Security Tools Archives - Page 3 of 4 - H2 Cyber Security for SMEs

Cyber Security is a Business Issue

I know that I tend to include the statement in the title, in many articles and posts that I produce, but I haven’t really expanded on it and explained in more detail why I say that this is a business issue and one that owners and boards need to fully embrace if they are to stay safe.

We still see many ‘tick in the box’ exercises happening when we talk to SMEs, particularly when they have encountered an issue and tell us that they have taken precautions which, when examined, aren’t doing what the company thought, or perhaps hoped, they were doing. Compliance and auditable solutions need to underpin what precautions you are taking. If you can’t check and make sure that everything is up to scratch, and do it easily and often, then you have wasted your money.

Far too much money is spent on one size fits all solutions and those that are reactive to one off threats, which produces a firefighter mentality that is at odds with the holistic preventive protection that is required to combat the current and emerging threat landscape.

This is not just a technical issue

A great quote which I use a lot comes from Bruce Schneier, an American scientist and

information security thought leader. He says:

If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology.

And there’s a lot of truth in that statement, particularly when it comes to SMEs, simply because they don’t understand the technology, and leave it to the IT management company that looks after their network, who mainly focus on technology, because that’s their comfort zone and selling licenses is a big part of their business. And neither the SME nor the IT Management company have a handle on the emerging threat landscape.

Another good quote comes from the Chair of the Australian Securities and Investments Commission. He says, ‘If boards do not give cybersecurity and cyber resilience sufficient priority, this creates a foreseeable risk of harm to the company and thereby exposes the directors to potential enforcement action by [insert here your regions governance requirements] based on the directors not acting with reasonable care and diligence.’

Cyber security needs to be flexible and adaptable to the changing threats as they occur, because once they have become prevalent, it’s often too late to play catchup. This means a holistic strategy that encompasses technology but also process, personnel, compliance and audit. Don’t be complacent. If you stand still, you will as they say, come a cropper.

Keep saying – PEOPLE, PROCESS and TECHNOLOGY – in that order.

Is there a Misleading Message Coming from the Technology Industry?

Perhaps, because there is a considerable amount of what we call FUD, fear, uncertainty and doubt, doing the rounds constantly. It concentrates people on thinking about specifics, instead of looking at the bigger picture. Whilst there is no doubt that phishing, ransomware, and other scams have certainly concentrated the mind somewhat, and these attacks are most definitely not confined to the large enterprise businesses, but have been attacking, with a lot of success, the small to medium business market, this causes vendors to try and exploit the issues around that and push their technology solutions and of course, SMEs rarely, if ever, have the expertise to judge whether or not a particular product will actually give them the protection they need. We now must add into the mix AI and its capacity for increasing cyber-attacks at all levels, making the production of malicious code so much easier and making it available to those perhaps less skilled than heretofore.

Another problem is that the advertising tends to give the impression that Cyber security is something new when in fact it’s just an evolution of the physical security issues that existed when information was all on paper. Think of it like that and you’ll realise that it’s been around for a very long time and that what you are trying to protect is information of all kinds. It’s information that makes your business work efficiently. The very word Cyber brings with it the illusion that it’s something modern and/or futuristic, when in fact that word is essentially meaningless and the old description of Information Security or Infosec, is far more accurate and descriptive. Cyber is a blatant attempt to push the technological aspect of information security.

Risk Management

I’m going to slip in a link to a short video on risk management as it pertains to Cyber (yes, I’m using that word because it’s sadly become de facto). This video describes the process at a high level.

https://bit.ly/3FdZ6x0

Technology can be an essential part of your protection, but it must be targeted in the right way, which not only means you have the right piece of kit doing the right thing, but that you are targeting your IT spend to support your business goals and give a maximum return on investment (ROI). It should also be married to good policies and processes that are enforceable and auditable and fully understood by your work force. To do this you have to understand exactly what your risks, vulnerabilities and threats are to ensure that your solution to those risks, vulnerabilities, and threats, is targeted for maximum effect and ROI and that the technology is supporting the policies and processes, all of which is underpinned with good security awareness training.

It’s also necessary to have some way of measuring the effectiveness of your solutions through a monitoring or auditing solution. Such solutions for SMEs have long been considered too expensive to even consider but that is no longer the case and affordable solutions are now on the market.

We must all grasp that these risks are owned by the board, and if you don’t have a formal board, then the management team. This needs to be understood fully by those at the top. They team need to understand what level of risk is acceptable and agree what risks they are prepared to tolerate to achieve the business aims. They need to ensure that supporting policies are produced, implemented, understood by employees, and regularly reviewed and updated. At H2 we tend to produce an information security and data protection handbook which can run into many pages. Producing these policies is not as easy as it sounds.

You may also wish to look at some recognised standards by which you can regulate your risk management. One such is the international standard for information security, ISO 27000 series but perhaps the most appropriate for SMEs is the Cyber Essentials Scheme which will help you demonstrate an appropriate level of information security and risk management within your company.

Once you have a risk management framework in place, owned from the top, then you can identify your information assets and assess the risk to your business should those assets be compromised in some way. Then and only then can you adequately assess what processes and technologies you need to mitigate the risks identified for each asset thus targeting your spend for maximum effectiveness.

Sadly, that’s not the end. User education is probably the most important element of all for SMEs. Ensuring that your staff are aware of the policies and why they exist. Protect yourself against scams which sadly, form the biggest danger to SMEs rather than hacks. Scams can be very low tech or high tech using malware, but however they come in, your staff need to be aware of them.

DATA BREACHES

Data breaches continue to make headlines, with corporate incidents grabbing the most attention. A prime example is the Equifax breach, where a server exploit compromised credit reports of over 140 million individuals. The breach took months to discover and resolve, ultimately resulting in Equifax settling with the FTC for a $575 million fine.

Not so long ago the Electoral Commission revealed it fell victim to a “complex cyber-attack,” potentially impacting millions of voters. Unspecified “hostile actors” accessed electoral registers from August 2021 and infiltrated emails and control systems. Alarmingly, this attack went undetected until the following October, leaving sensitive data exposed to cyber criminals for over a year. It’s astonishing that adequate protections were not in place to ensure timely detection and management of the breach.

According to the UK’s NCSC, half of businesses and about a third of charities have reported experiencing some form of cyber security breach or attack. This figure rises to approximately 70% for medium-sized businesses and 74% for large enterprises. Phishing remains a favoured attack method due to its relative simplicity, with AI now generating new variations of old scams.

Most data breaches occur unintentionally, often due to employees making mistakes because they lack awareness of proper procedures. Who bears responsibility? Is it the employee or the employer for not providing sufficient cyber awareness training? That’s open to interpretation.

Here are some notable examples from the Information Commissioner’s Office (ICO):

• A data controller inadvertently sent paperwork to a child’s birth parents without redacting the adoptive parents’ names and addresses. Upon discovering the breach, the data controller failed to inform the adoptive parents.

• A debt insolvency agent mistakenly emailed a vulnerable new client’s file to a colleague in another department. The colleague quickly deleted the email and alerted the sender about the mistake.

• An employee misplaced his briefcase containing work on an unencrypted laptop and unredacted paper files related to a sensitive court case, which included information on criminal convictions and health details. Initially, he believed both the laptop was encrypted and that the paper files were redacted. After informing his manager, who reported it to IT, the laptop was remotely wiped without initially notifying the ICO. The data controller later reported it after realising the laptop was unencrypted.

• A courier mistakenly delivered medication intended for one patient (Patient A) to another (Patient B). After Patient A complained, the pharmacist recognised the error and arranged for the unopened medication to be picked up and delivered correctly.

• A law firm employee fell victim to a phishing attack after clicking on a link in an email that led them to enter login credentials on what they thought was a legitimate site. The IT department later discovered that their email account had been compromised, leading to significant unauthorised payments being made by clients due to spoofed communications.

These cases are just a small sampling.

Now let’s discuss ransomware. There’s a common misconception among SME management that ransomware primarily targets larger companies since SMEs seem too small to be lucrative targets for cybercriminals. However, when SMEs do get attacked, ransom demands can be surprisingly low—often between £500 and £1,000—leading many SMEs to pay up without hesitation. This poses significant risks because often their data has already been stolen, and sometimes criminals fail to restore access afterward, leaving SMEs financially strained and unable to operate.

Preventing such attacks in the first place is far more advantageous. Here are several strategies you might consider implementing:

• One of the most impactful steps an SME can take is providing Cyber Awareness Training for employees. Research shows that 90% of data breaches stem from human error; it’s unlikely an employee will intentionally harm your business. However, without proper training, they may unknowingly engage in risky behaviour. Cyber security awareness training is crucial; staff need knowledge about potential threats. Cyber security is not just an IT issue; it’s a business-wide responsibility that requires everyone’s involvement. Effective strategies tend to follow the KISS principle—Keep It Simple Stupid.

• Another cost-effective measure is developing robust policies and procedures related to cyber security that are communicated throughout your organisation and regularly updated to remain relevant. Providing employees with clear guidelines on how to respond if they suspect suspicious activity supports them rather than penalising them for mistakes. Many SMEs lack adequate policies or settle for generic templates found online that seldom meet their needs.

• Review your backup strategy as well. Even if using cloud-based services, your data may not be adequately secured, despite providers’ claims. A better approach would be implementing a backup strategy where your data is backed up nightly onto magnetic media storage that’s stored securely offline. In case of an attack that locks your data, you could wipe affected workstations and restore information from backups without significant downtime.

• EMail remains one of the most common attack vectors. Numerous products claim to block malicious emails effectively; many excel at this task. For SMEs, cost is often a deciding factor when selecting these products. Unfortunately, some still opt for low-cost or free anti-malware solutions. Understanding that quality correlates with price is essential; if it’s free, you’re likely facing issues down the line.

Turning to how your systems might be monitored for security issues, we have been exploring options in the market for an affordable security managed service tailored specifically for SMEs and we believe we have found it! Our solution emphasises simplicity while utilising enterprise-grade technology to streamline daily operations effectively. Our unified platform seamlessly detects, prevents, and responds holistically to cyber threats without hassle or excessive costs.

We are offering a free trial that includes:

a. Email security.

b. Cloud data protection.

c. Automated cyber awareness training.

d. External risk assessment.

e. Endpoint security.

f. Secure browsing practices.

g. Phishing simulations.

h. Plus, as an added bonus: cyber insurance priced based on your risk score within our system—the lower your risk score, the more affordable your insurance!

This service is specifically designed for businesses with 1-250 IT users; while most SMEs typically fall between 10-15 users, we’re flexible! It’s a managed service approach with proactive risk mitigation tailored according to your preferences—all at just £12 per user per month!

We’re also introducing an intuitive cloud software solution focused on data protection that empowers organisations by securing their information while giving IT professionals an easy way to track sensitive data and manage risks effectively. The system routinely audits company data to locate sensitive information and applies necessary updates and encryption automatically.

This method ensures organisations always know what sensitive data they possess while keeping it secure through automatic encryption measures, making data security straightforward so businesses can protect private information as circumstances evolve over time, without needing complex software requiring specialised expertise.

Here are 2 very short videos explaining our solutions.

Why Your Business Needs Protective Monitoring – https://bit.ly/3Qy4u0x

Mastering GDPR Compliance: Safeguarding Your Company – https://bit.ly/4berDPa

Cyber Security Operations

Security operations is a complex subject and there is no doubt that it can be expensive and difficult, even for corporate organisations who generally have the resource, both financial and technical, to run a security operations centre (SOC), or at least can afford to outsource. I saw an RFP from a housing society for a SOC and I would be very interested to see if that contract gets let once the organisation gets the quotes, because I would be shocked if they could afford it.

Their RFP based its premise on the introduction of a Security Information and Event Management system (SIEM), which.in itself, might suggest that they don’t really know what they are asking for, or indeed, what they want. I base this on having designed, built and operated several such operations centres in the past.

Now before the SIEM vendors and resellers pile on, let’s be clear, SIEM systems have their place and are very useful in a SOC, although I would argue that they are most certainly not the end all and be all. My focus these days is on SMEs and for an SME there are several reasons why a SOC and an SIEM may be over the top and a cost too far.

Whilst an SIEM system is a valuable tool for cybersecurity, it comes with several drawbacks, including:

a. High Cost

Expensive Implementation – SIEM systems require significant upfront costs for software, hardware, and licensing.
Ongoing Costs – Maintenance, updates, and skilled personnel add to long-term expenses.

b. Complex Deployment and Management

Difficult Configuration – Setting up a SIEM system to work effectively requires extensive tuning and integration with various security tools.
Frequent Fine-Tuning – To avoid false positives and negatives, organisations must continuously refine alert rules and correlation policies.

c. High Volume of Alerts and False Positives

Alert Fatigue – SIEM systems generate numerous alerts, many of which are false positives, overwhelming security teams.
Difficult Prioritisation – It can be challenging to distinguish between critical threats and routine events without proper tuning.

d. Scalability Issues

Performance Bottlenecks – As an organisation grows, more logs and data sources can slow down the system.
Expensive Scaling – Scaling a SIEM to handle increasing data volumes often requires costly upgrades.

e. Need for Skilled Personnel

Expertise Required – SIEM systems need cybersecurity professionals to manage, analyse, and fine-tune them effectively.
Shortage of Talent – Finding skilled SIEM analysts can be challenging and expensive.

f. Storage and Compliance Challenges

Log Retention Costs – Storing large volumes of logs for compliance can be expensive.
Regulatory Complexity – Ensuring compliance with data protection laws (e.g., GDPR) requires careful log management.

h. Limited Threat Detection Without AI/Automation

Reactive Approach – Many traditional SIEMs rely on pre-set rules, making them less effective against new or sophisticated threats.
Lack of Automation – Without AI-driven analytics, manual investigation can be time-consuming.

Having debunked the usefulness of an SIEM system for an SME, let’s look at what an SME could do to mitigate their cyber risks.

A good cyber security strategy has always been founded upon strength in depth. Sound security architecture, good cyber awareness training, solid access control and identity management, and the ability to protectively monitor your estate for threats, vulnerabilities, and risks.

If you are not monitoring the effectiveness of the protections that you have spent good money on, how do you know it’s money well spent? Are those protections doing what you think they are? Monitoring is central to the identification and detection of threats to your IT systems. It acts as your eyes and ears when detecting and recovering from security incidents and it enables you to ensure that devices are used in accordance with your organisational policies.

Many small to medium-sized businesses struggle with stretched resources, lean budgets, and a critical technical expertise gap. This fight against sophisticated cyber threats and outdated systems turns them into easy targets for cybercriminals. Exposed and at risk, these businesses stagger on the edge of significant disruption, financial loss, and reputational damage. Although on the surface an SIEM system might seem to be what an SME needs, it would not fit the profile of most SMEs, being too resource intensive and costly.

We have been researching the market, looking for a way of providing a security managed service that would serve an SME, at an affordable price. And we think we’ve found it – no, we are SURE we have found it. Simplicity is at its core, employing enterprise-grade technology to simplify and streamline the day-to-day work. Our unified platform and onboarding process, seamlessly detects, prevents, and responds to cyber threats in the most holistic, hassle-free, and cost-effective way.

We are offering a 14 day free trial and will cover:

Email security.
Cloud data.
Automated cyber awareness training.
External risk.
Endpoint security.
Secure browsing.
Phishing simulation.
And as an added bonus we can provide cyber insurance at a price which is directly linked to your risk score within or system. The lower your risk, the cheaper the insurance.

This system is deliberately aimed at 1-250 IT users in any business. Most SMEs come in around 10 to 15 IT users, but we’re not precious about it. It is a managed service, and we have our eyes on the glass and can mitigate your risks automatically, or in concert with you, depending on how you wish to tailor the service. All this for a mere £12 per user per month.

IDENTITY AND ACCESS MANAGEMENT AND ZERO TRUST

Today is a typical January day, cold, wet and miserable. I really didn’t feel like getting out of bed but hey, not a lot of choice until I become a multi-millionaire and pay someone to get out of bed for me – I wish. I’m starting the day with a large coffee from Costa to try and kick start my creative juices and get this blog written. And no, I’m not writing it in Costa, it’s a takeaway. I’ve written several pieces on the dangers of insecure coffee shop WIFI.

Those of you who have managed to plough your way through some of my earlier stuff, will know that I am very big on user awareness training for staff at all levels, believing as I do, that it is arguably one of the quickest wins that an SME can make, to protect themselves against cybercrime. There is however a very close second, and that is identity and access management.

Before I get into that, let’s talk a bit about Zero Trust. You might have heard the term but what exactly does it mean? Zero Trust architecture is a security concept that emphasises the importance of continuous verification and strict access controls within a network environment. It operates on the principle of “trust no one” and assumes that no user or device should be inherently trusted, even if they are within the network perimeter. Instead, Zero Trust focuses on authenticating and authorising every access attempt, regardless of its source or location.

In a Zero Trust architecture, access controls are implemented based on various factors, such as user identity, device health, location, and other contextual information. This approach helps prevent lateral movement within a network, reduces the impact of potential breaches, and improves overall security posture.

Zero Trust architectures typically employ technologies such as multifactor authentication, encryption, micro-segmentation, and continuous monitoring to enforce access controls and detect anomalous behaviour. By adopting a Zero Trust mindset, organisations can enhance their security defences and better protect against modern cyber threats.

Getting back to Identity and Access Control, there is mounting evidence that the message is getting through that, although passwords are very important, they most certainly aren’t the panacea that many think they are. We can see many organisations moving to 2 factor authentication as a norm now. In fact, if you want to be accredited to Cyber Essentials or ISO 27001, it’s a requirement without which you won’t pass. A charity I volunteered for has done just that and not before time, considering the amount of personal data they are holding. But is that enough?

Compromised credentials are very high on the list of cybercrime related incidents that we see and have to deal with. Protecting these identities can be a very technical issue and advice and guidance will be needed to ensure that you are adequately covered. However it needn’t be overly expensive, neither need it be overly complicated. In fact, I’m a great believer in that the simplest solution is often the best solution. I’m an adherent of the KISS principle – Keep It Simple Stupid.

Questions to ask yourself include:

Are your user accounts configured with the minimum level of privilege they need to do their job?
If an employee needs additional privilege to carry out a one off job, how do you ensure that once it’s completed, the privilege is revoked?
What is a privileged account? Typically it’s someone who needs additional privileges as part of their daily tasks, such as adding/removing users, auditing actions, access to more secure areas of the network (finance, management data etc), etc etc. Are you limiting by policy the roles within your organisation that need privileged accounts, and are you specifying explicitly what those privileges are, by role?
Are your privileged accounts subject to greater levels of auditing and scrutiny?
Do you have a joiners and leavers process to manage active accounts?
Do you have a movers process ie employees that change roles and require different levels of access to carry out their new role, either adding or removing privilege?

Another issue that you may need to consider is any accounts that exist on your network that may be used by third party suppliers. Many companies use ‘just in time’ supply management which can require third parties to have access to their network. Another example is people like me who, when carrying out things like vulnerability assessments, may be given privileges to scan the network. Is that revoked at the end of the scan? And of course, there is the IT company you may have under contract who actively have access to your network to carry out maintenance and might actually also have a contract for controlling user privilege. Or perhaps the company you have under contract maintaining your alarms and security cameras which you didn’t know were actually using your network to connect to each other and their control room.

What about logging? What is logging? Every system has a set of logs which can be switched on or off. I often come across networks where logging has been switched off or never activated because its consider to be an overhead you can live without. Well, I disagree with that, quite vehemently. Logging helps you to determine what normal looks like. For example user profiles carry out certain functions within their role. If a user is stepping outside of that profile, you need to find out why. Is it a user who is doing something they simply didn’t realise they shouldn’t, or is it something more serious? Is it an identity that has been created or hi-jacked by a cybercriminal who has managed to gain access? Examination of these logs will help you understand that. There is of course software on the market that will be of great help with this. And of course, what do you do if you are suspicious of an activity or action by a user?

This is a big and crucial issue that deserves attention, more attention that a short blog like this can give it. So if you would like more information, we would be happy to oblige.

HOW DO HACKERS HACK?

You’ll have to forgive me for a somewhat provocative title and allow me some poetic licence, because in fact, different hacking groups do things differently, although they have much in common. Personally, I don’t like the term hacker, much preferring cybercriminal, because anyone who accesses a system without the owners’ permission, is by definition, a criminal. But I suppose hacker is less of a mouthful.

So, what is hacking? Hacking involves exploiting vulnerabilities in systems, software, or networks to gain unauthorised access or manipulate data using a variety of techniques and methods, which tend to combine technical tactics and social engineering.

One of the first things a hacker, or criminal group, will do, is to profile your organisation and your people. Favourite open sources of information include:

Social media: Information about hobbies, job roles, family, and schedules shared on platforms like LinkedIn, Facebook, and Instagram. Do you have a social media policy in your company? Do you lay down what an employee can and cannot say about your company on their personal social media pages? Do you have a designated person in the company who handles your company’s profile on social media?

Company Website: You’ll want to give prospective clients contact information of course, but you should not give out individual email addresses and limit profiles published. I do give my personal profile on my website but don’t give information about any other position, leaving it to a generic phone number and email address.

Professional Profiles: LinkedIn is a favourite for targeting businesses, as it provides details about an individual’s role, connections, and organisational structure.

Personal Websites or Blogs: These may reveal contact details, interests, or sensitive information inadvertently. The same issues that appertain to social media apply here.

Data Brokers: Cybercriminals can purchase detailed dossiers on individuals from data aggregator sites.

Another favourite is phishing and pretexting.

Phishing Emails: We all know, or at least I hope we know, what phishing is. Attackers send emails designed to extract more information, such as login credentials, by posing as a trusted entity. In this context, it could be as simple as the attacker wanting to verify information by perhaps sending an email to a discovered address but wanting to confirm that individuals position in the company. That just requires a response showing a signature block, so the phishing email might seem very innocuous.

Fake Surveys or Job Offers: These can be used to obtain detailed personal or professional data.

There are a variety of reconnaissance tools used by attackers, including open-source intelligence (OSINT) tools, WHOIS lookups and scanning misconfigured systems using commercially available tools such as Nmap and Nessus, which identify open ports, services and weak configurations. This is why it’s essential to regularly scan your network for these weaknesses. Ports can be opened for a particular reason and never closed again. It’s a common fault.

Here at H2 we scan the dark web daily looking for leaked credentials, particularly email credentials. When we on board a new client we nearly always get hits with sometimes up to 20+ compromised email addresses including passwords. You might ask why they’d be on the dark web – simple, they are often up for sale on dark web marketplaces.

In terms of cybercrime, who’s heard of psychological profiling? Cybercriminals analyse:

Behavioural Patterns: Regularity in actions, such as times a person is online, financial habits, or common purchases.

Weaknesses and Triggers: Examples include a recent job loss, major life changes, or emotional vulnerabilities, which they exploit through spear-phishing or scams.

I’ve often argued on these pages, that your employees are both your first line of defence and your greatest weakness, and that a good cyber awareness programme is worth its weight in gold. Cybercriminals often focus on employees in specific departments (like HR, finance, or IT).

LinkedIn and Organization Charts: Identify individuals with access to sensitive data.

Impersonation: Pretending to be a senior executive to trick lower-level employees (e.g., through Business Email Compromise attacks – I’ve written about the CEO scam a lot).

Technical Probing: Use of phishing or malware to breach a target’s employer.

In conclusion, what I’ve tried to do here is give you a flavour of what you may be up against, and I hope, I’ve shown you that for all the reasons shown above technology comes last after people and process. All the tech in the world won’t prevent issues arising from the above and is just one part of an integrated defence in depth required to prevent disaster.

Remote Working and Encryption

This is a subject that I tend to jump on every so often, because it’s one that people just don’t seem to get. Whether it’s working from home, from a coffee shop, airport, railway station etc, there is this perception that it’s safe because you’re connected via VPN, or perhaps some other form of application which encrypts data in transit. Well, let’s explore this subject a bit further.

There is no doubt that the propensity for working from home, or other remote locations, since COVID has introduced some very difficult, or at least challenging, security vulnerabilities into your network. For instance, prior to the pandemic, when you were 100% office based (except perhaps some mobile salespeople), your local IT provider will have almost certainly set up what we called the bastion security model. Ie, like a castle, a bastion, you had a wall around you, and for belt and braces, you also had a moat. The gateway was robust, had a drawbridge and portcullis, or let’s call it a secure firewall and anti-malware system. Everything was locked up inside and nice and secure (in fact it probably wasn’t but that’s for another day).

Whilst Microsoft didn’t invent the term the ‘new normal’, they were the first, I believe, to apply it to IT, following the enforced change in working practices brought about by the pandemic. Many companies have embraced this new normal and have settled into some form of hybrid working. Of course, this is nothing new, it’s been ‘a thing’ for years now, certainly regarding corporate organisations. The real change came about in SMEs for whom it really was quite revolutionary. Corporate bodies will have spent a lot of money on a variety or remote access systems to keep their data secure, whilst SMEs not only had to rush unprepared because of the pandemic, but they simply didn’t have the budget to employ more secure connections.

What the pandemic has done is change that, or perhaps arguably, accelerated the change to a more distributed way of working, already underway in corporate organisations but now common amongst SMEs. What does that mean for us? Firstly, we have to re-think how we are going to work. We start from a position where we still have preexisting tech, such as VPNs and whole disk encryption, to tackle modern and evolving issues.

So, what about VPNs? What are they? A VPN, or Virtual Private Network, is a service that creates a secure, encrypted connection between your device and the internet. This private “tunnel” protects your data and hides your IP address, effectively masking your online identity and activity. It works by allowing you to connect to the internet via an encrypted tunnel to a VPN server, which then forwards your requests to the website or service you’re accessing. The benefits are that it protects your data from being accessed by hackers or eavesdroppers, especially on public WIFI. It masks your IP address and replaces it with one from the VPN server, so it’s harder for websites, advertisers, or even your ISP (Internet Service Provider) to track your online activity. It’s particularly useful when working from insecure public WIFI but should also be used when working from home.

VPNs are available as standalone apps and more often now, incorporated into other applications, particularly those used to connect to cloud services.

All good, right? Well yes, anything that helps secure your data is a good thing. But like all good things it has some downsides. A VPN does help protect data in transit over an insecure WIFI connection by encrypting the data you send and receive over the internet. This means that if you’re connected to an insecure WIFI network (like in a coffee shop or airport), the VPN will prevent anyone from intercepting and reading your internet traffic.

However, a VPN does not protect data stored locally on your laptop. Files or personal information saved directly on your hard drive are not protected by the VPN. To secure the data on your laptop, you may want to consider using additional protections such as some sort of full disk encryption (BitLocker for Windows or FileVault for macOS are standard with the operating systems) to protect data at rest. And you should be using strong passwords and multi-factor authentication.

So, what I’m saying here is that should someone manage to gain access to your end point ie your laptop, desktop, even your phone, then your VPN is not going to protect you.

Let’s now talk a bit more about Bitlocker and FileVault. BitLocker, Microsoft’s disk encryption tool, provides robust security when configured properly (but I make the point here that it’s often not only incorrectly configured but isn’t even in use, making it pointless). And, like all encryption systems, its security depends on several factors, including the version of BitLocker, implementation practices, and potential vulnerabilities in the system environment. Bitlocker uses strong encryption, either AES 128 or 256 Bit, both of which are considered secure.

FileVault is the MacOS equivalent of Bitlocker (roughly) and is considered secure and built into the MacOS and is very easy to switch on. It too offers full disk encryption using AES 128 or 256 Bit. Once again though it is often not in use by Mac users, many of whom don’t even know it exists.

Are there any drawbacks to whole disk encryption? Will it protect me against things like ransomware? Whole disk encryption is designed to secure data at rest by preventing unauthorised access to data on a physical storage device (e.g., in case the device is lost or stolen). The problem is that once the machine is booted up, using the correct authentication, the disk is unencrypted, allowing you access to the data. So, the answer to the specific question re ransomware is that such an attack is typically not mitigated by this kind of encryption because:

Ransomware Operates at the OS Level: Once a device is booted up and the encrypted disk is unlocked (usually via user login), ransomware can interact with files just like any other software. Since the operating system has access to the data, the ransomware does as well.

Ransomware Encrypts Data Independently: Ransomware generally works by encrypting the contents of individual files or directories (not the entire disk), effectively “locking” them within the already-decrypted environment. BitLocker, or any full disk encryption, won’t stop ransomware from doing this, as it doesn’t interfere with file operations once the system is unlocked.

No Version Control or Rollback: Whole disk encryption solutions don’t provide a way to revert to previous file versions or recover from ransomware encryption. This is where regular backups (stored separately from the network) play a critical role in protecting against ransomware.

You’re being careful, you have a VPN, and you have Bitlocker configured on your laptop. You’re feeling nice and secure and have no issues using the local Coffee Shop or your home WIFI. Your connection to your cloud service is secure and all your data in transit is encrypted. Even your email is going via a secure tunnel. All is good with the world. Except of course that as soon as you logged on your whole disk encryption is switched off and your data is vulnerable even before you transmit it. Any data you download to work on likewise becomes vulnerable as soon as it lands on your laptop.

Earlier I argued that VPNs were old tech being used to combat modern threats and a different way of working. Does that mean that I think the VPN is no longer useful and is going out of style. No of course not, VPNs have a very real place in our security architectures and that won’t go away anytime soon. But they, like the vulnerabilities they are trying to mitigate, have to evolve and keep pace with present day and future realities.

VPNs, whether stand alone, or incorporated into another technology are great at securing data in transit. What about your data at rest? The best VPN in the world won’t protect you from someone who is determined to get in and steal your data or install ransomware. The problem for SMEs is the same that it pretty much always has been. Cost. Can they afford a system that will protect their data and stop it being lost, stolen or ransomed.

What has long been needed is a simple, flexible and intuitive security solution. We believe we have found such a system that protects your company against all known threats, and puts you firmly in control of your data, working automatically 24/7 to identify and safeguard your sensitive information.

Delivering multi-level protection, it provides real time control over all sensitive data. You can identify and solve every problem with a single click of your mouse! Instead of whole disk encryption, which is decrypted as soon as you log on, it provides file level encryption which allows authorised users access but no one else. But it does more, it locates all your data, allows you to decide what is, and what is not, sensitive, and provides subscription pricing for a fully managed solution.

It’s a system that is designed specifically for SMEs and is therefore appropriate to you, and affordable. To prove that we offer a 30-day free trial so that you can see it for yourself. Check it out at https://hah2.co.uk/gdpr-data-protection/.

Is Protective Monitoring Necessary for an SME?

I’ve talked about protective monitoring in the past but there is still some misperceptions about it, particularly amongst SMEs. Probably first and foremost is that it is way too expensive, which leads to thinking that it’s not for them and is much more of a nice to have than a necessity. I thought I’d take a bit of a deeper dive into this.

So, what is it?

Protective monitoring in cyber defence is a systematic approach to continuously observing and analysing an organisation’s digital environment to detect, prevent, and respond to security threats. It involves gathering and analysing data about network traffic, system activity, and user behaviours to identify potential vulnerabilities or malicious activities. Here’s a breakdown of its key components and purposes:

For a small or medium-sized enterprise (SME), implementing cyber protective monitoring is crucial for a variety of reasons. This proactive approach can be the difference between quickly identifying and mitigating threats or facing significant damage from a cyber-attack. Here are key reasons why SMEs should consider cyber protective monitoring:

1. Protection Against Data Breaches

SMEs often hold sensitive data like customer information, financial records, and intellectual property. Companies like law firms, financial advisors and estate agents, will hold years worth of personal identifiable information as defined by the Data Protection Act, or UK GDPR if you prefer. Protective monitoring helps identify unusual activity within their network, such as unauthorised access or data exfiltration attempts, allowing for swift action to prevent breaches.

This is especially important as SMEs can be perceived as easier targets by cybercriminals compared to larger enterprises with more robust defences.

2. Regulatory Compliance

Many industries have strict regulations around data privacy and cybersecurity, such as GDPR and PCI-DSS. Protective monitoring helps SMEs stay compliant by providing visibility into how data is accessed, used, and secured.

It allows them to maintain audit trails of activity, which are often required to prove compliance during an audit or investigation.

3. Early Threat Detection

Cyber threats are constantly evolving, and attackers are often inside a network for days or weeks before launching an attack (such as ransomware). Protective monitoring enables the detection of anomalous behaviour that could indicate a security threat before it becomes critical.

This helps minimise damage by enabling a faster response to potential threats like malware infections, unauthorized access, or network vulnerabilities.

4. Cost-Effectiveness in the Long Run

While some SMEs may view cyber protective monitoring as an additional cost, it is often more cost-effective than dealing with the fallout of a cyber-attack. The financial impact of a breach includes legal fees, loss of business, damage to reputation, and potential fines from regulatory bodies.

By investing in monitoring, SMEs can save significantly on these potential costs, making it a smart investment, especially now that there are systems specifically designed and costed for SMEs.

5. Building Trust with Clients and Partners

Customers and business partners expect their data to be handled securely. An SME with strong cybersecurity practices, including protective monitoring, can build trust and demonstrate its commitment to data security.

This can serve as a competitive advantage, especially when dealing with larger enterprises or industries that prioritise security.

6. Rapid Incident Response

When a security incident occurs, the speed of the response is critical. Cyber protective monitoring provides real-time alerts when suspicious activities are detected, enabling SMEs to quickly isolate affected systems and take necessary actions.

A rapid response can help contain potential damage, maintain business continuity, and limit operational disruptions.

7. Mitigating Insider Threats

Not all cybersecurity risks come from outside the organisation. Insider threats, whether malicious or accidental, can cause significant damage. Protective monitoring can help detect unusual behaviour from employees or contractors, such as unauthorised access to sensitive data or suspicious data transfers.

This allows SMEs to address these issues before they lead to data leaks or other security incidents.

8. Scalability and Adaptability

As SMEs grow, their digital footprint and potential vulnerabilities expand as well. Cyber protective monitoring solutions can scale alongside the business, ensuring that security measures remain effective even as new systems, networks, and applications are added.

This adaptability makes it easier for SMEs to adjust their cybersecurity strategy as their needs change, without a complete overhaul of their security infrastructure.

9. Insights for Better Decision-Making

Beyond just identifying threats, protective monitoring can provide valuable insights into network usage and performance. SMEs can leverage this data to make better strategic decisions regarding their IT infrastructure, such as identifying redundant systems or optimising network resources.

It can also highlight areas that require further security investments, helping prioritise spending on cybersecurity.

10. Improving Overall Cybersecurity Posture

Cyber protective monitoring is a key part of a broader cybersecurity strategy. By continuously monitoring and analysing network activities, SMEs can better understand their vulnerabilities and areas for improvement.

This helps create a culture of security within the organisation, where cybersecurity is not just an afterthought but an ongoing priority.

Overall, cyber protective monitoring provides visibility, control, and peace of mind for SMEs, helping them navigate the complex and ever-changing landscape of cyber threats. By taking a proactive stance, they can protect their assets, maintain customer trust, and ensure long-term resilience against cyber-attacks.

Protective monitoring is not just for corporate organisations, but is for everyone, especially now that there are systems and services designed especially for SMEs and priced accordingly. Don’t leave it until it’s too late. Playing catch up and fixing problems after the event, is always much more expensive that taking a pro-active stance.

To learn more about the protective monitoring managed solutions we provide please click here https://www.hah2.co.uk/

Can Remote Working be Dangerous?

Well frankly, yes it can be dangerous. There is a myriad of issues which have sprung out of remote working since COVID, with many SMEs, now operating a hybrid working scenario, although in my experience, certainly amongst my customer base, there are very few going 100% remote.

Businesses of all sizes have been forced to transform their operations to support remote work and by and large have done well, but not without many challenges—including video conferencing burn out, (along with wishing they’d taken out shares in Zoom!!), and a yearning to work together in person again, someday. We all realise that group working, face to face, is often necessary not just for efficiency, but because we are social animals. Experience has taught many businesses many things, but strangely, to my mind at least, many have simply not grasped the potentially dire consequences in terms of cyber security and data protection.

A distributed work environment i.e., personnel spread around various locations, office, home working, even the local coffee shop, creates critical challenges and new security threats as a result. The speed with which this has happened has meant that many simply did not take this into account and if they did, thought, well, this is temporary, and it won’t matter in the long run. Well perhaps, but as many are now finding, there have been advantages to home working, not least a lowering of costs in terms of how much office space is needed to carry out the business function. Many are now looking at Hybrid working i.e., from home with a day or two in the office during the week. There are pros and cons to this outside of the scope of this article, and businesses will have to make their own judgements, but one thing is clear and that is that businesses need to understand the risks now inherent in distributed work and need to get better at cyber security and data protection, in those environments.

Employees when remote working, are at much greater risk than those in offices. Since home connections are less secure, cybercriminals have an easier entry into the company network. Furthermore, the explosion of various online tools, solutions, and services for collaboration and productivity tend to have the bare minimum of security default setting, and updates from third-party vendors can change security preferences and be easily overlooked.

Phishing becomes an even greater threat to home workers simply because, in an office environment, they have access to colleagues and managers, who they can approach for advice and guidance. This is much harder to replicate with remote workers, especially those who may not be particularly tech savvy and who may not wish to become ‘burdensome’ to their co-workers.

Ransomware also enjoys an advantage in the remote working model. If their connection to the company is blocked, it is more difficult for workers to get assistance from the right experts and authorities. And since trust levels are lower when working from home, some workers will be concerned that they have “done something wrong” and so may be more reluctant to seek help. While this risk can be addressed by increased training, as well as messaging that vigilance and involving corporate IT will be rewarded, it can still be an uphill battle.

One of the biggest dangers I still see day to day is the dangers inherent in working from the local coffee shop. This is a subject that I tend to jump on every so often, because it’s one that people just don’t seem to get. Whenever I drop into a coffee shop for my caffeine infusion, there are usually at least a couple of people with their laptops open, working away on business issues. I could see open spreadsheets (and easy to read if you were sitting behind them), and all have their email open. They are often on a video call, and I can often hear all their side of the conversation, annoying enough for other café users but they are oblivious of the data being released into the wild.

If you are among those free Wi-Fi lovers, there’s bad news for you… your online privacy and security is at risk, if you rely on the weak to non-existent Wi-Fi security protocolsat coffee shops. This means that you could be exposed to various threats such as identity theft which has over 15 million cases each year, data theft/breaches, introducing malware to your business network and that of your customers/suppliers. This list is not exhaustive.

Free or public Wi-Fi’s are hotspots for hackers and data snoopers who want to steal your private data or financial information. It is easy for hackers to do that nowadays. You will be surprised to know the different ways hackers can compromise your device or your private information and why you shouldn’t rely on Wi-Fi security at coffee shops as they come with a lot of risk.

Unencrypted Data Exposure: If the Wi-Fi network is not encrypted, your sensitive information (e.g., passwords, emails, and financial data) can be intercepted by hackers using packet-sniffing tools.

Man-in-the-Middle Attacks: Hackers can position themselves between you and the network, intercepting and potentially altering the communication between your device and the server, leading to data theft or manipulation.

Fake Hotspots (Evil Twin Attacks): Cybercriminals may create a rogue Wi-Fi network that mimics the coffee shop’s legitimate network. If you connect to it, they can access all the data transmitted over the connection.

Malware Injection: Open networks can allow hackers to inject malware or viruses onto your device, which can lead to long-term breaches of your data or systems.

Session Hijacking: Attackers can intercept your session cookies, giving them access to your accounts, even if you’re using secure websites.

To mitigate these risks, use a VPN, avoid sensitive transactions, and ensure your firewall and antivirus software are active. Although a VPN may not save your data if it’s stored on your laptop.

We are huge supporters of Cyber Awareness training for managers and staff, arguing that this is no longer a ‘nice to have’ and is now very much a necessity. In fact, it is arguably the biggest quick win, giving the greatest potential return on investment that there is. Of course, this means that companies must understand what their threats, vulnerabilities and risks are, to assess exactly what training is going to be the most effective.

But that alone won’t save you from a dedicated hacker. We need to look at some more technical solutions to help you beat attacks. Here at H2 we have researched and developed services using Software as a Service (SaaS), which, being cloud based, work wherever you are, office, home or coffee shop, and encrypts your most sensitive data whether on your machine, or in transit.

If you feel a no obligation chat about this would be helpful, give us a call.

How are Mid-Market Businesses Faring Regarding Cyber Security

Mid-sized businesses are under as much pressure to keep the organisation secure as are the larger corporates but without the deep pockets that those larger corporates have. Because of this they are also fast becoming the easy target that we often view small businesses as being, but with a larger payload for the cyber-criminal. In fact, in 2023, 59% of medium sized businesses suffered a cyber-attack or data breach in the UK.

The biggest issue facing mid-market organisations is balancing limited resources with the growing complexity and volume of cyber threats. The lack of resources is compounded by an overall dearth of cyber-security skills in general, and a real lack of skills in mid-sized companies and the IT companies they often outsource to. Key aspects of this challenge include:

1. Resource Constraints: Mid-market organisations typically lack the budget and personnel to implement robust, enterprise-level cyber-security solutions. They may not have dedicated security teams, forcing IT departments to manage cyber-security alongside other duties. This dilutes skills and leaves them vulnerable to sophisticated attacks.

2. Rising Threat Sophistication: Cyber-criminals are increasingly using advanced tools and techniques, such as ransomware, phishing, and supply chain attacks, now enhanced with AI, which often outpace the security capabilities of mid-sized businesses. These organisations are prime targets because they are often seen as less protected than larger enterprises but more valuable than small businesses.

3. Compliance and Regulatory Challenges: As regulations like GDPR, FCA, and industry specific mandates grow, mid-market companies struggle to meet compliance requirements without the same level of support and infrastructure that larger organisations can afford.

4. Lack of Cyber security Awareness: Employees at mid-market organisations may not have adequate training on cyber-security best practices, making them vulnerable to human error, such as falling for phishing scams or weak password practices.

5. Third-Party Risks: Mid-market companies often rely on third-party vendors for various services, but they may lack the resources to thoroughly vet these vendors’ security postures, leading to vulnerabilities in their supply chain.

Addressing these issues requires mid-market organisations to prioritise cyber-security despite resource constraints, invest in scalable security solutions, and foster a strong security culture throughout the organisation.

There is a very real difficulty in breaking out of this cycle. The mind set of most board members is to focus on the core business and keep costs to an absolute minimum. Costs are important in a mid-sized business, especially one where margins may be tight. IT budgets will focus on items, both hardware and software, that are required to keep the revenue flowing and its cyber-security solutions, including data protection solutions, are often seen as nebulous because there is no obvious return on investment. CIOs/CISOs/IT Directors are often left trying to prove a negative, ie we haven’t had any security issues because we have protections in place, as opposed to we haven’t had any security issues therefore we don’t need to budget for protections. It’s a years old argument that never seems to have a resolution.

However, breaking out of this cycle, this thought process, is very important. Cyber threats, what we refer to as the threat landscape, are evolving at a frightening pace, often enhanced using AI. This will further compound any argument about budget simply because there is this need to keep pace with the cyber-criminal, and those of us in this industry know that we have always been playing catch up.

So how do we do it? Not an easy answer but one way that some mid-sized organisations are now looking at is managed security solutions. The provision of SOC (Security Operations Centre) solutions, in a shared way, as we do with cloud services for example, makes managed security more affordable. Many of the large enterprise organisations also make use of managed security solutions for the reasons of cost. On site solutions are not just expensive in terms of hardware and software, but also staffing costs, training etc, can be exorbitant. So, sharing those costs becomes very attractive.

Of course, there is no one size fits all solution and most managed service providers will have a set of services it provides, and do not tailor their services simply because it would make them too complex and expensive to provide, somewhat obviating the whole reason for doing it in the first place.

To make sure that you have the level of protection that you need, then you must do some up front work, maybe getting some consultancy that will save you money in the long run, by getting the protections and levels of service in place that you actually need.

There are several solutions around and organisations that provide them, and I do recommend that you shop around. Some are better than others and the CrowdStrike issue hasn’t done the reputation of managed services much good. Here at H2 we offer solutions for both monitoring your technical estate, your user actions, email, cloud services etc, as well as your data protection issues providing monitoring of any compliances that you may need, including UK GDPR, PCI DSS as an example.

If in doubt give us call, we’d be delighted to chat it over, offer a demo and a FREE trial lasting up to 30 days for the data protection solutions and 14 days for the more technical solution.

Is Cyber Security about Tech or the Business?

It’s simply a fact that many owners, managers, directors etc, believe that cyber security is a technology issue and is best left to those guys in IT who understand that stuff. Here at H2 we spend a lot of time and effort trying to educate C level people, that it really is a business issue, although it has significant input from the techies. It’s a business issue because breaches can have a significant financial and reputational impact. It’s also an IT issue because it involves implementing technical measures to protect systems and data. Effective cyber security requires a collaboration between business leaders and IT professionals to address both the strategic and technical aspects of security.

The crux of the issue though, is that it must be led by the business, and at board level. It requires a strategy to be followed, which is laid down at board level and which is focused on the goals and aspirations of the business, especially when your IT is outsourced. You can outsource your IT, but you can’t outsource your responsibility.

A valid argument is that the proliferation of security tools creates an illusion of safety. Organisations, large and small, often believe that by deploying a firewall, antivirus software and maybe some other tools, such as intrusion detection systems, they are adequately protected. This ignores the fact that such tools are controls put in place to mitigate risks identified and qualified in terms of importance, in a risk assessment and unless the benefits they bring are properly identified, and the solutions placed and configured correctly, they may well not be doing what you think they are doing. This thinking can also introduce significant third-party risks into your domain. The most recent example of this is the CrowdStrike issue which caused so much chaos throughout the globe.

To be fair to most companies in the smaller and mid-market arenas, their focus is on obtaining IT solutions as cost effectively as possible, and with the minimum of support costs. Cost control is vital to most. This means that they are extremely reluctant to spend money on what they see as not being part of their core business. Of course, if they get a cyber-attack or scam, or worse a data breach attracting the attention of the ICO, then their costs trying to fix the issue can easily outstrip any costs in prevention. Unless they have a well thought out risk managed strategy, they are wide open to slick sales pitches which push products. The rub is that in order to have that well thought out strategy, it means spending on what they see as expensive services that can seem somewhat nebulous, not something they can see and feel, and there is that vague feeling that they are being led to do something that really isn’t all that important.

The approach most take is to trust their IT provider to give them the protections they need. Most of these IT providers are what is known as re-sellers, ie they sell other people’s products and will push those products because that’s their business model. What they won’t do is take a risk managed approach which is essential in ensuring that any limited spend on security, limited because of cost constraints, is targeted where it’s needed and will be most effective. In other words, the technological approach taken by most IT support company’s will do half a job at best.

In essence then, if you don’t understand the risks you face, how can ensure that your cyber security strategy and protections are fit for purpose? Risk management is all about helping us to create plans for our future in a deliberate and responsible way. This requires us to explore what could go wrong in an organisation, on a day-to-day basis.

A quote from Bruce Schneier, Fellow at the Berkman Center for Internet & Society at Harvard Law School, goes like this:

‘If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology’.

How do we approach this then? First and foremost, you need to identify the risks that you face. How can you identify that risk and then mitigate it? Taking risks is a part of business. You assess risk every day when doing business. Do you want to do this deal? What happens if it goes not as expected? Do I want to take this person on? Whether you formally undertake a risk assessment or whether you assess that risk informally, you are working out what is appropriate to a level that is consistent with the risk that your organisation is prepared to take. Failure to do that will almost certainly be damaging to your business, perhaps fatally so.

The difference between assessing day to day business risk and assessing risk to cyber assets, is one of understanding. What is a cyber asset? In this context insert the word ‘information’ instead of cyber. It is the information contained within the IT system that is the important asset, not the piece of hardware it is sitting on. You understand your business risk, after all it is your business, but do you understand information risk? Do you have a clear idea of what information assets you have and where they are? Before you answer that think it through. Do you really know where all the data is? OK, you know that you have a server or servers probably in a cloud somewhere (cloud storage and access is a whole other subject) and that somewhere in those servers there is a bunch of data which runs your business. How much of that data has been saved onto staff workstations when they needed it to carry out some work? How much has been copied off somewhere else for what was probably a very good reason at one point? How well is your firewall functioning? Can malware work its way onto the network because the firewall does not have Universal Threat Management installed and can therefore be probing the servers and workstations. And we haven’t even thought about changes in working patterns. How many of your staff now work remotely some or all of the time. I could go on.

How can we be sure where all this information is and how important each bit is to the business? How can we assess this risk to the business, if information is lost or otherwise compromised? What about ransomware, phishing scams etc? The good news is that some of this can now be automated and managed for you at an affordable price and you can even arrange a 14 day totally free trial to assess its effectiveness.

Security Tools