Blog & Social

The latest cyber security news for UK Businesses

Cyber Awareness Training Data Breaches and their consequences General Security Issues Identity and Access Management Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security Tools Supply Chain Security Working Practices

What are the questions business owners ask when considering cyber security?

I wrote a post recently about what SMEs care about regarding Cyber Security v the continued FUD (fear, uncertainty and doubt), which many sales pitches tend to rely on, which helps foster the view that it’s all a little hyped up and not as serious as it advertised.  Well, I hope my post did a little to dispel this and show that there really is an issue out there that needs to be addressed by all businesses, not just the corporate big boys.  Let’s leave the stats and hype behind and concentrate on what SMEs need to be thinking about.

What is the cost of ignoring cyber security?

Perhaps this is the first question that they should be asking.  The financial hit of a data breach can be crippling, especially for the smaller businesses who are perhaps running on tight margins and for whom cash flow is often critical.  The average clean up for a smallish business is about £27K. this relates to system restoration, hardware replacement, and the implementation of enhanced security measures. and doesn’t include financial loss from the actual data stolen, or whatever scam was perpetrated, and any fall out from compliance failures, such as fines from the ICO.  And at least a third of organisations admit to losing customers post a data breach, highlighting reputational damage and a loss of customer trust. 

If you take all that into account, you should be able to work out what the potential cost might be for you.

So, what questions should owners, managers and board members be asking?

I think many get bogged down in the technicalities of IT and don’t consider it in business terms.  They don’t think about the business impact of cyber security, about what it is they’re trying to protect.  It’s not your IT systems, it’s your data that is the crown jewels.  IT systems can be replaced, that’s what your insurance is about, but once the data is stolen, then you are in very real trouble.

Risk Management

Talking of insurance, that’s perhaps how you should be viewing Cyber Security solutions.  Don’t think tech, think protecting the business.  First and foremost, the board members need to ask themselves if they have a good handle on their cyber risk.  Have they identified their cyber assets?  What is a cyber asset? Cyber assets are not just hardware and software, in fact those are the least of your worries.  It’s the data, where it is and how it’s protected that is important.  Have you assessed the risk to those assets?  Have you assessed the training requirements for your staff, not just the techies but all staff?  Think People, Process and then Technology.

Once you have done this, then you can consider what controls need to be put in place to reduce the risk to an acceptable level.

Below is some of the controls you will need to consider.  This list is not exhaustive

1.        User Access Control (Admin access is a whole other discussion)

 

This isn’t just about passwords.  Yes, they remain important but on their own, they are no longer sufficient.   Nonetheless weak passwords, password re-use and password sharing remain one of the leading root causes of a data breach.  123456 and, believe it or not, password, remain the most used passwords across the world! 

It is imperative that you have a strong password policy, dictating not just the length of the password, but also its construction, ensuring that there is a good mix of upper and lower case characters, numbers and symbols, that together make things very difficult for password crackers.

On their own though passwords remain a potential weak spot.  Multi factor authentication (MFA), sometimes referred to as 2FA, provides that extra layer of defence and can help to protect against brute-force attacks, phishing scams, key-logging and social engineering.  MFA can be simply implemented on most email platforms and within various apps you are using.  For those of you trying for Cyber Essentials or ISO 27K series, MFA is mandatory, so make sure it’s put in place.  

2.        Are you backing up your files? 

This seems an obvious thing to do but you’d be surprised how often when trying to restore from a backup, it fails.  This is often because the backup routine was set up back in the mists of time and has never been reviewed and even more dangerous, it’s never been tested to see if it works.  Set up your backup regime, have it reviewed regularly and tested regularly to make sure it works.  If you are backing up online, keep in mind that if a cyber-criminal gets access to your systems to, for example, carry out a ransomware attack, then they can probably get at your back up as well.  So, belt and braces, consider having an offline backup as well as an online backup.  The latter is more convenient but is vulnerable.

3.        Do you train your staff in cyber awareness? 

My favourite subject – cyber awareness training.  Your first line of defence is your staff, but if not trained adequately, they can be your biggest weakness.  It’s known in the trade as the insider threat, but it is caused mainly by human error, staff members doing something they shouldn’t, not maliciously but simply because they didn’t know they shouldn’t.  It accounts for 88% of data breaches. Providing your people with training on the threats, current scams and basic cyber awareness reduces the chance of a cyber-attack. This really is the easiest and cheapest quick win any organisation can take in reducing their risk exposure.

4.        Do your employees regularly travel or work remotely? 

This brings us neatly to what Microsoft coined as the New Normal.  Essentially this means remote working shared with in office working, known as the hybrid working model, or for some, moving to a totally remote working system.  Totally remote is not as common as hybrid working but is becoming more normal with certain size businesses in certain commercial verticals.  It’ll never work for everyone, but for those who have embraced it, it saves a considerable amount of expense.  It does however require us to rethink our cyber strategy.

Work-from-home employees are at much greater risk than those in offices. Since home connections are less secure, cybercriminals have an easier entry into the company network.  Furthermore, the explosion of various online tools, solutions, and services for collaboration and productivity tend to have the bare minimum of security default setting, and updates from third-party vendors can change security preferences and be easily overlooked.

Phishing becomes an even greater threat to home workers, often because, in an office environment, they have access to colleagues and managers, who they can approach for advice and guidance.  This is much harder to replicate with remote workers, especially those who may not be particularly tech savvy and who may not wish to become ‘burdensome’ to their co-workers.

Ransomware also enjoys an advantage in the work-from-home model.  If their connection to the company is blocked, it is more difficult for workers to get assistance from the right experts and authorities.  And since trust levels are lower when working from home, some workers will be concerned that they have “done something wrong” and so may be more reluctant to seek help. While this risk can be addressed by increased training, as well as messaging that vigilance and involving IT support will be rewarded, it can still be an uphill battle.

We need to break out of the old ‘bastion’ security model of a network protected by firewalls and other technologies and think about solutions that are designed to protect your assets regardless of where your employees work from.  They exist and aren’t hard to find.

 

5.        Where is all your data stored and who has access to it? 

Data tends to proliferate, especially when working remotely.  Cyber awareness training helps here, but it also helps for management to have a handle on data storage.  All organisations have this problem, but it becomes more acute for those businesses that hold large amounts of what is known as Personal Identifiable Information or PII.  This is information that can identify a living individual and compromise their privacy in some way.  Financial advisors, estate agents, solicitors etc, all share this issue.  The data protection act, becoming referred to as UK GDPR, is not a suggestion, it is law.

One of the biggest issues we find with organisations of all sizes, is that they think they know where all their data is but get quite a surprise when they discover multiple instances of the same data set.  This has become a real issue in that the new normal tempts users when working remotely, with possibly less than robust broadband, to copy data from cloud storage to their PC or laptop to ensure they can keep working on it.  Then they upload it again when they’ve finished but forget to delete their copy.  That’s just one instance but it is vital to understand where all this data is.  What if for instance, you get what is known as a subject access request, where a client or other member of the public wants to know exactly what personal data you have on them, and why.  I spoke to a financial advisor not long ago who told me that it took one of their partners off the road for 3 weeks, to discover where all the data was kept on just one person.  But under the law, they had no choice but to bite the bullet.

There are several systems on the market which will help with this but what most need now is a system that works regardless of the location of the user and continues providing that cover when the user moves from one location to another.  This is just a suggestion, but we’d be delighted to demo it to anyone who is interested.  https://hah2.co.uk/gdpr-data-protection/

6.        Disaster Recovery and Business Continuity

Business Continuity refers to the proactive strategies and plans put in place to ensure that essential business functions can continue in the event of a disruption or disaster. This could include natural disasters, cyber-attacks, power outages, or any other event that could disrupt normal business operations. Business Continuity planning typically involves identifying critical business processes, implementing redundant systems and processes, and developing communication plans to ensure that the organisation can continue to operate smoothly in the face of adversity.

Disaster Recovery, on the other hand, is focused specifically on restoring IT infrastructure and data after a disaster has occurred. This could involve recovering lost data, restoring systems and networks, and ensuring that IT operations can resume as quickly as possible. Disaster Recovery planning typically involves creating backup systems, implementing data recovery procedures, and testing these plans regularly to ensure they are effective. 

Both are critical components of a comprehensive risk management strategy and should be integrated into an organisation’s overall resilience planning efforts.

Just like backups, which are a crucial part of Disaster Recovery, these plans can become very quickly out of date and useless, unless reviewed periodically and tested to see if they work.

7.        Vulnerabilities and Threats 

A vulnerability is a flaw or weakness in an asset’s design, implementation, or operation and management that could be exploited by a threat. A threat is a potential for a cybercriminal to exploit a vulnerability.  A simple way to explain this is that a vulnerability is the inability to resist a hazard or to respond when a disaster has occurred. For instance, people who live on plains are more vulnerable to floods than people who live higher up.  The threat is the flood itself.

IT risks and vulnerabilities are the potential threats and weaknesses that can affect the performance, security and reliability of your business function and processes. They can have serious consequences for your business goals, customer satisfaction, and competitive advantage.

Identifying vulnerabilities to your cyber security assets and then identifying the threat to those assets in terms of the vulnerability being exploited, informs your risk and enables you to assign a value to it.  Financial value can be assigned to the risk score if you so wish.  You then apply controls to bring the risk down to an acceptable level, starting with the Very High risks, and then bringing them down to whatever is acceptable to you.  That acceptable level, known as the risk appetite, will vary business to business, risk to risk.

8. Supply Chain Security? 

In short, a supply chain attack is a cyber-attack that seeks to damage an organisation by targeting less-secure elements in the supply chain.

An example of such an attack was published by NCSC and points out that many modern businesses outsource their data to third party companies which aggregate, store, process, and broker the information, sometimes on behalf of clients in direct competition with one another.

Such sensitive data is not necessarily just about customers, but could also cover business structure, financial health, strategy, and exposure to risk. In the past, firms dealing with high profile mergers and acquisitions have been targeted. In September 2013, several networks belonging to large data aggregators were reported as having been compromised.

A small botnet was observed exfiltrating information from the internal systems of numerous data stores, through an encrypted channel, to a botnet controller on the public Internet. The highest profile victim was a data aggregator that licenses information on businesses and corporations for use in credit decisions, business-to-business marketing, and supply chain management. While the attackers may have been after consumer and business data, fraud experts suggested that information on consumer and business habits and practices was the most valuable.

The victim was a credit bureau for numerous businesses, providing “knowledge-based authentication” for financial transaction requests. This supply chain compromise enabled attackers to access valuable information stored via a third party and potentially commit large scale fraud.

OK, it was over 10 years ago, but don’t think it won’t happen again.

NCSC also cited what is known as a watering hole attack, which works by identifying a website that’s frequented by users within a targeted organisation, or even an entire sector, such as defence, government, or healthcare. That website is then compromised to enable the distribution of malware.

The attacker identifies weaknesses in the main target’s cyber security, then manipulates the watering hole site to deliver malware that will exploit these weaknesses.

The malware may be delivered and installed without the target realising it (called a ‘drive by’ attack) but given the trust the target is likely to have in the watering hole site, it can also be a file that a user will consciously download without realising what it really contains. Typically, the malware will be a Remote Access Trojan (RAT), enabling the attacker to gain remote access to the target’s system.

If you are in someones supply chain, then you need to make doubly sure that your security protects your customer as well as yourself.  And conversely, if you are connected electronically to someone who supplies you, are you sure that you are protected from any vulnerability they may have.

H2 provides affordable and flexible one-off and ongoing data protection and cyber risk protection services.

To learn more about the services we provide please click here https://www.hah2.co.uk/

Please feel free to give us a call or email.

Alternatively, you can book a slot using our Calendly link, https://bit.ly/3yoT0qi

T: 0800 4947478

M: 07702 019060

E: kevin_hawkins@hah2.co.uk

Trust H2 – Making sure your information is secure

Cyber Awareness Training Data Breaches and their consequences General Security Issues Identity and Access Management Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security Security Tools

All about H2

Introduction

All the information below is contained within the website but we thought it might be useful to summarise it in one post to make it easier for people who want to understand what we are all about.

About myself and H2

I like to start any discussion by saying that I’ve been in the cyber security game almost since before it was a game!  I started in Information Security at the MOD at a time when IT and databases were in their infancy and got in on the ground floor.  I subsequently went to work for the NHS, HP/HPE, CSC and Symantec, during which time I led many major cyber security projects in the public and private sectors, designing and commissioning the Security Operations Centre for the FCO, carrying out several projects for the MOD, leading the security team for the new online passport application, as well as several high street banks.

In 2013 I was asked to go to the middle east to set up a Cyber Security team covering the UAE, Bahrain, Saudi Arabia, and Qatar, growing the team from 3 people to 24.

On return my business partner and I set up H2 to serve the SME community. Sadly, my business partner did not survive the pandemic, and I am now the sole management of the company.

So why SMEs?  Surely there’s more money in corporate security?

Well yes there is, but SMEs are at the heart of our ethos.  During our time working in the corporate sector, it became clear that there was little to no support given to SMEs, either at the S, or the M end of the scale, and the big security companies and system integrators were content to leave that to their resellers ie those local IT support companies that resold their products.

Here at H2 we understand that the only real difference between an SME and a corporate organisation, in terms of cyber security, is that of scale.  We have therefore scaled our services, the products that support them, and our pricing, to fit with an SMEs issues and

pocket.   We like to say that we offer a triple A service providing solutions that are Appropriate (to you), Affordable and Accreditable (to standards such as Cyber Essentials).

Take a look at our Blog and social media posts.  We try to inform and educate, placing a link between what we know, and what SMEs need to know but are rarely told.

Solutions Provided to SMEs

The first thing that we discovered is that SMEs have a very poor grasp of cyber security issues, although that is changing following the pandemic when many were forced to change their working practices almost overnight and have subsequently embraced a distributed working model.  There is no doubt that the propensity for working from home, or other remote locations, since COVID has introduced some very difficult, or at least challenging, security vulnerabilities into SME networks.  For instance, prior to the pandemic, when they were 100% office based (except perhaps some mobile salespeople), their local IT provider will have almost certainly set up what we called the bastion security model.  Ie, like a castle, a bastion, you had a wall around you, and for belt and braces, you also had a moat.  The gateway was robust, had a drawbridge and portcullis, or let’s call it a secure firewall and anti-malware system.  Everything was locked up inside and nice and secure (in fact it probably wasn’t but that’s for another day).

Whilst Microsoft didn’t invent the term the ‘new normal’, they were the first, I believe, to apply it to IT, following the enforced change in working practices brought about by the pandemic.  Many companies have embraced this new normal and have settled into some form of hybrid working.  Of course, this is nothing new, it’s been ‘a thing’ for years now, certainly in corporate organisations.  The real change came about in SMEs for whom it really was quite revolutionary.  Corporate bodies will have spent a lot of money on a variety of remote access systems to keep their data secure, whilst SMEs not only had to rush unprepared because of the pandemic, but they simply didn’t have the budget to employ more secure connections.

What the pandemic has done is change that, or perhaps arguably, accelerated the change to a more distributed way of working, already underway in corporate organisations but now common amongst SMEs. 

Our first challenge then was that of education.  Changing the mindset of SMEs, moving them away from being simply technology focused, onto a more business oriented cyber

security focus.  Cyber security is a business issue, not a technical issue and that is something that many SMEs fail to grasp.  Any true cyber security professional takes a

risk managed approach, identifying the risks posed to their client, and then applying the principles of People, Process and then Technology, in that order.  That risk managed

approach is equally applicable to all sizes of organisation in all sectors and has not changed since the advent of the internet.

Taking the services we provide as shown clearly on our website (where pricing is shown), www.hah2.co.uk, the first is that of Board Advisory, where we offer advice and guidance to our clients regarding their security.  We often end up providing this advice for free as we are putting forward solutions to solve their issues but there is of course a limit to that.  We also offer a Cyber Maturity Assessment (CMA), which is close to a full risk assessment but tries to keep the costs down to an order that an SME can afford.  The CMA is fully described on the website, and we won’t reprint that here.

Another service we provide is Penetration Testing and Vulnerability assessment.  Pen Testing is a point in time test ie the minute you finish it and have read the report, it’s out of date.  It is however useful to do once a year or when you add a new feature to your systems, or take a new system into use.  We use a fully qualified CREST team who can, if you wish, also carry out attack simulations.

Vulnerability assessments are carried out continuously via agents deployed on the network.  The main difference is that as a Pen Test will find real issues, a vulnerability assessment will find things that you may be vulnerable to, but which haven’t necessarily been exploited and in fact, may not be a real issue once investigated.  They are, however, continuous throughout the year and can be more effective.

We talked earlier about People, Process and then Technology.  Arguably your first line of defence is your people.  They can also be your weakest link.  Data leaks often occur inadvertently, due to a lack of awareness rather than malicious intent. We offer cyber awareness training designed to equip your team with the knowledge and skills to safeguard sensitive information.

This training can be delivered in one of 2 ways.  The first is classroom based, either on site or over a remote connection such as Zoom or Google Meet.  The second is online training provided via another of our solutions which will be described below and allows

staff to pick when they will take some time to undertake the training which is delivered in a modular fashion, taking up very limited time which won’t take staff away from their desks to too long.

Another very important service which we provide online, cloud based, using a SaaS solution, is aimed at Data Protection.  Clients with large amounts of sensitive data that they wish to protect, use this solution.  It is essentially a data loss prevention system

that is designed and priced for SMEs, using state of the art file level encryption.  This system comes with a 30-day free trial so that clients can see it for themselves.

Based on Actifile it is tailored to the unique needs of the modern business which often sees its staff work remotely as well as in the office.  It protects the valuable data you hold and reduces your risk, without breaking the bank.  It covers:

  • Insider Threat Detection: Protect your business from internal threats posed by employees
  • Ransomware Protection: Safeguard your data from ransomware attacks that can cripple your operations
  • Data Leakage Prevention (DLP): Prevent confidential information from falling into the wrong hands
  • Data Privacy and Compliance: Ensure you meet GDPR requirements and avoid costly fines
  • Automated Encryption: Protect sensitive data with encryption that’s easy to manage.

In the dynamic world of cybersecurity, staying ahead of evolving threats requires a comprehensive approach that adapts to the ever-changing landscape. At H2, we recognise that one-size-fits-all solutions often fall short, which is why we’ve developed a flexible and scalable cybersecurity solution powered by Guardz, to address the needs of our clients.

Our approach is grounded in sound risk management principles, ensuring that our solutions are aligned with your specific cybersecurity requirements. Whether you need one or more of our products woven into a solution, we can tailor that solution to meet your exact needs and budget.

This complements the data protection solution whilst remaining capable of standing alone. Especially devised and priced for SMEs, it maintains our commitment to affordability and accessibility which is reflected in our incredibly competitive price of

£12 per seat, which includes no hidden charges, add-ons, or expensive infrastructure costs. The solution comes with a 14-day trial to give you hands-on experience with our solutions and assess their impact on your business.

This solution comes with a fully loaded Cyber Security Awareness training course, and a Phishing simulation capability.

You should note that we have bundled the 2 managed services together and offer them at a price reduced by £3 per seat per month.

Finally, we offer certification in Cyber Essentials and Cyber Essentials Plus which provide robust defences, endorsed by UK government to guard against common cyber-attacks. They are required certifications to work with public sector entities, and achieving certification signals a commitment to securing client data.

We now offer different pricing options to our clients.  For Cyber Essentials we offer:

Our Supported Package whereby we guide you during yourself assessment ensuring that you achieve certification first time, can be purchased at a one-off price which we are happy to quote for or a monthly subscription from £61 per month.  

If you are short on time or not too sure what to do, try our Turnkey Package whereby we carry out the assessment for you in total, once again ensuring that you achieve certification first time.  This can also be purchased as a one off at a price which we are happy to quote for or there is a subscription price which starts at £120 per month.

We can offer consultancy around ISO 2700X if it is considered desirable or appropriate.  We can advise on that.

Cyber Awareness Training General Security Issues Working Practices

Policies and Processes – a topic that can quickly lead to feelings of despair

When discussing cyber security, many envision suspicious figures hunched over screens in dimly lit rooms, perhaps with the scent of Jamaican Woodbines lingering in the air. Unfortunately, this image is misleading; cyber security is often quite routine, especially for those of us focused on defence rather than offence. It fundamentally revolves around People, Process, and Technology.

I published a blog recently about how hackers hack (https://hah2.co.uk/how-do-hackers-hack/). In this article, I delve into how hackers profile individuals and organisations through various methods, frequently utilising what is known as social engineering. This technique is primarily non-technical and hinges on a cybercriminals ability to infiltrate the defences of your employees to extract information. Defending against this threat relies heavily on the first two components of cyber risk management: People and Policy.

For regular readers, it’s clear how much I value cyber awareness training. I consistently emphasise that your staff can be both your most significant asset and your greatest vulnerability. Cyber awareness training is essential and should include educating employees about your organisations structure and operations. They should know whom to contact if they have concerns regarding cyber security or suspect social engineering attempts. This information needs to be embedded in the policy, potentially accompanied by a related process that connects People with Process.

In addition to cyber security policies, we also have data protection policies, which are separate but certainly overlap. While nearly every organisation requires security policies, the necessity and comprehensiveness of data protection policies vary based on the type of business. For instance, you might not immediately think of Estate Agents as data holders, yet they manage substantial amounts of Personally Identifiable Information (PII)—data that can identify an individual. Not long ago, a London estate agent faced an £80,000 fine from the Information Commissioner’s Office (ICO) for leaving the personal data of over 18,000 customers exposed for almost two years due to a failure in their data sharing practices.

It’s astonishing how much PII estate agents possess. Consider all the information they request when buying a house! In this case, compromised details included bank statements, salary information, copies of passports, birth dates, and addresses for both tenants and landlords.

Moreover, individuals have the right to sue companies that mishandle their data. Today, law firms even promote “no win no fee” agreements for these cases. Remember that data breaches typically involve numerous individuals—often hundreds or thousands of records.

To solidify the connection between cyber security and data protection, it’s important to note that the Data Protection Act 2018—often referred to as UK GDPR—mandates that personal data must be secured by ‘default and design’. This implies that cyber security measures must be integrated into your data protection processes, potentially increasing the number of policies and procedures necessary to ensure safety and compliance with legal requirements.

Let’s explore what you might need for cyber security. First and foremost, you require a comprehensive policy approved at the board level or by company ownership if there isn’t a formal structure in place. This policy serves to demonstrate the company’s commitment to cyber security and establishes a foundation for what we term an Information Security Management System (ISMS). While you don’t need to adopt formal terminology, it essentially outlines the framework detailing necessary policies, assigns responsibility for keeping them current and relevant, and ensures dissemination among all staff. Essential policies may include but aren’t limited to:

– Top-level policy issued by the board

– Starters and Leavers Policy

– Access Control Policy

– Magnetic Media Policy

– Mobile Working Policy

– Password Policy

– Email Policy

– Acceptable Use Policy

As mentioned earlier, data protection closely aligns with cyber security. Below is a potential list of policies you may need to comply with legal standards. Again, this list is not exhaustive and may seem excessive for some businesses but provides insight into what may be required:

– Data Protection – Overarching Policy

– Data Protection Training

– Data Protection – Consent

– Consent Withdrawal

– Subject Access Request

– Data Protection Complaints

– Retention of Records

– Data Breach Notification (note there is an electronic version of this on the ICO website)

– Data Protection Impact Assessment Procedure

– Security & Control of data protection documentation

– Policy Management Review Procedure

– Internal Data Protection Breach Register

– Retention & Disposal of Records Register

– Data Protection Officer (DPO) Responsibilities

– Required records to be maintained

Most policies are readily available online; however, knowing what you truly need versus what you can do without can be challenging. Too often people download templates only to modify them superficially while hoping for satisfactory results.

Over time, our approach has evolved alongside legislative changes both here and in Europe as well as shifts in working practices. We’ve dedicated countless hours researching solutions tailored to meet requirements that adapt into systems suitable for all business types—not only affordable but also compliant with standards like Cyber Essentials if needed. Flexibility has become crucial due to new working paradigms; traditional security systems where everyone operates within secure boundaries protected by firewalls are outdated. Today’s protective systems must function seamlessly whether you’re at home, on the move, or in the office, and your policies must reflect that.

When we first engage with prospective clients, we offer a free trial to assess their needs, we frequently discover they lack clarity on what data they hold or its location. They might have a vague understanding—perhaps it’s stored on cloud servers, with laptops or desktops accessing data on the cloud. However, once we implement our software for discovery purposes, we often find numerous copies stored on laptops/desktops alongside cloud servers. How does this happen? Over time—and particularly with many adopting hybrid work models—employees log onto cloud services remotely using unstable internet connections; they download necessary files to work offline then neglect to delete them after re-uploading. Or they may share files via email without realising it leaves sensitive information attached to their email server.

Audit trails present another issue: If the ICO investigates, having clear records indicating who created/copied/deleted/forwarded data is crucial. Additionally, individuals are entitled to submit Data Subject Access Requests (DSARs), compelling you to disclose any held data regarding them—a legal obligation you cannot refuse. I know of a financial firm that took almost three weeks just to fulfil a DSAR request which diverted an employee from billing tasks during that time.

Our solution addresses today’s requirements effectively—it even includes an encryption system—all under one monthly fee. You can trial it at no cost; we’d be surprised if after seeing its capabilities along with our incredibly low managed service rates you didn’t want to keep it!

Data Breaches and their consequences Risk Analysis and Security Strategy

What are the effects of downtime on your business?

I’ve talked in the past about what SMEs really care about when it comes to cyber security.  Do they really care about the technicalities of an attack or scam?  Do they really care about the technical aspects of a piece of protective software or hardware?  My argument is that they don’t give a damn.  What they want to know can be summed up pretty easily.

  1. How vulnerable are they to an attack and/or scam?
  2. What would be the effects if that attack or scam succeeded?
  3. What can they do about it, and how much will it cost them?

I wrote mostly about points a and c in a blog earlier in the year, https://hah2.co.uk/what-do-sme-owners-and-directors-want-from-cyber-security/, and I’ve included the link if you want to read it.  This time I’m concentrating on point b and the effects of the downtime that it creates.

Downtime following a cyberattack can have serious consequences for businesses, and individuals. We can categorise these into several key areas:

  1. Financial Costs
  • Lost Revenue: For e-commerce platforms, financial institutions, or other time-sensitive industries, downtime directly results in revenue losses.
  • Operational Costs: Companies may need to pay overtime to IT staff, hire external cybersecurity experts, or invest in replacement hardware or software.
  • Regulatory Fines: Non-compliance with regulations like GDPR or industry focused standards, due to downtime or data breaches can lead to significant fines.
  • Damage to Reputation
  • Loss of Customer Trust: Downtime can erode confidence, especially if sensitive customer data is exposed or if services are unavailable for extended periods.
  • Brand Damage: Affected organisations may face negative publicity, making it harder to attract and retain customers or partners.
  •  Operational Disruption
  • Service Outages: Critical systems might be offline, affecting production lines, supply chains, or essential services.
    • Loss of Productivity: Employees unable to access IT systems are effectively idle, causing delays in work and project completion.
  • Data Loss
  • Corruption or Deletion: Cyberattacks like ransomware can encrypt or destroy critical data, which may take days or weeks to recover, even with backups.
  • Intellectual Property Theft: If attackers steal proprietary information, it can be sold to competitors or leaked online.
  • Security Gap
  • Exploitation of Vulnerabilities: Downtime often exposes weak points in an organisation’s infrastructure, which may need to be patched or rebuilt.
  • Increased Risk of Future Attacks: Downtime may signal to attackers that the organisation is a viable target.
  •  Legal and Regulatory Implications
  • Breach of Contract: Failure to meet service-level agreements (SLAs) due to downtime can result in legal action from customers or partners.
  • Insurance Implications: Cyber insurance claims may be denied if the company failed to follow adequate preventative measures.
  •  Psychological and Social Impact
  • Employee Stress: Staff may feel pressured to resolve issues quickly, leading to burnout.
  • Customer Frustration: Extended downtime can alienate loyal customers, particularly in industries where continuity is critical, such as healthcare or finance.
  •  Broader Economic and Societal Impacts
  • Supply Chain Disruption: Downtime in one organisation can ripple through its partners, affecting entire supply chains.
    • Critical Infrastructure Risks: Attacks on essential services like utilities or healthcare systems can have life-threatening consequences.

I have blogged many times about the mitigation strategies you can take, that don’t need to break the bank, but the bottom line, proactive measures can significantly reduce the impact of cyberattacks and the associated downtime.  Understand your vulnerabilities and threats, base your spend on protecting against those threats, starting with the most serious, and then working down.  Don’t try and get to 100% security, it doesn’t exist, so understand what risks you find acceptable and what risks you don’t.

Cyber Awareness Training Working Practices

Work v Life Balance

A little change this week from my usual promotion of cyber security issues, prompted, at least in part, by the changes affecting SMEs by the budget, and also because I do tend to interact a lot with HR and recruitment company’s largely because of the amounts of personal identifiable information that they hold and their concern about those budget changes.

There are going to be different views about those changes, driven by lots of things ranging from political views to how they will impact individuals and I’m not going to pore oil on those differing views.  That’s not the focus of this piece.

My first 30 years employment, from age 15 to age 40, was spent in the public sector, 25 years in the Army and 5 years in the NHS.  I then left and spent 2 years in a UK company before moving on to a major US corporation, followed by 2 more major US corporations.  By that time I’d had enough and wanted to run my own business my own way.  A challenge which never stops but has its rewards.  The contrast between the attitudes in the UK and in the US are stark, even given that the UK has attitudes to employment and laws, which are much more onerous than they are in Western Europe.

One of the first things that hits you in a US corporation is the expectation that you will work as long as they want you to, go where they want you to, and do what they want you to, all within the same salary.  Some managers are harsher than others of course, but the stock price will win every argument, and I well remember the Chairman of my first company openly admitting that they used staffing levels to control the stock price.  That meant that they would cut staff to keep the markets happy, without a second thought and absolutely hated that they couldn’t do that in Europe because of the employment laws.  The US employees had no such protection.

There were many examples of how employees were often impacted by the attitude of the senior management across the pond.  One such sticks out when I was running a team in the middle east.  Our weekends were Friday and Saturday, we worked Sundays.  One Friday the team had hired a boat, privately between us, and we were anchored offshore with the team diving off the boat into some very warm waters and having a good time.  My mobile phone rang, and I was told that I needed to get online and produce some stats that were needed immediately.  All the European teams were doing this.  I told him we couldn’t get to the office and even sent him some photos that I took with my phone to show him where we were and reminded him it was our weekend. 

Needless to say, I was reprimanded for this and told that I wasn’t being loyal.  I was a manager who insisted on looking after my guys (and gals) but that wasn’t universally appreciated by those above.

So, what is senior management often missing when they treat staff poorly, when they are demanding and even sometimes, demeaning.  Managers are looking for productivity, of course they are, without that the company goes under, but is a happy staff more productive than an unhappy one.  If we are paying a low wage and making staff claim UC to make it up, does that demean the staff member as well as putting the burden on the taxpayer.  Going back to my time in the Army in the late seventies, I remember being a Lance Corporal and qualifying for supplementary benefit, which I found demeaning.  Mind you it got worse, I was promoted to Corporal and no longer qualified and lost about a tenner a week – a lot of dosh back then.

Let’s now look at what a good work-life balance is going to give us.  Is it essential for maintaining overall well-being and improving not just the personal aspects of life, but also does it improve those professional aspects that increase productivity?  I’m not declaring myself one way or another and would prefer others to come to their own conclusions.

a. Improved Mental Health

  • Reduces stress and anxiety.
  • Helps prevent burnout by creating time for rest and self-care.
  • Encourages a clearer mind, enhancing focus and decision-making.

b. Enhanced Physical Health

  • Allows for regular exercise and proper sleep.
  • Reduces the risk of stress-related illnesses, such as heart disease and high blood pressure, reducing time off for illness.

c. Increased Productivity

  • Balancing personal and professional priorities leads to greater focus and efficiency at work.
  • Employees who are well-rested and satisfied with their personal lives tend to be more motivated.

d. Stronger Relationships

  • Allocating time for family and friends strengthens personal bonds and social support networks.
  • Improves communication and connection with families.

e. Greater Job Satisfaction

  • Employees who maintain balance are more likely to enjoy their work, feel fulfilled, and remain engaged.
  • Reduces turnover rates by creating a supportive work environment.

f. Personal Growth and Fulfilment

  • Provides opportunities to pursue hobbies, interests, and personal goals.
  • Encourages learning and development outside of work, leading to a more well-rounded life.

g. Better Work Culture

  • Promotes a positive workplace where employees feel respected and valued.
  • Encourages teamwork and collaboration by reducing tension and conflict.

h. Increased Creativity and Innovation

  • Taking breaks and engaging in diverse activities fosters creative thinking and problem-solving.

We can argue that a poor work-life balance on the other hand, can have wide-ranging effects, impacting mental, physical, and social well-being as well as professional performance. Here’s a breakdown:

a. Physical Health Issues

  • Increased stress levels: Chronic stress can lead to headaches, fatigue, muscle tension, and weakened immunity.
  • Higher risk of chronic illnesses: Conditions such as heart disease, obesity, and diabetes can result from prolonged stress and lack of physical activity.
  • Sleep problems: Difficulty in disconnecting from work may lead to insomnia or poor-quality sleep.

b. Mental Health Challenges

  • Burnout: Persistent overwork can result in emotional exhaustion, reduced productivity, and detachment from work.
  • Anxiety and depression: Long hours and the pressure to perform can exacerbate mental health issues.
  • Reduced focus and creativity: Mental fatigue from a poor balance impairs cognitive functioning and decision-making.

c. Professional Consequences

  • Decreased productivity: Overworking may initially boost

So, what do I personally, conclude from this and why do I care?  Well firstly I’m a human being and so should care and secondly, I’m a business owner and want my staff focused, productive, great for clients to interact with, responsive and who look forward to coming in every day, or at least most days, every day is probably a stretch.  I will also readily admit that some of these points aren’t my own, I have cribbed from some research I did into this area.

What is your take?  I would expect differing views and that’s OK, we all face issues every day in business, some we have in common, and some are unique to a particular business.  I’m not looking for an argument, just some mature reflection.

Data Breaches and their consequences General Security Issues Risk Analysis and Security Strategy

Cyber Security Skills Gap

We often hear, particularly withing the Cyber Security industry itself, of a skills gap and a real problem recruiting and retaining cyber security professionals. Why and is it real or imagined?  There is a very useful report you can reference from the Department for Science, Innovation and Technology (DSIT), which I’d recommend.

Firstly, let’s look at the market.  As my regular readers will know, I work largely in the SME market, having come from the corporate market where I worked for many years.  Even there, true cyber security professionals were always hard to find and it’s very important to recognise the difference between cyber security skills and experience, and technical skills and experience.

Let me explain.  Within the SME sector there has always been the perception that technical skills were what is needed when putting in place protections against cybercrime.  That does seem to be changing, and I asked the question of a business audience a couple of weeks ago; did they think cyber security was a business issue or best left to the techies.  100% said business which is much different than when I first asked this group the same question 18 months ago, when about 80% said it was a technical issue.  This last result was somewhat heart-warming.

So why does technology get pushed so hard in that sector?  If we look at the corporate market for a moment, we’ll see that these organisations have a solid security team in place, run by a Chief Information Security Officer (CISO), who often reports to a Chief Information Officer (CIO) who is a board member.  This allows them to build a team covering most of the security skills needed, cyber generalists and governance, risk and compliance specialists amongst others, and techies as well.  They will often only outsource skills only needed now and again.  But even here they often struggle to recruit.

SMEs simply don’t have that organisation in place, and even at the top ‘M’ end of the market, those company’s knocking on the door of the corporate market, they still outsource most of their IT and with it, their cyber security.  The reason why an SME would choose to do this is obvious, it’s cost.  They can’t afford to employ even IT staff full time and those that do, often have one person whose main role is to keep on top of their outsource partner.

A big issue facing SME organisations is balancing limited resources with the growing complexity and volume of cyber threats. The lack of resources is compounded by an overall dearth of cyber-security skills in general, and a real lack of skills in mid-sized companies and the IT companies they often outsource to.

Allied to this issue is that many IT support company’s, focused on the SME market, don’t really have any more of a handle on cyber security issues and how to fix them, than the SMEs themselves.  This might sound harsh but consider that their business is all about selling in hardware and software licences, the more they sell, the stronger their business.  Obvious right?  That makes them focused on the technologies they sell, firewalls, anti-virus etc, and they will have technical skills needed to support and maintain those products.  That’s all fine but ask them some simple questions: 

  • Have they fully identified your security assets?  Security assets are not just hardware and software, in fact those are often the least of your worries.  It’s the data, where it is and how it’s protected that is important.
  • Have they done a risk assessment on those assets.
  • Have they recommended or implemented controls to manage the risk down to your acceptable residual risk level.  That is assuming they have spoken to you about what that acceptable risk is. 

It’s very important that business owners grasp the difference between the technical requirements of their networks, and the business requirement. 

Cyber security professionals will focus on encompassing all aspects of protecting digital assets, IT systems and networks, from unintended or unauthorised access, change or destruction. Cybersecurity focuses on a devising a security strategy and identifies controls, processes, and technologies to ensure the protection of data, programs, networks and associated software from unauthorised access or attack. It is focused on People, Process and then Technology.

Technical security focuses on the technologies employed as controls to remediate the risks defined in the risk assessments carried out.  Risk assessment is essential because without it, you can’t be sure that you have the right controls in the right place doing what you think they are doing.  In other words, it helps to ensure that your spend is targeted correctly and you’re not wasting money.

And that last piece is what your local IT provider is not doing.  They look at tech, not the business.

Getting back to the skills gap, it’s clear that whilst that gap exists it probably isn’t hitting SMEs hard because they weren’t invested in those skills in the first place in the way the corporate market is.  SMEs tend to outsource those things that aren’t their core business, including IT, HR and payroll etc, so why not cyber security?  The answer is often because they don’t think they need to, often until it’s too late.  Having someone on tap that you can contact for advice and guidance is worth every penny.  Trust me – I’m a cyber security pro!

H2 provides affordable and flexible one-off and ongoing data protection and cyber risk protection services designed specifically for SMEs; at a price they can afford.  Our advice and guidance takes a unique look at the problems facing SMEs whilst calling on our vast experience working for the larger organisations and government departments.

To learn more about the services we provide please click here https://www.hah2.co.uk/

Alternatively, please feel free to give us a call or email

T: 0800 4947478

M: 07702 019060

E: kevin_hawkins@hah2.co.uk

Trust H2 – Making sure your information is secure

General Security Issues Risk Analysis and Security Strategy Security

360º Protection in a perimeter-less world – A White Paper

Cyber Security – Some Facts

  • In the last year, 39% of all businesses in the UK were the victim of a cyber-attack
  • 20% of these lost money or data as a direct consequence
  • 31% of these estimated they were attacked at least once a week
  • The average financial loss to a business is £19,400
  • Phishing emails continue to be a major threat to businesses
  • Hacking of social media and email accounts to extort victims or to enable cases of fraud is increasing – over 8,000 cases in 2021/22, an increase of 23.5% on the previous year
  • Ransomware attacks are one of the most serious threats to businesses and organisations – they can prevent users accessing their devices, network, and data, and confidential information can be deliberately leaked unless a ransom is paid
  • There is a rise in Ransomware as a Service (RaaS) transactions where sophisticated ransomware programmes are leased to less technical cyber criminals so they can launch their own attacks
  • Most ransomware criminal gangs that target the UK are based in and around Russia
  • The NCSC (the National Cyber Security Centre) dealt with more than two million malicious cyber campaigns over the last 12 months
  • 63 cyber-attacks needed a national level response
  • Only 33% of businesses conduct a cyber risk assessment
  • The percentages of business which have Cyber Essentials certification is climbing but is still far too low.
  • 45% of businesses have staff using personally owned devices to carry out work related activities (BYOD – Bring Your Own Device policy)
  • Only 14% of businesses invested in threat intelligence and only 17% carried out a cyber security vulnerability audit
  • Only 23% of businesses have a formal cyber security strategy and only 38% have any kind of cyber security insurance (with only 5% having a dedicated cyber security insurance policy)
  • Only 17% of businesses have had training or awareness raising sessions on cyber security in the last 12 months

Glossary

Phishing

Fraudulent attempts to extract important information, such as passwords, from staff.

Ransomware

A type of malicious software designed to block access to a computer system until a sum of money is paid.

Malware
Malware (short for “malicious software”) is a type of computer program designed to infiltrate and damage computers without the user’s consent (e.g. viruses, worms, Trojan horses etc).

Threat Intelligence

Threat intelligence is where an organisation may employ a staff member or contractor or purchase a product to collate information and advice around all the cyber security risks the organisation faces.

Sources

  1. The National Cyber Security Centre (NCSC), part of GCHQ
  2. UK Government Official Statistics – Cyber Security Breaches Survey

Hybrid Working

Welcome to the changing world of work

Whether you’re an employer or an employee, you’ll know the world of work has changed.

The global Covid-19 pandemic and national lockdowns around the world meant factories shut their gates, shops closed their doors, and offices were forced to quickly transition to remote working. And this has fundamentally changed how many businesses operate today.

According to the Office of National Statistics (ONS), despite lockdown being over, a significant percentage of all UK staff now work remotely some or all of the time.

But these hybrid staff are not just working from home when they’re not in the workplace. They are also working from coffee shops, in shared working spaces, in airports and motorway service stations, and from other locations outside of most SME’s security boundaries.

What’s more, they are connecting to your network, downloading and uploading files, and sharing business sensitive information in more ways than ever before. And they’re using Cloud services and messaging apps (such as WhatsApp), and other communication systems and sharing tools, to ‘do business’ because they’re fast and easy.

But this hybrid way of working, and the speed and convenience of these systems and tools, comes at a cost. Your business information and data is now distributed like never before outside of your network and stored in locations that you may never know about.

For today’s cybercriminal, this presents a huge opportunity. They no longer need to target a company through their workplace network; instead, they can target businesses and their employees – and most importantly, their sensitive and confidential data – on the sites and in the places outside of your protected security network.

That’s why hacking of social media and email accounts to extort victims or to enable cases of fraud has increased by more than 23% over the last year.

And why the NCSC (the National Cyber Security Centre) had to deal with more than two million malicious cyber campaigns.

But with 39% of all businesses in the UK becoming the victim of a cyber-attack, the threats to SMEs in today’s hybrid world are increasing.

The Challenge for SMEs

In the UK and Europe, a business is classified as a SME (a Small to Medium-sized Enterprise) if it has fewer than 250 staff and a turnover of less than €50 million or a balance sheet of less than €43 million (although this definition has changed over the years).

And according to the DTI, 90% of UK GDP comes from SMEs including micro businesses with fewer than 10 staff.

But worryingly – but perhaps not surprisingly – the NCSC (the UK’s cyber security authority) and ENISA (the EU equivalent) are predicting a spike in cyber-attacks on SMEs, following a rise in attacks on smaller businesses in the US and Australia.

Why are SMEs the main target of cybercriminals?

There are two main reasons why cybercriminals are increasingly targeting smaller businesses, as follows:

1. Resources

Cybercriminals know that most SMEs don’t have the resources of enterprise level companies and therefore haven’t invested in the cyber protection that larger companies often do.

Many enterprise level companies use Managed Security Service Providers (MSSP’s) to provide the cyber protection they need, sometimes working alongside their own internal dedicated cyber security staff.

Most SMEs simply don’t have the ‘deep pockets’ to do this, making them an easy target for cyber attackers. 

2. Level of concern

For many smaller businesses, cyber security is simply not something they believe is a priority compared to the numerous other things they have to worry about.

And in most cases, they believe that they are already effectively protected because they use an outsourced IT partner (for things like managing their network or supplying hardware) or because they use Cloud based systems.

But cybercriminals know that things have changed since the onset of Covid and that more and more employees are now working remotely and using many different systems and online tools, outside of their traditional IT security boundary.

What’s more, many companies have adopted a Bring Your Own Device (BYOD) policy that means staff can use their own personal devices – such as laptops and phones – for work purposes.

All of this means cybercriminals have more points of entry then ever before to launch an attack.

Zero Trust Architecture and Shadow IT

When companies have files located in different places and spread across various systems and Cloud based solutions, they need what is known as a zero trust architecture. This model assumes that security breaches will happen, particularly as important data is held on third party systems such as communication apps and third party portals, which are collectively known as shadow IT.

SMEs typically do not understand the principles of zero trust architecture and use (or fail to monitor) shadow IT, meaning they rarely truly know all the locations where their data is held and whether it is protected.

Cyber Security Principles

Despite not having the resources of enterprise level companies, the basic principles of cyber security are the same for small businesses as they are for much larger ones.

Principle 1 – Understand the value of your data

Whether you’re a multibillion pound conglomerate or a sole trader working from home, the first thing you need to know is the value of your information assets and data. This could include your customer records, financial information, your passwords and system login details, intellectual property, and much more. All data has a monetary value.

One way to calculate the value of this is to estimate what the cost would be to your business if this data and information was compromised or stolen. Would the situation be recoverable, or would it mean the end of your business, both financially and reputationally? And even if you’re one of the 5% of UK companies that has a dedicated cyber security insurance policy, would this cover you for all the losses you would experience?

Principle 2 – Understand the threats

Do you really know what cyber-attacks could threaten your business? Could cyber criminals send you or your colleagues phishing emails in an attempt to extract important information or passwords? Or could they attempt to install ransomware software on your network that could lock you and your team out of your systems until a ransom is paid? Or could a virus, worm, or a Trojan horse be installed on your network due to a malware attack aimed at damaging your systems?

It’s important you know the threats facing your business in order to understand your vulnerability to those threats.

Principle 3 – Understand your vulnerability

How exposed is your business to the possibility of a cyber-attack? To understand your vulnerability, think about any security measures you have in place, as well as gaps in your protection that may be easily exploited by a cybercriminal. 

But keep in mind that like many other companies nowadays, your staff are most likely working outside of the traditional workplace environment some (if not most) of the time, and the locations they are now working from – and the methods they use to communicate, share, and work – are likely to be outside of your traditional network boundary. This greatly increases your vulnerability to a cyber-attack.

Principle 4 – Know your risk and mitigate

Once you know the value of your information, the threats that exist, and your vulnerability to a cyber-attack, you’ll know the risk that faces your business. But rather than believing you need to eliminate all risk – which even enterprise level companies and national organisations and governments struggle to do – you need to mitigate it to a level that is acceptable for your business.

This may involve implementing new security procedures or installing new software or changing how staff work or providing cyber security training, so all staff know what to watch out for. Or it could mean you have a cyber security audit carried out on your business or hire a (on-premises or remote) Cyber Security Officer who actively monitors your systems and protects you from existing and new cyber threats.

Perimeter-less 360o Protection for SMEs

In today’s hybrid world, what’s needed is a new approach to cyber security. A solution that provides advanced shield technology (proactive protection against all known and unknown security threats) and has the following features specifically designed for SMEs:

  • Works inside and outside of traditional IT security boundaries across all devices, systems, and platforms
  • Is built for a ‘perimeter-less’ ecosystem
  • Is designed for zero trust architecture and the use of shadow IT
  • Is low cost and flexible
  • Doesn’t impose unwieldy security barriers or restrictions but rather has been created to provide protection however and wherever staff are working
  • Protects against all external threats including ransomware (which most data loss prevention solutions don’t)
  • Has the ability to block ‘zero-day’ threats (an attack that exploits a security vulnerability which a developer has zero days to fix) before a business has even identified that such a threat exists
  • Stops all attempts to write known and unknown malware onto the permanent storage of any device
  • Doesn’t require a big (and often expensive) effort setting up blocking rules or ongoing costly maintenance
  • Doesn’t cause any performance issues and has no impact on a device’s RAM or CPU
  • Is a real-time low maintenance ‘fit and forget’ solution that blocks 100% of unauthorised attempts to modify a business’s IT systems

An Innovative Solution

H2 Cyber Risk Advisory Services has developed a low cost managed cyber security solution for SMEs that is designed specifically for hybrid working and 360o perimeter-less protection.

360o Real Time Work Anywhere Cyber Protection fuses industry leading cross platform data discovery functionality with robust and innovative data flow monitoring capabilities so that you’ll know where every one of your files and all of your data is and how to protect it.

It provides both valuable insight and protection to stop you becoming the next victim of cybercrime.

Insight

  • The system analyses your cyber-attack vulnerabilities and risks factoring in every device connected on your network.
  • It quantifies the threats against your organisation’s particular appetite or tolerance for risk.
  • It prioritises responses based on factors important to your business and monitors the effects of your actions.
  • It provides clear actionable insight including security recommendations such as security patches, updates, or workarounds.

Protection

  • Advanced shield technology that provides a ‘one time’ fit security solution that prevents against malware, ransomware, zero-day attacks, and all other cyber threats, known and unknown.
  • Shield technology does not use signatures so there is no need for constant updates to add newly discovered threats and no risk of becoming a zero-day victim.
  • The system proactively scans workstations, laptops, and other devices for sensitive data using smart patterning, and assigns a financial value to the risks you’re exposed to.
  • It tracks and audits data risk in real time by continually monitoring incoming and outgoing sensitive data flows to and from your perimeter-less organisation.
  • It uses a patented encryption process to automatically secure sensitive data across all endpoints, Cloud apps, third party portals, and shadow IT.  The entire process from initial deployment through to data risk analysis and remediation by automatic encryption takes as little as 72 hours.

Benefits

H2’s 360o Real Time Work Anywhere Cyber Protection provides the following benefits:

  • Perimeter-less cyber protection for wherever you or your staff are working – at home, in a coffee shop, at an airport, or anywhere else
  • Ideal for remote and hybrid workers
  • Real time 24-hour protection inside and outside of the Cloud
  • Protects your network, your devices, and your information
  • Enterprise grade shield technology specifically developed for the growing number of SMEs being targeted by hackers and cyber criminals
  • 360o protection against data breaches and cyber-attacks and scams
  • Simple subscription-based per month pricing – pay for just what you need and cancel anytime with 30 days notice

Ask yourself, do you know with absolute certainty where your data is?  Are you sure that an employee hasn’t downloaded a piece of sensitive data onto their laptop or desktop at home to work on, before uploading it again?  Have they forgotten to remove the copy they have on their machine, resulting in there now being two copies of the sensitive data, one sitting outside of your security boundary or outside of your Cloud systems? Or have they used a shadow IT tool, such as WhatsApp or some other communication system, to share the data outside of your network?

Ask about our free no-obligation trial to see how H2’s 360o Real Time Work Anywhere Cyber Protection can protect your business however and wherever your staff are working.

The Experts in Cyber Protection

H2 Cyber Risk Advisory Services was founded by industry leading experts in cyber protection who previously worked for a number of Fortune 500 companies, national governments, and leading technology companies including Symantec, Hewlett-Packard (HP), and BAE Systems.

Their experience in the security sector goes back to the late 1980s and includes designing the first security operations centre for the Foreign and Commonwealth Office (FCO), as well as leading security projects for the Ministry of Defence (MOD) and the Passport Office.

H2 was established in 2016 to provide the same quality of cyber and data protection to mid-market businesses and SMEs in the UK.

What else can H2 do for you?

As well as providing 360o Real Time Work Anywhere Cyber Protection, H2 provides the following services, each of which can be bundled into a comprehensive managed service:

  • Managed Cyber Security Officer – dedicated remote cyber security expert who proactively monitors your systems and cyber threats to your business, offered on a number of hours a month basis to suit the client
  • Innovative anti-malware solutions – these protect against malware threats and ransomware attacks
  • Patch management across your entire network
  • Cyber maturity assessments – examines and analyses all aspects of your cyber security stance, including policies and processes
  • Cyber Awareness Training for your staff – aimed at IT users and non-technical staff, and offered on-line as well as face to face
  • Cyber Essentials and Cyber Essentials + certification

Contact

H2 Cyber Risk Advisory Services

T: 0800 4947478

E: hello@hah2.co.uk

W: www.hah2.co.uk

H2 Cyber Risk Advisory Services Ltd
57 High Street Somersham Huntingdon PE28 3JB  		H2 Cyber Risk Advisory Services Ltd
Unit C17 Kestrel Business Centre 2 Colwick Industrial Estate Nottingham NG4 2JR

Cyber Awareness Training Data Breaches and their consequences General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security Tools

HOW DO HACKERS HACK?

You’ll have to forgive me for a somewhat provocative title and allow me some poetic licence, because in fact, different hacking groups do things differently, although they have much in common.  Personally, I don’t like the term hacker, much preferring cybercriminal, because anyone who accesses a system without the owners’ permission, is by definition, a criminal.  But I suppose hacker is less of a mouthful.

So, what is hacking?  Hacking involves exploiting vulnerabilities in systems, software, or networks to gain unauthorised access or manipulate data using a variety of techniques and methods, which tend to combine technical tactics and social engineering.

One of the first things a hacker, or criminal group, will do, is to profile your organisation and your people.  Favourite open sources of information include:

  • Social media: Information about hobbies, job roles, family, and schedules shared on platforms like LinkedIn, Facebook, and Instagram.  Do you have a social media policy in your company?  Do you lay down what an employee can and cannot say about your company on their personal social media pages?  Do you have a designated person in the company who handles your company’s profile on social media?
  • Company Website:  You’ll want to give prospective clients contact information of course, but you should not give out individual email addresses and limit profiles published.  I do give my personal profile on my website but don’t give information about any other position, leaving it to a generic phone number and email address.
  • Professional Profiles: LinkedIn is a favourite for targeting businesses, as it provides details about an individual’s role, connections, and organisational structure.
  • Personal Websites or Blogs: These may reveal contact details, interests, or sensitive information inadvertently.  The same issues that appertain to social media apply here. 
  • Data Brokers: Cybercriminals can purchase detailed dossiers on individuals from data aggregator sites.

Another favourite is phishing and pretexting.

  • Phishing Emails: We all know, or at least I hope we know, what phishing is.  Attackers send emails designed to extract more information, such as login credentials, by posing as a trusted entity.  In this context, it could be as simple as the attacker wanting to verify information by perhaps sending an email to a discovered address but wanting to confirm that individuals position in the company.  That just requires a response showing a signature block, so the phishing email might seem very innocuous.
  • Fake Surveys or Job Offers: These can be used to obtain detailed personal or professional data.

There are a variety of reconnaissance tools used by attackers, including open-source intelligence (OSINT) tools, WHOIS lookups and scanning misconfigured systems using commercially available tools such as Nmap and Nessus, which identify open ports, services and weak configurations.  This is why it’s essential to regularly scan your network for these weaknesses.  Ports can be opened for a particular reason and never closed again.  It’s a common fault.

Here at H2 we scan the dark web daily looking for leaked credentials, particularly email credentials.  When we on board a new client we nearly always get hits with sometimes up to 20+ compromised email addresses including passwords.  You might ask why they’d be on the dark web – simple, they are often up for sale on dark web marketplaces.

In terms of cybercrime, who’s heard of psychological profiling?  Cybercriminals analyse:

  • Behavioural Patterns: Regularity in actions, such as times a person is online, financial habits, or common purchases.
  • Weaknesses and Triggers: Examples include a recent job loss, major life changes, or emotional vulnerabilities, which they exploit through spear-phishing or scams.

I’ve often argued on these pages, that your employees are both your first line of defence and your greatest weakness, and that a good cyber awareness programme is worth its weight in gold.  Cybercriminals often focus on employees in specific departments (like HR, finance, or IT).

  • LinkedIn and Organization Charts: Identify individuals with access to sensitive data.
  • Impersonation: Pretending to be a senior executive to trick lower-level employees (e.g., through Business Email Compromise attacks – I’ve written about the CEO scam a lot).
  • Technical Probing: Use of phishing or malware to breach a target’s employer.

In conclusion, what I’ve tried to do here is give you a flavour of what you may be up against, and I hope, I’ve shown you that for all the reasons shown above technology comes last after people and process.  All the tech in the world won’t prevent issues arising from the above and is just one part of an integrated defence in depth required to prevent disaster.

Cyber Awareness Training General Security Issues Identity and Access Management Risk Analysis and Security Strategy Uncategorized

BRING YOUR OWN DEVICE (BYOD)

This is a subject that, at one time, was pretty much confined to the larger enterprise organisations but largely because of the pandemic, it is gaining popularity within SMEs and is now getting a lot of attention from the National Cyber Security Centre.

So, what is it?  Well the idea was to allow employees to use their own devices for work purposes.  The thinking was that in this day and age, many employees have developed preferences for what they use.  So whilst many will stick to Microsoft, others may prefer an Android or Apple tablet, whilst others still may prefer a MacBook or Chromebook.  There’s a wide choice these days.

But what do we mean by work purposes?  It can mean anything from accessing your emails, which most of us do on our phones, to accessing critical services and applications.  And this makes it a potentially complex issue.

The pandemic brought with it many issues that needed swift resolutions and now, it’s not uncommon to visit companies that have allowed their staff to continue to work from home often because the cost savings in office accommodation are very beneficial, and some have allowed staff to use their own preferred devices when working, including connecting to the company network and/or cloud services, remotely. 

For just about all SMEs, this has started from a position of necessity.  But like many such events, if it seems to be working, it rapidly becomes the norm and in creeps a complacency that it’s actually all OK.

BYOD solutions need to be planned and thought through.  And pretty much the same as most things, particularly risk based assessments, what you need to do really depends on your organisation.  You need to ask some questions:

  • Is there anything that needs to be done from the office that cannot be done by home workers?
  • Are there functions which employees need to do, that requires the company to have visibility and management of, and is there anything that doesn’t?
  • What do my employees need to do?
  • How can we balance what employees do that also involves your need to protect data and their privacy (DPA2018)?  They are after all, using their own device.

Above all you need a well thought through and comprehensive strategy, which, while offering flexibility and potential cost savings, recognises and deals with several security implications that organisations must address to ensure sensitive data and systems remain secure. Below are the key concerns:

a. Data Security

  • Data Leakage: Employees’ personal devices may lack adequate protections, increasing the risk of unauthorised access or accidental data leaks.
  • Loss or Theft of Devices: Personal devices may not have encryption enabled, making sensitive corporate data vulnerable if the device is lost or stolen.
  • Uncontrolled Sharing: Employees might unknowingly share corporate data via apps or cloud services outside the organisation’s control.

b. Malware and Cyber Threats

  • Insecure Devices: Personal devices might not have up-to-date antivirus software, firewalls, or operating system patches, making them susceptible to malware or ransomware attacks.
  • Unverified Applications: Employees may install unauthorised or malicious applications that could compromise corporate networks.

c. Network Security

  • Untrusted Connections: BYOD devices may connect to public Wi-Fi networks, exposing them to man-in-the-middle (MITM) attacks that could jeopardise corporate data.
  • Device Spoofing: An attacker could mimic a BYOD device to gain unauthorised access to the network.

d. Compliance Risks

  • Regulatory Violations: BYOD policies may lead to data handling practices that violate regulations like GDPR or PCI DSS if personal devices aren’t properly managed.
  • Audit Challenges: Tracking and demonstrating compliance can become difficult with non-standardised, user-managed devices.

e. Access Control

  • Weak Authentication: Personal devices may not support strong authentication mechanisms, increasing the risk of unauthorised access.
  • Lack of Segmentation: Employees’ devices may access both corporate and personal systems, creating potential crossover risks.

f. Insufficient Visibility

  • Limited Monitoring: Organisations may lack full visibility into personal devices, making it harder to detect breaches or policy violations.
  • Shadow IT: Employees might use unauthorised apps or services that bypass official security controls.

g. Employee Turnover

  • Data Retention: When an employee leaves, ensuring the removal of corporate data from their personal devices can be challenging.
  • Device Ownership: Legal and practical issues might arise when attempting to enforce data wiping on personal devices.

Mitigation Strategies

To address these risks, organisations adopting BYOD should:

  • Implement Mobile Device Management (MDM) or Endpoint Detection and Response (EDR) solutions.
  • Enforce strong authentication, such as multi-factor authentication (MFA).
  • Require device encryption and ensure compliance through regular checks.
  • Use some form of file separation to ensure separate corporate data from personal data.
  • Deploy a zero-trust security model with conditional access controls.
  • Establish clear policies and training to educate employees on BYOD security best practices.

By proactively addressing these risks, organisations can leverage the benefits of BYOD while maintaining robust security.

General Security Issues Ransomware, Phishing and other Malware Security Tools The Dangers of WiFi

Remote Working and Encryption

This is a subject that I tend to jump on every so often, because it’s one that people just don’t seem to get.  Whether it’s working from home, from a coffee shop, airport, railway station etc, there is this perception that it’s safe because you’re connected via VPN, or perhaps some other form of application which encrypts data in transit.  Well, let’s explore this subject a bit further.

There is no doubt that the propensity for working from home, or other remote locations, since COVID has introduced some very difficult, or at least challenging, security vulnerabilities into your network.  For instance, prior to the pandemic, when you were 100% office based (except perhaps some mobile salespeople), your local IT provider will have almost certainly set up what we called the bastion security model.  Ie, like a castle, a bastion, you had a wall around you, and for belt and braces, you also had a moat.  The gateway was robust, had a drawbridge and portcullis, or let’s call it a secure firewall and anti-malware system.  Everything was locked up inside and nice and secure (in fact it probably wasn’t but that’s for another day).

Whilst Microsoft didn’t invent the term the ‘new normal’, they were the first, I believe, to apply it to IT, following the enforced change in working practices brought about by the pandemic.  Many companies have embraced this new normal and have settled into some form of hybrid working.  Of course, this is nothing new, it’s been ‘a thing’ for years now, certainly regarding corporate organisations.  The real change came about in SMEs for whom it really was quite revolutionary.  Corporate bodies will have spent a lot of money on a variety or remote access systems to keep their data secure, whilst SMEs not only had to rush unprepared because of the pandemic, but they simply didn’t have the budget to employ more secure connections.

What the pandemic has done is change that, or perhaps arguably, accelerated the change to a more distributed way of working, already underway in corporate organisations but now common amongst SMEs.  What does that mean for us?  Firstly, we have to re-think how we are going to work.  We start from a position where we still have preexisting tech, such as VPNs and whole disk encryption, to tackle modern and evolving issues.

So, what about VPNs?  What are they?  A VPN, or Virtual Private Network, is a service that creates a secure, encrypted connection between your device and the internet. This private “tunnel” protects your data and hides your IP address, effectively masking your online identity and activity.  It works by allowing you to connect to the internet via an encrypted tunnel to a VPN server, which then forwards your requests to the website or service you’re accessing.  The benefits are that it protects your data from being accessed by hackers or eavesdroppers, especially on public WIFI. It masks your IP address and replaces it with one from the VPN server, so it’s harder for websites, advertisers, or even your ISP (Internet Service Provider) to track your online activity.  It’s particularly useful when working from insecure public WIFI but should also be used when working from home.

VPNs are available as standalone apps and more often now, incorporated into other applications, particularly those used to connect to cloud services.

All good, right?  Well yes, anything that helps secure your data is a good thing.  But like all good things it has some downsides.  A VPN does help protect data in transit over an insecure WIFI connection by encrypting the data you send and receive over the internet. This means that if you’re connected to an insecure WIFI network (like in a coffee shop or airport), the VPN will prevent anyone from intercepting and reading your internet traffic.

However, a VPN does not protect data stored locally on your laptop. Files or personal information saved directly on your hard drive are not protected by the VPN. To secure the data on your laptop, you may want to consider using additional protections such as some sort of full disk encryption (BitLocker for Windows or FileVault for macOS are standard with the operating systems) to protect data at rest.  And you should be using strong passwords and multi-factor authentication.

So, what I’m saying here is that should someone manage to gain access to your end point ie your laptop, desktop, even your phone, then your VPN is not going to protect you. 

Let’s now talk a bit more about Bitlocker and FileVault.  BitLocker, Microsoft’s disk encryption tool, provides robust security when configured properly (but I make the point here that it’s often not only incorrectly configured but isn’t even in use, making it pointless). And, like all encryption systems, its security depends on several factors, including the version of BitLocker, implementation practices, and potential vulnerabilities in the system environment. Bitlocker uses strong encryption, either AES 128 or 256 Bit, both of which are considered secure. 

FileVault is the MacOS equivalent of Bitlocker (roughly) and is considered secure and built into the MacOS and is very easy to switch on.  It too offers full disk encryption using AES 128 or 256 Bit.  Once again though it is often not in use by Mac users, many of whom don’t even know it exists.

Are there any drawbacks to whole disk encryption?  Will it protect me against things like ransomware?  Whole disk encryption is designed to secure data at rest by preventing unauthorised access to data on a physical storage device (e.g., in case the device is lost or stolen).  The problem is that once the machine is booted up, using the correct authentication, the disk is unencrypted, allowing you access to the data.  So, the answer to the specific question re ransomware is that such an attack is typically not mitigated by this kind of encryption because:

  • Ransomware Operates at the OS Level: Once a device is booted up and the encrypted disk is unlocked (usually via user login), ransomware can interact with files just like any other software. Since the operating system has access to the data, the ransomware does as well.
  • Ransomware Encrypts Data Independently: Ransomware generally works by encrypting the contents of individual files or directories (not the entire disk), effectively “locking” them within the already-decrypted environment. BitLocker, or any full disk encryption, won’t stop ransomware from doing this, as it doesn’t interfere with file operations once the system is unlocked.
  • No Version Control or Rollback: Whole disk encryption solutions don’t provide a way to revert to previous file versions or recover from ransomware encryption. This is where regular backups (stored separately from the network) play a critical role in protecting against ransomware.

You’re being careful, you have a VPN, and you have Bitlocker configured on your laptop.  You’re feeling nice and secure and have no issues using the local Coffee Shop or your home WIFI.  Your connection to your cloud service is secure and all your data in transit is encrypted.  Even your email is going via a secure tunnel.  All is good with the world.  Except of course that as soon as you logged on your whole disk encryption is switched off and your data is vulnerable even before you transmit it.  Any data you download to work on likewise becomes vulnerable as soon as it lands on your laptop.

Earlier I argued that VPNs were old tech being used to combat modern threats and a different way of working.  Does that mean that I think the VPN is no longer useful and is going out of style.  No of course not, VPNs have a very real place in our security architectures and that won’t go away anytime soon.  But they, like the vulnerabilities they are trying to mitigate, have to evolve and keep pace with present day and future realities.

VPNs, whether stand alone, or incorporated into another technology are great at securing data in transit.  What about your data at rest?  The best VPN in the world won’t protect you from someone who is determined to get in and steal your data or install ransomware.  The problem for SMEs is the same that it pretty much always has been.  Cost.  Can they afford a system that will protect their data and stop it being lost, stolen or ransomed. 

What has long been needed is a simple, flexible and intuitive security solution. We believe we have found such a system that protects your company against all known threats, and puts you firmly in control of your data, working automatically 24/7 to identify and safeguard your sensitive information.

Delivering multi-level protection, it provides real time control over all sensitive data. You can identify and solve every problem with a single click of your mouse!  Instead of whole disk encryption, which is decrypted as soon as you log on, it provides file level encryption which allows authorised users access but no one else.  But it does more, it locates all your data, allows you to decide what is, and what is not, sensitive, and provides subscription pricing for a fully managed solution. 

It’s a system that is designed specifically for SMEs and is therefore appropriate to you, and affordable.  To prove that we offer a 30-day free trial so that you can see it for yourself.  Check it out at https://hah2.co.uk/gdpr-data-protection/.

Scroll to top