulnerabilities and threats are to ensure that your solution to those risks, vulnerabilities, and threats, is targeted for maximum effect and ROI and that the technology is supporting the policies and processes, all of which is underpinned with good security awareness training.

It’s also necessary to have some way of measuring the effectiveness of your solutions through a monitoring or auditing solution. Such solutions for SMEs have long been considered too expensive to even consider but that is no longer the case and affordable solutions are now on the market.

We must all grasp that these risks are owned by the board, and if you don’t have a formal board, then the management team. This needs to be understood fully by those at the top. They team need to understand what level of risk is acceptable and agree what risks they are prepared to tolerate to achieve the business aims. They need to ensure that supporting policies are produced, implemented, understood by employees, and regularly reviewed and updated. At H2 we tend to produce an information security and data protection handbook which can run into many pages. Producing these policies is not as easy as it sounds.

You may also wish to look at some recognised standards by which you can regulate your risk management. One such is the international standard for information security, ISO 27000 series but perhaps the most appropriate for SMEs is the Cyber Essentials Scheme which will help you demonstrate an appropriate level of information security and risk management within your company.

Once you have a risk management framework in place, owned from the top, then you can identify your information assets and assess the risk to your business should those assets be compromised in some way. Then and only then can you adequately assess what processes and technologies you need to mitigate the risks identified for each asset thus targeting your spend for maximum effectiveness.

Sadly, that’s not the end. User education is probably the most important element of all for SMEs. Ensuring that your staff are aware of the policies and why they exist. Protect yourself against scams which sadly, form the biggest danger to SMEs rather than hacks. Scams can be very low tech or high tech using malware, but however they come in, your staff need to be aware of them.

DATA BREACHES

Data breaches continue to make headlines, with corporate incidents grabbing the most attention. A prime example is the Equifax breach, where a server exploit compromised credit reports of over 140 million individuals. The breach took months to discover and resolve, ultimately resulting in Equifax settling with the FTC for a $575 million fine.

Not so long ago the Electoral Commission revealed it fell victim to a “complex cyber-attack,” potentially impacting millions of voters. Unspecified “hostile actors” accessed electoral registers from August 2021 and infiltrated emails and control systems. Alarmingly, this attack went undetected until the following October, leaving sensitive data exposed to cyber criminals for over a year. It’s astonishing that adequate protections were not in place to ensure timely detection and management of the breach.

According to the UK’s NCSC, half of businesses and about a third of charities have reported experiencing some form of cyber security breach or attack. This figure rises to approximately 70% for medium-sized businesses and 74% for large enterprises. Phishing remains a favoured attack method due to its relative simplicity, with AI now generating new variations of old scams.

Most data breaches occur unintentionally, often due to employees making mistakes because they lack awareness of proper procedures. Who bears responsibility? Is it the employee or the employer for not providing sufficient cyber awareness training? That’s open to interpretation.

Here are some notable examples from the Information Commissioner’s Office (ICO):

• A data controller inadvertently sent paperwork to a child’s birth parents without redacting the adoptive parents’ names and addresses. Upon discovering the breach, the data controller failed to inform the adoptive parents.

• A debt insolvency agent mistakenly emailed a vulnerable new client’s file to a colleague in another department. The colleague quickly deleted the email and alerted the sender about the mistake.

• An employee misplaced his briefcase containing work on an unencrypted laptop and unredacted paper files related to a sensitive court case, which included information on criminal convictions and health details. Initially, he believed both the laptop was encrypted and that the paper files were redacted. After informing his manager, who reported it to IT, the laptop was remotely wiped without initially notifying the ICO. The data controller later reported it after realising the laptop was unencrypted.

• A courier mistakenly delivered medication intended for one patient (Patient A) to another (Patient B). After Patient A complained, the pharmacist recognised the error and arranged for the unopened medication to be picked up and delivered correctly.

• A law firm employee fell victim to a phishing attack after clicking on a link in an email that led them to enter login credentials on what they thought was a legitimate site. The IT department later discovered that their email account had been compromised, leading to significant unauthorised payments being made by clients due to spoofed communications.

These cases are just a small sampling.

Now let’s discuss ransomware. There’s a common misconception among SME management that ransomware primarily targets larger companies since SMEs seem too small to be lucrative targets for cybercriminals. However, when SMEs do get attacked, ransom demands can be surprisingly low—often between £500 and £1,000—leading many SMEs to pay up without hesitation. This poses significant risks because often their data has already been stolen, and sometimes criminals fail to restore access afterward, leaving SMEs financially strained and unable to operate.

Preventing such attacks in the first place is far more advantageous. Here are several strategies you might consider implementing:

• One of the most impactful steps an SME can take is providing Cyber Awareness Training for employees. Research shows that 90% of data breaches stem from human error; it’s unlikely an employee will intentionally harm your business. However, without proper training, they may unknowingly engage in risky behaviour. Cyber security awareness training is crucial; staff need knowledge about potential threats. Cyber security is not just an IT issue; it’s a business-wide responsibility that requires everyone’s involvement. Effective strategies tend to follow the KISS principle—Keep It Simple Stupid.

• Another cost-effective measure is developing robust policies and procedures related to cyber security that are communicated throughout your organisation and regularly updated to remain relevant. Providing employees with clear guidelines on how to respond if they suspect suspicious activity supports them rather than penalising them for mistakes. Many SMEs lack adequate policies or settle for generic templates found online that seldom meet their needs.

• Review your backup strategy as well. Even if using cloud-based services, your data may not be adequately secured, despite providers’ claims. A better approach would be implementing a backup strategy where your data is backed up nightly onto magnetic media storage that’s stored securely offline. In case of an attack that locks your data, you could wipe affected workstations and restore information from backups without significant downtime.

• EMail remains one of the most common attack vectors. Numerous products claim to block malicious emails effectively; many excel at this task. For SMEs, cost is often a deciding factor when selecting these products. Unfortunately, some still opt for low-cost or free anti-malware solutions. Understanding that quality correlates with price is essential; if it’s free, you’re likely facing issues down the line.

Turning to how your systems might be monitored for security issues, we have been exploring options in the market for an affordable security managed service tailored specifically for SMEs and we believe we have found it! Our solution emphasises simplicity while utilising enterprise-grade technology to streamline daily operations effectively. Our unified platform seamlessly detects, prevents, and responds holistically to cyber threats without hassle or excessive costs.

We are offering a free trial that includes:

a. Email security.

b. Cloud data protection.

c. Automated cyber awareness training.

d. External risk assessment.

e. Endpoint security.

f. Secure browsing practices.

g. Phishing simulations.

h. Plus, as an added bonus: cyber insurance priced based on your risk score within our system—the lower your risk score, the more affordable your insurance!

This service is specifically designed for businesses with 1-250 IT users; while most SMEs typically fall between 10-15 users, we’re flexible! It’s a managed service approach with proactive risk mitigation tailored according to your preferences—all at just £12 per user per month!

We’re also introducing an intuitive cloud software solution focused on data protection that empowers organisations by securing their information while giving IT professionals an easy way to track sensitive data and manage risks effectively. The system routinely audits company data to locate sensitive information and applies necessary updates and encryption automatically.

This method ensures organisations always know what sensitive data they possess while keeping it secure through automatic encryption measures, making data security straightforward so businesses can protect private information as circumstances evolve over time, without needing complex software requiring specialised expertise.

Here are 2 very short videos explaining our solutions.

Why Your Business Needs Protective Monitoring – https://bit.ly/3Qy4u0x

Mastering GDPR Compliance: Safeguarding Your Company – https://bit.ly/4berDPa

Cyber Security Operations

Security operations is a complex subject and there is no doubt that it can be expensive and difficult, even for corporate organisations who generally have the resource, both financial and technical, to run a security operations centre (SOC), or at least can afford to outsource. I saw an RFP from a housing society for a SOC and I would be very interested to see if that contract gets let once the organisation gets the quotes, because I would be shocked if they could afford it.

Their RFP based its premise on the introduction of a Security Information and Event Management system (SIEM), which.in itself, might suggest that they don’t really know what they are asking for, or indeed, what they want. I base this on having designed, built and operated several such operations centres in the past.

Now before the SIEM vendors and resellers pile on, let’s be clear, SIEM systems have their place and are very useful in a SOC, although I would argue that they are most certainly not the end all and be all. My focus these days is on SMEs and for an SME there are several reasons why a SOC and an SIEM may be over the top and a cost too far.

Whilst an SIEM system is a valuable tool for cybersecurity, it comes with several drawbacks, including:

a. High Cost

Expensive Implementation – SIEM systems require significant upfront costs for software, hardware, and licensing.
Ongoing Costs – Maintenance, updates, and skilled personnel add to long-term expenses.

b. Complex Deployment and Management

Difficult Configuration – Setting up a SIEM system to work effectively requires extensive tuning and integration with various security tools.
Frequent Fine-Tuning – To avoid false positives and negatives, organisations must continuously refine alert rules and correlation policies.

c. High Volume of Alerts and False Positives

Alert Fatigue – SIEM systems generate numerous alerts, many of which are false positives, overwhelming security teams.
Difficult Prioritisation – It can be challenging to distinguish between critical threats and routine events without proper tuning.

d. Scalability Issues

Performance Bottlenecks – As an organisation grows, more logs and data sources can slow down the system.
Expensive Scaling – Scaling a SIEM to handle increasing data volumes often requires costly upgrades.

e. Need for Skilled Personnel

Expertise Required – SIEM systems need cybersecurity professionals to manage, analyse, and fine-tune them effectively.
Shortage of Talent – Finding skilled SIEM analysts can be challenging and expensive.

f. Storage and Compliance Challenges

Log Retention Costs – Storing large volumes of logs for compliance can be expensive.
Regulatory Complexity – Ensuring compliance with data protection laws (e.g., GDPR) requires careful log management.

h. Limited Threat Detection Without AI/Automation

Reactive Approach – Many traditional SIEMs rely on pre-set rules, making them less effective against new or sophisticated threats.
Lack of Automation – Without AI-driven analytics, manual investigation can be time-consuming.

Having debunked the usefulness of an SIEM system for an SME, let’s look at what an SME could do to mitigate their cyber risks.

A good cyber security strategy has always been founded upon strength in depth. Sound security architecture, good cyber awareness training, solid access control and identity management, and the ability to protectively monitor your estate for threats, vulnerabilities, and risks.

If you are not monitoring the effectiveness of the protections that you have spent good money on, how do you know it’s money well spent? Are those protections doing what you think they are? Monitoring is central to the identification and detection of threats to your IT systems. It acts as your eyes and ears when detecting and recovering from security incidents and it enables you to ensure that devices are used in accordance with your organisational policies.

Many small to medium-sized businesses struggle with stretched resources, lean budgets, and a critical technical expertise gap. This fight against sophisticated cyber threats and outdated systems turns them into easy targets for cybercriminals. Exposed and at risk, these businesses stagger on the edge of significant disruption, financial loss, and reputational damage. Although on the surface an SIEM system might seem to be what an SME needs, it would not fit the profile of most SMEs, being too resource intensive and costly.

We have been researching the market, looking for a way of providing a security managed service that would serve an SME, at an affordable price. And we think we’ve found it – no, we are SURE we have found it. Simplicity is at its core, employing enterprise-grade technology to simplify and streamline the day-to-day work. Our unified platform and onboarding process, seamlessly detects, prevents, and responds to cyber threats in the most holistic, hassle-free, and cost-effective way.

We are offering a 14 day free trial and will cover:

Email security.
Cloud data.
Automated cyber awareness training.
External risk.
Endpoint security.
Secure browsing.
Phishing simulation.
And as an added bonus we can provide cyber insurance at a price which is directly linked to your risk score within or system. The lower your risk, the cheaper the insurance.

This system is deliberately aimed at 1-250 IT users in any business. Most SMEs come in around 10 to 15 IT users, but we’re not precious about it. It is a managed service, and we have our eyes on the glass and can mitigate your risks automatically, or in concert with you, depending on how you wish to tailor the service. All this for a mere £12 per user per month.

Security Tools