We often hear, particularly withing the Cyber Security industry itself, of a skills gap and a real problem recruiting and retaining cyber security professionals. Why and is it real or imagined? There is a very useful report you can reference from the Department for Science, Innovation and Technology (DSIT), which I’d recommend.
Firstly, let’s look at the market. As my regular readers will know, I work largely in the SME market, having come from the corporate market where I worked for many years. Even there, true cyber security professionals were always hard to find and it’s very important to recognise the difference between cyber security skills and experience, and technical skills and experience.
Let me explain. Within the SME sector there has always been the perception that technical skills were what is needed when putting in place protections against cybercrime. That does seem to be changing, and I asked the question of a business audience a couple of weeks ago; did they think cyber security was a business issue or best left to the techies. 100% said business which is much different than when I first asked this group the same question 18 months ago, when about 80% said it was a technical issue. This last result was somewhat heart-warming.
So why does technology get pushed so hard in that sector? If we look at the corporate market for a moment, we’ll see that these organisations have a solid security team in place, run by a Chief Information Security Officer (CISO), who often reports to a Chief Information Officer (CIO) who is a board member. This allows them to build a team covering most of the security skills needed, cyber generalists and governance, risk and compliance specialists amongst others, and techies as well. They will often only outsource skills only needed now and again. But even here they often struggle to recruit.
SMEs simply don’t have that organisation in place, and even at the top ‘M’ end of the market, those company’s knocking on the door of the corporate market, they still outsource most of their IT and with it, their cyber security. The reason why an SME would choose to do this is obvious, it’s cost. They can’t afford to employ even IT staff full time and those that do, often have one person whose main role is to keep on top of their outsource partner.
A big issue facing SME organisations is balancing limited resources with the growing complexity and volume of cyber threats. The lack of resources is compounded by an overall dearth of cyber-security skills in general, and a real lack of skills in mid-sized companies and the IT companies they often outsource to.
Allied to this issue is that many IT support company’s, focused on the SME market, don’t really have any more of a handle on cyber security issues and how to fix them, than the SMEs themselves. This might sound harsh but consider that their business is all about selling in hardware and software licences, the more they sell, the stronger their business. Obvious right? That makes them focused on the technologies they sell, firewalls, anti-virus etc, and they will have technical skills needed to support and maintain those products. That’s all fine but ask them some simple questions:
Have they fully identified your security assets? Security assets are not just hardware and software, in fact those are often the least of your worries. It’s the data, where it is and how it’s protected that is important.
Have they done a risk assessment on those assets.
Have they recommended or implemented controls to manage the risk down to your acceptable residual risk level. That is assuming they have spoken to you about what that acceptable risk is.
It’s very important that business owners grasp the difference between the technical requirements of their networks, and the business requirement.
Cyber security professionals will focus on encompassing all aspects of protecting digital assets, IT systems and networks, from unintended or unauthorised access, change or destruction. Cybersecurity focuses on a devising a security strategy and identifies controls, processes, and technologies to ensure the protection of data, programs, networks and associated software from unauthorised access or attack. It is focused on People, Process and then Technology.
Technical security focuses on the technologies employed as controls to remediate the risks defined in the risk assessments carried out. Risk assessment is essential because without it, you can’t be sure that you have the right controls in the right place doing what you think they are doing. In other words, it helps to ensure that your spend is targeted correctly and you’re not wasting money.
And that last piece is what your local IT provider is not doing. They look at tech, not the business.
Getting back to the skills gap, it’s clear that whilst that gap exists it probably isn’t hitting SMEs hard because they weren’t invested in those skills in the first place in the way the corporate market is. SMEs tend to outsource those things that aren’t their core business, including IT, HR and payroll etc, so why not cyber security? The answer is often because they don’t think they need to, often until it’s too late. Having someone on tap that you can contact for advice and guidance is worth every penny. Trust me – I’m a cyber security pro!
H2 provides affordable and flexible one-off and ongoing data protection and cyber risk protection services designed specifically for SMEs; at a price they can afford. Our advice and guidance takes a unique look at the problems facing SMEs whilst calling on our vast experience working for the larger organisations and government departments.
In the last year, 39% of all businesses in the UK were the victim of a cyber-attack
20% of these lost money or data as a direct consequence
31% of these estimated they were attacked at least once a week
The average financial loss to a business is £19,400
Phishing emails continue to be a major threat to businesses
Hacking of social media and email accounts to extort victims or to enable cases of fraud is increasing – over 8,000 cases in 2021/22, an increase of 23.5% on the previous year
Ransomware attacks are one of the most serious threats to businesses and organisations – they can prevent users accessing their devices, network, and data, and confidential information can be deliberately leaked unless a ransom is paid
There is a rise in Ransomware as a Service (RaaS) transactions where sophisticated ransomware programmes are leased to less technical cyber criminals so they can launch their own attacks
Most ransomware criminal gangs that target the UK are based in and around Russia
The NCSC (the National Cyber Security Centre) dealt with more than two million malicious cyber campaigns over the last 12 months
63 cyber-attacks needed a national level response
Only 33% of businesses conduct a cyber risk assessment
The percentages of business which have Cyber Essentials certification is climbing but is still far too low.
45% of businesses have staff using personally owned devices to carry out work related activities (BYOD – Bring Your Own Device policy)
Only 14% of businesses invested in threat intelligence and only 17% carried out a cyber security vulnerability audit
Only 23% of businesses have a formal cyber security strategy and only 38% have any kind of cyber security insurance (with only 5% having a dedicated cyber security insurance policy)
Only 17% of businesses have had training or awareness raising sessions on cyber security in the last 12 months
Glossary
Phishing
Fraudulent attempts to extract important information, such as passwords, from staff.
Ransomware
A type of malicious software designed to block access to a computer system until a sum of money is paid.
Malware Malware (short for “malicious software”) is a type of computer program designed to infiltrate and damage computers without the user’s consent (e.g. viruses, worms, Trojan horses etc).
Threat Intelligence
Threat intelligence is where an organisation may employ a staff member or contractor or purchase a product to collate information and advice around all the cyber security risks the organisation faces.
Sources
The National Cyber Security Centre (NCSC), part of GCHQ
UK Government Official Statistics – Cyber Security Breaches Survey
Hybrid Working
Welcome to the changing world of work
Whether you’re an employer or an employee, you’ll know the world of work has changed.
The global Covid-19 pandemic and national lockdowns around the world meant factories shut their gates, shops closed their doors, and offices were forced to quickly transition to remote working. And this has fundamentally changed how many businesses operate today.
According to the Office of National Statistics (ONS), despite lockdown being over, a significant percentage of all UK staff now work remotely some or all of the time.
But these hybrid staff are not just working from home when they’re not in the workplace. They are also working from coffee shops, in shared working spaces, in airports and motorway service stations, and from other locations outside of most SME’s security boundaries.
What’s more, they are connecting to your network, downloading and uploading files, and sharing business sensitive information in more ways than ever before. And they’re using Cloud services and messaging apps (such as WhatsApp), and other communication systems and sharing tools, to ‘do business’ because they’re fast and easy.
But this hybrid way of working, and the speed and convenience of these systems and tools, comes at a cost. Your business information and data is now distributed like never before outside of your network and stored in locations that you may never know about.
For today’s cybercriminal, this presents a huge opportunity. They no longer need to target a company through their workplace network; instead, they can target businesses and their employees – and most importantly, their sensitive and confidential data – on the sites and in the places outside of your protected security network.
That’s why hacking of social media and email accounts to extort victims or to enable cases of fraud has increased by more than 23% over the last year.
And why the NCSC (the National Cyber Security Centre) had to deal with more than two million malicious cyber campaigns.
But with 39% of all businesses in the UK becoming the victim of a cyber-attack, the threats to SMEs in today’s hybrid world are increasing.
The Challenge for SMEs
In the UK and Europe, a business is classified as a SME (a Small to Medium-sized Enterprise) if it has fewer than 250 staff and a turnover of less than €50 million or a balance sheet of less than €43 million (although this definition has changed over the years).
And according to the DTI, 90% of UK GDP comes from SMEs including micro businesses with fewer than 10 staff.
But worryingly – but perhaps not surprisingly – the NCSC (the UK’s cyber security authority) and ENISA (the EU equivalent) are predicting a spike in cyber-attacks on SMEs, following a rise in attacks on smaller businesses in the US and Australia.
Why are SMEs the main target of cybercriminals?
There are two main reasons why cybercriminals are increasingly targeting smaller businesses, as follows:
1. Resources
Cybercriminals know that most SMEs don’t have the resources of enterprise level companies and therefore haven’t invested in the cyber protection that larger companies often do.
Many enterprise level companies use Managed Security Service Providers (MSSP’s) to provide the cyber protection they need, sometimes working alongside their own internal dedicated cyber security staff.
Most SMEs simply don’t have the ‘deep pockets’ to do this, making them an easy target for cyber attackers.
2. Level of concern
For many smaller businesses, cyber security is simply not something they believe is a priority compared to the numerous other things they have to worry about.
And in most cases, they believe that they are already effectively protected because they use an outsourced IT partner (for things like managing their network or supplying hardware) or because they use Cloud based systems.
But cybercriminals know that things have changed since the onset of Covid and that more and more employees are now working remotely and using many different systems and online tools, outside of their traditional IT security boundary.
What’s more, many companies have adopted a Bring Your Own Device (BYOD) policy that means staff can use their own personal devices – such as laptops and phones – for work purposes.
All of this means cybercriminals have more points of entry then ever before to launch an attack.
Zero Trust Architecture and Shadow IT
When companies have files located in different places and spread across various systems and Cloud based solutions, they need what is known as a zero trust architecture. This model assumes that security breaches will happen, particularly as important data is held on third party systems such as communication apps and third party portals, which are collectively known as shadow IT.
SMEs typically do not understand the principles of zero trust architecture and use (or fail to monitor) shadow IT, meaning they rarely truly know all the locations where their data is held and whether it is protected.
Cyber Security Principles
Despite not having the resources of enterprise level companies, the basic principles of cyber security are the same for small businesses as they are for much larger ones.
Principle 1 – Understand the value of your data
Whether you’re a multibillion pound conglomerate or a sole trader working from home, the first thing you need to know is the value of your information assets and data. This could include your customer records, financial information, your passwords and system login details, intellectual property, and much more. All data has a monetary value.
One way to calculate the value of this is to estimate what the cost would be to your business if this data and information was compromised or stolen. Would the situation be recoverable, or would it mean the end of your business, both financially and reputationally? And even if you’re one of the 5% of UK companies that has a dedicated cyber security insurance policy, would this cover you for all the losses you would experience?
Principle 2 – Understand the threats
Do you really know what cyber-attacks could threaten your business? Could cyber criminals send you or your colleagues phishing emails in an attempt to extract important information or passwords? Or could they attempt to install ransomware software on your network that could lock you and your team out of your systems until a ransom is paid? Or could a virus, worm, or a Trojan horse be installed on your network due to a malware attack aimed at damaging your systems?
It’s important you know the threats facing your business in order to understand your vulnerability to those threats.
Principle 3 – Understand your vulnerability
How exposed is your business to the possibility of a cyber-attack? To understand your vulnerability, think about any security measures you have in place, as well as gaps in your protection that may be easily exploited by a cybercriminal.
But keep in mind that like many other companies nowadays, your staff are most likely working outside of the traditional workplace environment some (if not most) of the time, and the locations they are now working from – and the methods they use to communicate, share, and work – are likely to be outside of your traditional network boundary. This greatly increases your vulnerability to a cyber-attack.
Principle 4 – Know your risk and mitigate
Once you know the value of your information, the threats that exist, and your vulnerability to a cyber-attack, you’ll know the risk that faces your business. But rather than believing you need to eliminate all risk – which even enterprise level companies and national organisations and governments struggle to do – you need to mitigate it to a level that is acceptable for your business.
This may involve implementing new security procedures or installing new software or changing how staff work or providing cyber security training, so all staff know what to watch out for. Or it could mean you have a cyber security audit carried out on your business or hire a (on-premises or remote) Cyber Security Officer who actively monitors your systems and protects you from existing and new cyber threats.
Perimeter-less 360o Protection for SMEs
In today’s hybrid world, what’s needed is a new approach to cyber security. A solution that provides advanced shield technology (proactive protection against all known and unknown security threats) and has the following features specifically designed for SMEs:
Works inside and outside of traditional IT security boundaries across all devices, systems, and platforms
Is built for a ‘perimeter-less’ ecosystem
Is designed for zero trust architecture and the use of shadow IT
Is low cost and flexible
Doesn’t impose unwieldy security barriers or restrictions but rather has been created to provide protection however and wherever staff are working
Protects against all external threats including ransomware (which most data loss prevention solutions don’t)
Has the ability to block ‘zero-day’ threats (an attack that exploits a security vulnerability which a developer has zero days to fix) before a business has even identified that such a threat exists
Stops all attempts to write known and unknown malware onto the permanent storage of any device
Doesn’t require a big (and often expensive) effort setting up blocking rules or ongoing costly maintenance
Doesn’t cause any performance issues and has no impact on a device’s RAM or CPU
Is a real-time low maintenance ‘fit and forget’ solution that blocks 100% of unauthorised attempts to modify a business’s IT systems
An Innovative Solution
H2 Cyber Risk Advisory Services has developed a low cost managed cyber security solution for SMEs that is designed specifically for hybrid working and 360o perimeter-less protection.
360o Real Time Work Anywhere Cyber Protection fuses industry leading cross platform data discovery functionality with robust and innovative data flow monitoring capabilities so that you’ll know where every one of your files and all of your data is and how to protect it.
It provides both valuable insight and protection to stop you becoming the next victim of cybercrime.
Insight
The system analyses your cyber-attack vulnerabilities and risks factoring in every device connected on your network.
It quantifies the threats against your organisation’s particular appetite or tolerance for risk.
It prioritises responses based on factors important to your business and monitors the effects of your actions.
It provides clear actionable insight including security recommendations such as security patches, updates, or workarounds.
Protection
Advanced shield technology that provides a ‘one time’ fit security solution that prevents against malware, ransomware, zero-day attacks, and all other cyber threats, known and unknown.
Shield technology does not use signatures so there is no need for constant updates to add newly discovered threats and no risk of becoming a zero-day victim.
The system proactively scans workstations, laptops, and other devices for sensitive data using smart patterning, and assigns a financial value to the risks you’re exposed to.
It tracks and audits data risk in real time by continually monitoring incoming and outgoing sensitive data flows to and from your perimeter-less organisation.
It uses a patented encryption process to automatically secure sensitive data across all endpoints, Cloud apps, third party portals, and shadow IT. The entire process from initial deployment through to data risk analysis and remediation by automatic encryption takes as little as 72 hours.
Benefits
H2’s 360o Real Time Work Anywhere Cyber Protection provides the following benefits:
Perimeter-less cyber protection for wherever you or your staff are working – at home, in a coffee shop, at an airport, or anywhere else
Ideal for remote and hybrid workers
Real time 24-hour protection inside and outside of the Cloud
Protects your network, your devices, and your information
Enterprise grade shield technology specifically developed for the growing number of SMEs being targeted by hackers and cyber criminals
360o protection against data breaches and cyber-attacks and scams
Simple subscription-based per month pricing – pay for just what you need and cancel anytime with 30 days notice
Ask yourself, do you know with absolute certainty where your data is? Are you sure that an employee hasn’t downloaded a piece of sensitive data onto their laptop or desktop at home to work on, before uploading it again? Have they forgotten to remove the copy they have on their machine, resulting in there now being two copies of the sensitive data, one sitting outside of your security boundary or outside of your Cloud systems? Or have they used a shadow IT tool, such as WhatsApp or some other communication system, to share the data outside of your network?
Ask about our free no-obligation trial to see how H2’s 360o Real Time Work Anywhere Cyber Protection can protect your business however and wherever your staff are working.
The Experts in Cyber Protection
H2 Cyber Risk Advisory Services was founded by industry leading experts in cyber protection who previously worked for a number of Fortune 500 companies, national governments, and leading technology companies including Symantec, Hewlett-Packard (HP), and BAE Systems.
Their experience in the security sector goes back to the late 1980s and includes designing the first security operations centre for the Foreign and Commonwealth Office (FCO), as well as leading security projects for the Ministry of Defence (MOD) and the Passport Office.
H2 was established in 2016 to provide the same quality of cyber and data protection to mid-market businesses and SMEs in the UK.
What else can H2 do for you?
As well as providing 360o Real Time Work Anywhere Cyber Protection, H2 provides the following services, each of which can be bundled into a comprehensive managed service:
Managed Cyber Security Officer – dedicated remote cyber security expert who proactively monitors your systems and cyber threats to your business, offered on a number of hours a month basis to suit the client
Innovative anti-malware solutions – these protect against malware threats and ransomware attacks
Patch management across your entire network
Cyber maturity assessments – examines and analyses all aspects of your cyber security stance, including policies and processes
Cyber Awareness Training for your staff – aimed at IT users and non-technical staff, and offered on-line as well as face to face
Cyber Essentials and Cyber Essentials + certification
You’ll have to forgive me for a somewhat provocative title and allow me some poetic licence, because in fact, different hacking groups do things differently, although they have much in common. Personally, I don’t like the term hacker, much preferring cybercriminal, because anyone who accesses a system without the owners’ permission, is by definition, a criminal. But I suppose hacker is less of a mouthful.
So, what is hacking? Hacking involves exploiting vulnerabilities in systems, software, or networks to gain unauthorised access or manipulate data using a variety of techniques and methods, which tend to combine technical tactics and social engineering.
One of the first things a hacker, or criminal group, will do, is to profile your organisation and your people. Favourite open sources of information include:
Social media: Information about hobbies, job roles, family, and schedules shared on platforms like LinkedIn, Facebook, and Instagram. Do you have a social media policy in your company? Do you lay down what an employee can and cannot say about your company on their personal social media pages? Do you have a designated person in the company who handles your company’s profile on social media?
Company Website: You’ll want to give prospective clients contact information of course, but you should not give out individual email addresses and limit profiles published. I do give my personal profile on my website but don’t give information about any other position, leaving it to a generic phone number and email address.
Professional Profiles: LinkedIn is a favourite for targeting businesses, as it provides details about an individual’s role, connections, and organisational structure.
Personal Websites or Blogs: These may reveal contact details, interests, or sensitive information inadvertently. The same issues that appertain to social media apply here.
Data Brokers: Cybercriminals can purchase detailed dossiers on individuals from data aggregator sites.
Another favourite is phishing and pretexting.
Phishing Emails: We all know, or at least I hope we know, what phishing is. Attackers send emails designed to extract more information, such as login credentials, by posing as a trusted entity. In this context, it could be as simple as the attacker wanting to verify information by perhaps sending an email to a discovered address but wanting to confirm that individuals position in the company. That just requires a response showing a signature block, so the phishing email might seem very innocuous.
Fake Surveys or Job Offers: These can be used to obtain detailed personal or professional data.
There are a variety of reconnaissance tools used by attackers, including open-source intelligence (OSINT) tools, WHOIS lookups and scanning misconfigured systems using commercially available tools such as Nmap and Nessus, which identify open ports, services and weak configurations. This is why it’s essential to regularly scan your network for these weaknesses. Ports can be opened for a particular reason and never closed again. It’s a common fault.
Here at H2 we scan the dark web daily looking for leaked credentials, particularly email credentials. When we on board a new client we nearly always get hits with sometimes up to 20+ compromised email addresses including passwords. You might ask why they’d be on the dark web – simple, they are often up for sale on dark web marketplaces.
In terms of cybercrime, who’s heard of psychological profiling? Cybercriminals analyse:
Behavioural Patterns: Regularity in actions, such as times a person is online, financial habits, or common purchases.
Weaknesses and Triggers: Examples include a recent job loss, major life changes, or emotional vulnerabilities, which they exploit through spear-phishing or scams.
I’ve often argued on these pages, that your employees are both your first line of defence and your greatest weakness, and that a good cyber awareness programme is worth its weight in gold. Cybercriminals often focus on employees in specific departments (like HR, finance, or IT).
LinkedIn and Organization Charts: Identify individuals with access to sensitive data.
Impersonation: Pretending to be a senior executive to trick lower-level employees (e.g., through Business Email Compromise attacks – I’ve written about the CEO scam a lot).
Technical Probing: Use of phishing or malware to breach a target’s employer.
In conclusion, what I’ve tried to do here is give you a flavour of what you may be up against, and I hope, I’ve shown you that for all the reasons shown above technology comes last after people and process. All the tech in the world won’t prevent issues arising from the above and is just one part of an integrated defence in depth required to prevent disaster.
This is a subject that, at one time, was pretty much confined to the larger enterprise organisations but largely because of the pandemic, it is gaining popularity within SMEs and is now getting a lot of attention from the National Cyber Security Centre.
So, what is it? Well the idea was to allow employees to use their own devices for work purposes. The thinking was that in this day and age, many employees have developed preferences for what they use. So whilst many will stick to Microsoft, others may prefer an Android or Apple tablet, whilst others still may prefer a MacBook or Chromebook. There’s a wide choice these days.
But what do we mean by work purposes? It can mean anything from accessing your emails, which most of us do on our phones, to accessing critical services and applications. And this makes it a potentially complex issue.
The pandemic brought with it many issues that needed swift resolutions and now, it’s not uncommon to visit companies that have allowed their staff to continue to work from home often because the cost savings in office accommodation are very beneficial, and some have allowed staff to use their own preferred devices when working, including connecting to the company network and/or cloud services, remotely.
For just about all SMEs, this has started from a position of necessity. But like many such events, if it seems to be working, it rapidly becomes the norm and in creeps a complacency that it’s actually all OK.
BYOD solutions need to be planned and thought through. And pretty much the same as most things, particularly risk based assessments, what you need to do really depends on your organisation. You need to ask some questions:
Is there anything that needs to be done from the office that cannot be done by home workers?
Are there functions which employees need to do, that requires the company to have visibility and management of, and is there anything that doesn’t?
What do my employees need to do?
How can we balance what employees do that also involves your need to protect data and their privacy (DPA2018)? They are after all, using their own device.
Above all you need a well thought through and comprehensive strategy, which, while offering flexibility and potential cost savings, recognises and deals with several security implications that organisations must address to ensure sensitive data and systems remain secure. Below are the key concerns:
a. Data Security
Data Leakage: Employees’ personal devices may lack adequate protections, increasing the risk of unauthorised access or accidental data leaks.
Loss or Theft of Devices: Personal devices may not have encryption enabled, making sensitive corporate data vulnerable if the device is lost or stolen.
Uncontrolled Sharing: Employees might unknowingly share corporate data via apps or cloud services outside the organisation’s control.
b. Malware and Cyber Threats
Insecure Devices: Personal devices might not have up-to-date antivirus software, firewalls, or operating system patches, making them susceptible to malware or ransomware attacks.
Unverified Applications: Employees may install unauthorised or malicious applications that could compromise corporate networks.
c. Network Security
Untrusted Connections: BYOD devices may connect to public Wi-Fi networks, exposing them to man-in-the-middle (MITM) attacks that could jeopardise corporate data.
Device Spoofing: An attacker could mimic a BYOD device to gain unauthorised access to the network.
d. Compliance Risks
Regulatory Violations: BYOD policies may lead to data handling practices that violate regulations like GDPR or PCI DSS if personal devices aren’t properly managed.
Audit Challenges: Tracking and demonstrating compliance can become difficult with non-standardised, user-managed devices.
e. Access Control
Weak Authentication: Personal devices may not support strong authentication mechanisms, increasing the risk of unauthorised access.
Lack of Segmentation: Employees’ devices may access both corporate and personal systems, creating potential crossover risks.
f. Insufficient Visibility
Limited Monitoring: Organisations may lack full visibility into personal devices, making it harder to detect breaches or policy violations.
Shadow IT: Employees might use unauthorised apps or services that bypass official security controls.
g. Employee Turnover
Data Retention: When an employee leaves, ensuring the removal of corporate data from their personal devices can be challenging.
Device Ownership: Legal and practical issues might arise when attempting to enforce data wiping on personal devices.
Mitigation Strategies
To address these risks, organisations adopting BYOD should:
Implement Mobile Device Management (MDM) or Endpoint Detection and Response (EDR) solutions.
Enforce strong authentication, such as multi-factor authentication (MFA).
Require device encryption and ensure compliance through regular checks.
Use some form of file separation to ensure separate corporate data from personal data.
Deploy a zero-trust security model with conditional access controls.
Establish clear policies and training to educate employees on BYOD security best practices.
By proactively addressing these risks, organisations can leverage the benefits of BYOD while maintaining robust security.
This is a subject that I tend to jump on every so often, because it’s one that people just don’t seem to get. Whether it’s working from home, from a coffee shop, airport, railway station etc, there is this perception that it’s safe because you’re connected via VPN, or perhaps some other form of application which encrypts data in transit. Well, let’s explore this subject a bit further.
There is no doubt that the propensity for working from home, or other remote locations, since COVID has introduced some very difficult, or at least challenging, security vulnerabilities into your network. For instance, prior to the pandemic, when you were 100% office based (except perhaps some mobile salespeople), your local IT provider will have almost certainly set up what we called the bastion security model. Ie, like a castle, a bastion, you had a wall around you, and for belt and braces, you also had a moat. The gateway was robust, had a drawbridge and portcullis, or let’s call it a secure firewall and anti-malware system. Everything was locked up inside and nice and secure (in fact it probably wasn’t but that’s for another day).
Whilst Microsoft didn’t invent the term the ‘new normal’, they were the first, I believe, to apply it to IT, following the enforced change in working practices brought about by the pandemic. Many companies have embraced this new normal and have settled into some form of hybrid working. Of course, this is nothing new, it’s been ‘a thing’ for years now, certainly regarding corporate organisations. The real change came about in SMEs for whom it really was quite revolutionary. Corporate bodies will have spent a lot of money on a variety or remote access systems to keep their data secure, whilst SMEs not only had to rush unprepared because of the pandemic, but they simply didn’t have the budget to employ more secure connections.
What the pandemic has done is change that, or perhaps arguably, accelerated the change to a more distributed way of working, already underway in corporate organisations but now common amongst SMEs. What does that mean for us? Firstly, we have to re-think how we are going to work. We start from a position where we still have preexisting tech, such as VPNs and whole disk encryption, to tackle modern and evolving issues.
So, what about VPNs? What are they? A VPN, or Virtual Private Network, is a service that creates a secure, encrypted connection between your device and the internet. This private “tunnel” protects your data and hides your IP address, effectively masking your online identity and activity. It works by allowing you to connect to the internet via an encrypted tunnel to a VPN server, which then forwards your requests to the website or service you’re accessing. The benefits are that it protects your data from being accessed by hackers or eavesdroppers, especially on public WIFI. It masks your IP address and replaces it with one from the VPN server, so it’s harder for websites, advertisers, or even your ISP (Internet Service Provider) to track your online activity. It’s particularly useful when working from insecure public WIFI but should also be used when working from home.
VPNs are available as standalone apps and more often now, incorporated into other applications, particularly those used to connect to cloud services.
All good, right? Well yes, anything that helps secure your data is a good thing. But like all good things it has some downsides. A VPN does help protect data in transit over an insecure WIFI connection by encrypting the data you send and receive over the internet. This means that if you’re connected to an insecure WIFI network (like in a coffee shop or airport), the VPN will prevent anyone from intercepting and reading your internet traffic.
However, a VPN does not protect data stored locally on your laptop. Files or personal information saved directly on your hard drive are not protected by the VPN. To secure the data on your laptop, you may want to consider using additional protections such as some sort of full disk encryption (BitLocker for Windows or FileVault for macOS are standard with the operating systems) to protect data at rest. And you should be using strong passwords and multi-factor authentication.
So, what I’m saying here is that should someone manage to gain access to your end point ie your laptop, desktop, even your phone, then your VPN is not going to protect you.
Let’s now talk a bit more about Bitlocker and FileVault. BitLocker, Microsoft’s disk encryption tool, provides robust security when configured properly (but I make the point here that it’s often not only incorrectly configured but isn’t even in use, making it pointless). And, like all encryption systems, its security depends on several factors, including the version of BitLocker, implementation practices, and potential vulnerabilities in the system environment. Bitlocker uses strong encryption, either AES 128 or 256 Bit, both of which are considered secure.
FileVault is the MacOS equivalent of Bitlocker (roughly) and is considered secure and built into the MacOS and is very easy to switch on. It too offers full disk encryption using AES 128 or 256 Bit. Once again though it is often not in use by Mac users, many of whom don’t even know it exists.
Are there any drawbacks to whole disk encryption? Will it protect me against things like ransomware? Whole disk encryption is designed to secure data at rest by preventing unauthorised access to data on a physical storage device (e.g., in case the device is lost or stolen). The problem is that once the machine is booted up, using the correct authentication, the disk is unencrypted, allowing you access to the data. So, the answer to the specific question re ransomware is that such an attack is typically not mitigated by this kind of encryption because:
Ransomware Operates at the OS Level: Once a device is booted up and the encrypted disk is unlocked (usually via user login), ransomware can interact with files just like any other software. Since the operating system has access to the data, the ransomware does as well.
Ransomware Encrypts Data Independently: Ransomware generally works by encrypting the contents of individual files or directories (not the entire disk), effectively “locking” them within the already-decrypted environment. BitLocker, or any full disk encryption, won’t stop ransomware from doing this, as it doesn’t interfere with file operations once the system is unlocked.
No Version Control or Rollback: Whole disk encryption solutions don’t provide a way to revert to previous file versions or recover from ransomware encryption. This is where regular backups (stored separately from the network) play a critical role in protecting against ransomware.
You’re being careful, you have a VPN, and you have Bitlocker configured on your laptop. You’re feeling nice and secure and have no issues using the local Coffee Shop or your home WIFI. Your connection to your cloud service is secure and all your data in transit is encrypted. Even your email is going via a secure tunnel. All is good with the world. Except of course that as soon as you logged on your whole disk encryption is switched off and your data is vulnerable even before you transmit it. Any data you download to work on likewise becomes vulnerable as soon as it lands on your laptop.
Earlier I argued that VPNs were old tech being used to combat modern threats and a different way of working. Does that mean that I think the VPN is no longer useful and is going out of style. No of course not, VPNs have a very real place in our security architectures and that won’t go away anytime soon. But they, like the vulnerabilities they are trying to mitigate, have to evolve and keep pace with present day and future realities.
VPNs, whether stand alone, or incorporated into another technology are great at securing data in transit. What about your data at rest? The best VPN in the world won’t protect you from someone who is determined to get in and steal your data or install ransomware. The problem for SMEs is the same that it pretty much always has been. Cost. Can they afford a system that will protect their data and stop it being lost, stolen or ransomed.
What has long been needed is a simple, flexible and intuitive security solution. We believe we have found such a system that protects your company against all known threats, and puts you firmly in control of your data, working automatically 24/7 to identify and safeguard your sensitive information.
Delivering multi-level protection, it provides real time control over all sensitive data. You can identify and solve every problem with a single click of your mouse! Instead of whole disk encryption, which is decrypted as soon as you log on, it provides file level encryption which allows authorised users access but no one else. But it does more, it locates all your data, allows you to decide what is, and what is not, sensitive, and provides subscription pricing for a fully managed solution.
It’s a system that is designed specifically for SMEs and is therefore appropriate to you, and affordable. To prove that we offer a 30-day free trial so that you can see it for yourself. Check it out at https://hah2.co.uk/gdpr-data-protection/.
There’s a lot of FUD (fear, uncertainty and doubt), going around about Ransomware, and it has to be said that a lot of it comes from cyber security companies. But amongst the rocks there are some very real diamonds that need the publicity. There is a very real difference between genuine information and propaganda. I hope what I do is spread information.
There is a prevailing feeling amongst small and medium-sized enterprises (SMEs) that they are not a desirable target for Ransomware and it’s therefore not a problem for them. However, that’s simply not true and they are increasingly vulnerable to ransomware attacks, with recent trends showing a notable rise in these incidents among smaller businesses. Several factors influence the likelihood of SMEs being targeted:
Widespread Targeting: SMEs are often viewed as “soft targets” because they may lack the advanced cybersecurity defences of larger corporations. Attackers assume that smaller businesses may have fewer resources dedicated to security, making them easier to compromise.
Increasing Ransomware Attacks Overall: Ransomware attacks globally have been on the rise, and attackers have shifted their focus to include not only large enterprises but also smaller organisations across various sectors. This is often due to the lower cost of launching ransomware campaigns, allowing attackers to spread wide nets with mass phishing campaigns and automated attacks.
Financial and Operational Impact: Many SMEs are attractive to attackers because the disruption from ransomware can be financially devastating for them. SMEs may feel greater pressure to pay the ransom to restore operations quickly, fearing the loss of business or reputation if the downtime persists.
Underinvestment in Cybersecurity: SMEs often underinvest in cybersecurity due to budget constraints, lack of expertise, or other business priorities. This underinvestment can lead to outdated software, limited employee training on cybersecurity best practices, and weaker defences that attackers can exploit.
Likelihood and Statistics
High Likelihood: Studies show that more than half of SMEs have experienced a cyberattack in the last year, with ransomware being one of the most common types of attack.
Small Business Victimisation: According to a 2022 survey by the Cyber Readiness Institute, nearly 60% of small businesses were targeted by cyberattacks, and a significant portion of these involved ransomware.
Increasing Cost: For many SMEs, the average cost of a ransomware attack, including downtime, lost revenue, and recovery expenses, can be as high as £50 to a £100K, making the financial impact severe and sometimes unmanageable without external assistance.
Key Risk Factors for SMEs
Lack of Security Awareness and Training: Employees at SMEs may be less well trained on cybersecurity threats, increasing the risk of phishing and social engineering attacks that lead to ransomware.
Lack of Backup and Recovery Plans: SMEs may not have effective data backup or disaster recovery strategies, making them more susceptible to extended downtime or paying the ransom.
Weak Network and Endpoint Security: Limited resources often mean that SMEs may not have enterprise-grade firewalls, intrusion detection, or antivirus solutions, leaving systems exposed to exploitation. They also struggle with the distributed work practice (office, home etc) that has happened since COVID.
Encryption: Data is often unencrypted on end point machines.
Reducing the Risk
While the risk is high, SMEs can take measures to reduce the likelihood and impact of a ransomware attack:
Implementing Regular Backups: Ensuring data backups are frequent, secured, and tested for restoration can significantly reduce the impact of an attack.
Employee Training: Conducting regular training to recognize phishing and social engineering can help employees avoid common attack vectors.
Monitoring: No or inadequate monitoring of their data and systems, including home and other remote workers.
Endpoint and Network Security: Investing in antivirus software, firewalls, and network monitoring can improve defences.
Cyber Insurance: Purchasing cyber insurance can help mitigate financial losses associated with an attack.
Data encryption.
In summary, while SMEs face a high likelihood of ransomware attacks, increasing awareness, preparation, and proactive defence measures can substantially reduce both the risk and the impact of an attack.
What is the impact of a Ransomware Attack?
Ransomware can have devastating effects on small and medium-sized enterprises (SMEs). Here are some of the key impacts:
Financial Losses
Ransom Payment: If SMEs decide to pay the ransom (which is not generally recommended), this can result in significant, sometimes crippling, costs.
Operational Downtime: Even if no ransom is paid, businesses often experience significant downtime as they attempt to recover systems, which can halt revenue generation and lead to lost sales.
Recovery Costs: In addition to the ransom, SMEs incur expenses related to data recovery, IT support, and forensic investigation. Often, additional security solutions are needed to prevent future attacks.
Loss of Data
Data Encryption or Destruction: Ransomware can lead to the permanent loss of critical data if files are corrupted or remain encrypted after an attack.
Loss of Sensitive Information: SMEs may lose access to sensitive customer or business data, leading to gaps in operational records or strategic plans.
Reputational Damage
Loss of Customer Trust: Ransomware attacks, especially if customer data is exposed or operations are disrupted, can damage customer confidence. Many SMEs rely on personal relationships, and a ransomware incident can harm these relationships.
Brand Damage: Businesses often struggle to rebuild trust, and reputation damage may deter new clients and weaken partnerships with vendors or other business partners.
Legal and Regulatory Consequences
Compliance Violations: If SMEs operate in regulated sectors (like finance, healthcare, or legal services), a data breach can lead to violations of regulations like GDPR, resulting in fines and other penalties.
Legal Liabilities: Affected customers or vendors may pursue legal action if sensitive data is compromised, adding further financial strain.
Operational Disruptions
Halting of Services: For many SMEs, especially those without a strong IT infrastructure, ransomware can paralyse day-to-day operations.
Long Recovery Times: SMEs often lack the same level of IT resources as larger enterprises, so restoring full operational capacity after an attack can take weeks or months.
Employee Productivity and Morale
Reduced Productivity: During and after a ransomware attack, employees may be unable to work if they lack access to necessary files, email, or software.
Psychological Impact: The stress and uncertainty from a cyberattack can lead to anxiety or frustration among employees, potentially impacting morale and retention.
Increased Insurance Costs
Higher Cyber Insurance Premiums: Cyber insurance costs tend to increase significantly for companies that have experienced ransomware attacks. Additionally, insurers may demand proof of enhanced security measures to continue providing coverage.
Pressure to Strengthen Cybersecurity Measures
Increased Security Costs: Post-incident, SMEs often must invest in more robust cybersecurity infrastructure, including advanced threat detection, backup solutions, and employee training.
Ongoing Monitoring Needs: Ransomware may prompt SMEs to adopt more rigorous monitoring and endpoint protection tools, leading to continuous IT spending.
Ransomware attacks can be particularly harmful to SMEs because they often have fewer resources for cybersecurity, and a single attack can have a prolonged impact. Many SMEs lack a full-time IT staff or robust data backup protocols, which can compound the impact. Consequently, proactive measures, such as employee training, regular data backups, and up-to-date cybersecurity defences, are critical to reducing the likelihood and impact of ransomware attacks on SMEs.
I wrote a post earlier this week exploring what SME owners and directors really care about when it comes to cyber security! Do they really care about the how the latest technological solutions work? Do they really care about the scare stories, or at least, do they really think that they apply to them. Oh, they might have a sneaky suspicion that it could be a problem but is it on their mind enough for them to do something about it.
The argument was made that this is especially true in an economic downturn when they are focused on costs, even more than they normally are. They want robust cyber security solutions that don’t cost an arm and a leg. And what they don’t want is jargon and tech speak that they feel is aimed at bamboozling them with science in order to convince them they should buy something that they don’t actually need.
We are believers that what is needed is simplicity. SMEs are looking for user-friendly security measures that don’t require a PhD in Cyber Science. They don’t want jargon or even industry metrics. Remember the KISS principle – Keep It Simple Stupid.
Of course they are going to have a focus, and you need to understand what is important to them and what isn’t. That will depend on the nature of their business to a great extent. Whilst there are commonalities regardless of the vertical they work in, there will always be differences, some big, some more subtle, that will impact any cyber security solutioning.
Nowadays many SMEs are increasingly aware of cybersecurity risks, but a significant number still underestimate the importance of cybersecurity risk management. SMEs often face unique challenges in this area due to limited resources, competing priorities, and often a lack of expertise not just in their organisation but also in the IT support company’s they use. Here are some insights into the current landscape:
Growing Awareness: SMEs have started to recognise that they are just as likely to be targeted by cyber threats as larger companies, partly due to high-profile ransomware attacks and data breaches affecting businesses of all sizes. As a result, awareness is rising, especially as more businesses transition to digital platforms and remote work, which increases exposure to cyber risks.
Resource Constraints: For many SMEs, the cost of robust cybersecurity measures can be prohibitive. They often lack dedicated IT and cybersecurity teams, which makes it challenging to implement and maintain comprehensive security protocols. Cybersecurity solutions can be expensive, so SMEs may prioritise short-term operational needs over what they might perceive as longer-term security investments.
Risk Perception and Underestimation: Some SMEs mistakenly believe they are too small to be targeted by cybercriminals, assuming that attackers primarily focus on large corporations. However, this “security by obscurity” mindset has been proven false, as attackers often view SMEs as easier targets due to their weaker defences.
Impact of a Breach on SMEs: Unlike larger companies, SMEs are less likely to recover from a significant cyber incident. A data breach or ransomware attack can be devastating, leading to financial losses, reputational damage, and even closure. Despite this, many SMEs may not fully understand the potential scale of these consequences.
Compliance and Regulatory Pressure: With increasing data protection regulations (e.g., GDPR, PCI), SMEs are under more pressure to adopt better cybersecurity practices to remain compliant. This has led to greater awareness among some SMEs, especially those handling sensitive data like healthcare, finance, or customer and payment information.
Cybersecurity Awareness Training and Culture: Even when SMEs implement some cybersecurity measures, they may lack the necessary employee training and risk management practices that foster a security-focused culture. Human error remains a leading cause of data breaches, so SMEs need to prioritize employee awareness and training.
In summary, while awareness of cybersecurity risk management is growing among SMEs, gaps remain, particularly around adequate investment, robust risk perception, and ongoing management of cybersecurity threats. Cybersecurity can seem overwhelming for small businesses, but as the digital landscape continues to evolve, understanding and addressing these risks is becoming essential for SME survival and growth.
I’ve talked about protective monitoring in the past but there is still some misperceptions about it, particularly amongst SMEs. Probably first and foremost is that it is way too expensive, which leads to thinking that it’s not for them and is much more of a nice to have than a necessity. I thought I’d take a bit of a deeper dive into this.
So, what is it?
Protective monitoring in cyber defence is a systematic approach to continuously observing and analysing an organisation’s digital environment to detect, prevent, and respond to security threats. It involves gathering and analysing data about network traffic, system activity, and user behaviours to identify potential vulnerabilities or malicious activities. Here’s a breakdown of its key components and purposes:
For a small or medium-sized enterprise (SME), implementing cyber protective monitoring is crucial for a variety of reasons. This proactive approach can be the difference between quickly identifying and mitigating threats or facing significant damage from a cyber-attack. Here are key reasons why SMEs should consider cyber protective monitoring:
1. Protection Against Data Breaches
SMEs often hold sensitive data like customer information, financial records, and intellectual property. Companies like law firms, financial advisors and estate agents, will hold years worth of personal identifiable information as defined by the Data Protection Act, or UK GDPR if you prefer. Protective monitoring helps identify unusual activity within their network, such as unauthorised access or data exfiltration attempts, allowing for swift action to prevent breaches.
This is especially important as SMEs can be perceived as easier targets by cybercriminals compared to larger enterprises with more robust defences.
2. Regulatory Compliance
Many industries have strict regulations around data privacy and cybersecurity, such as GDPR and PCI-DSS. Protective monitoring helps SMEs stay compliant by providing visibility into how data is accessed, used, and secured.
It allows them to maintain audit trails of activity, which are often required to prove compliance during an audit or investigation.
3. Early Threat Detection
Cyber threats are constantly evolving, and attackers are often inside a network for days or weeks before launching an attack (such as ransomware). Protective monitoring enables the detection of anomalous behaviour that could indicate a security threat before it becomes critical.
This helps minimise damage by enabling a faster response to potential threats like malware infections, unauthorized access, or network vulnerabilities.
4. Cost-Effectiveness in the Long Run
While some SMEs may view cyber protective monitoring as an additional cost, it is often more cost-effective than dealing with the fallout of a cyber-attack. The financial impact of a breach includes legal fees, loss of business, damage to reputation, and potential fines from regulatory bodies.
By investing in monitoring, SMEs can save significantly on these potential costs, making it a smart investment, especially now that there are systems specifically designed and costed for SMEs.
5. Building Trust with Clients and Partners
Customers and business partners expect their data to be handled securely. An SME with strong cybersecurity practices, including protective monitoring, can build trust and demonstrate its commitment to data security.
This can serve as a competitive advantage, especially when dealing with larger enterprises or industries that prioritise security.
6. Rapid Incident Response
When a security incident occurs, the speed of the response is critical. Cyber protective monitoring provides real-time alerts when suspicious activities are detected, enabling SMEs to quickly isolate affected systems and take necessary actions.
A rapid response can help contain potential damage, maintain business continuity, and limit operational disruptions.
7. Mitigating Insider Threats
Not all cybersecurity risks come from outside the organisation. Insider threats, whether malicious or accidental, can cause significant damage. Protective monitoring can help detect unusual behaviour from employees or contractors, such as unauthorised access to sensitive data or suspicious data transfers.
This allows SMEs to address these issues before they lead to data leaks or other security incidents.
8. Scalability and Adaptability
As SMEs grow, their digital footprint and potential vulnerabilities expand as well. Cyber protective monitoring solutions can scale alongside the business, ensuring that security measures remain effective even as new systems, networks, and applications are added.
This adaptability makes it easier for SMEs to adjust their cybersecurity strategy as their needs change, without a complete overhaul of their security infrastructure.
9. Insights for Better Decision-Making
Beyond just identifying threats, protective monitoring can provide valuable insights into network usage and performance. SMEs can leverage this data to make better strategic decisions regarding their IT infrastructure, such as identifying redundant systems or optimising network resources.
It can also highlight areas that require further security investments, helping prioritise spending on cybersecurity.
10. Improving Overall Cybersecurity Posture
Cyber protective monitoring is a key part of a broader cybersecurity strategy. By continuously monitoring and analysing network activities, SMEs can better understand their vulnerabilities and areas for improvement.
This helps create a culture of security within the organisation, where cybersecurity is not just an afterthought but an ongoing priority.
Overall, cyber protective monitoring provides visibility, control, and peace of mind for SMEs, helping them navigate the complex and ever-changing landscape of cyber threats. By taking a proactive stance, they can protect their assets, maintain customer trust, and ensure long-term resilience against cyber-attacks.
Protective monitoring is not just for corporate organisations, but is for everyone, especially now that there are systems and services designed especially for SMEs and priced accordingly. Don’t leave it until it’s too late. Playing catch up and fixing problems after the event, is always much more expensive that taking a pro-active stance.
To learn more about the protective monitoring managed solutions we provide please click here https://www.hah2.co.uk/
Did you know that October is Cybersecurity Awareness Month? No – not terribly surprised after the poll we put out asking how important this subject was. The response was truly frightening. Cybersecurity Awareness month has participants in many countries and sponsored by many governments and tries to push awareness of the importance of this subject, across all industries.
Why do we think it’s so important? Why would an SME bother with it? Well, in short, it’s probably the single most cost effective and quickest win you can make. It really doesn’t have to cost a fortune, it’s not techie if done right, is educational and it beefs up your security by ensuring your staff can spot a scam when they see one, can recognise social engineering and how to counter it, won’t open a rogue email and it generally keeps the subject in the forefront of minds.
OK, but what’s the threat? Do hackers/scammers prey on SMEs? Is there sufficient financial reward there for them? Yes, yes and again yes. The UK GDP is made up of north of 90% from SMEs. Just think about that – 90% of the countries wealth is generated by SMEs, so a huge financial target. The big companies spend a fortune on cyber security protections. Most spend up to 15% of their annual IT budget on security and when you think that the IT budget often runs into millions, that’s big bucks. SMEs can’t afford that and that makes them a much easier target.
I wrote a blog recently about the findings of the 2024 cyber security breaches survey. The report tells us that among businesses, there has been a shift in the proportion saying cyber security is a “fairly” high priority (e.g. from 35% of businesses last year, to 40% this year). The proportions of businesses saying it is a very high priority is consistent with last year (36% last year and 35% this year). In 2023, as evidenced by the qualitative interviews, it was felt that cyber security had moved down the agenda among the businesses where it was already seen as a more marginal priority, and among businesses that typically have the fewest resources to deploy. The qualitative findings this year point towards an increased awareness of the risks that are faced when not prioritising cyber security, which could explain the increase in businesses this year rating it as a high priority.
It is more common for larger businesses to say that cyber security is a high priority (93% of medium businesses and 98% of large businesses, vs. 75% overall). The same is true for high-income charities (93% of those with income of £500,000 or more, vs. 63% overall). This continues the pattern seen since 2020, where larger organisations tend to treat cyber security more seriously, and consequently allocate more resources to it.
Businesses in the following sectors tend to treat cyber security as a higher priority than others:
information and communications (65% a “very” high priority)
finance and insurance (61% say it is a “very” high priority)
health, social care and social work (62% a “very” high priority).
These percentages are still very low and amongst this, if we drill down, we will find that the prevailing answer amongst SMEs remains to reach for technology for protection. Technology will help, but it isn’t the full answer. When faced with constraints such as a tight budget it’s essential that a business prioritises its spend, making sure that it is targeting what really needs protection, and making sure that the protections in place are actually doing what you think they’re doing. That is essentially what we refer to in regard to risk management. It’s a business issue, not an IT issue.
In the 2024 survey, half of businesses and around a third of charities report having experienced some kind of cyber security breach or attack in the last 12 months. As in previous years, larger businesses and charities are more likely to identify breaches or attacks than smaller ones. This latter point is worth mentioning because it’s generally only the larger businesses that have some kind of monitoring in place to identify an attack and many smaller businesses only find out when they start losing money.
Of course, good old COVID has had its effect, and I know we still bang on about it but that’s because its effect is long term. It has changed our working practices in many respects although there is more of a move towards a return to the workplace currently, but some businesses have embraced the hybrid working practice and look unlikely to change. My own client base has only seen one client move to 100% remote working, but they are all working some form of hybrid working pattern.
Many corporates have had some form of hybrid working for a long time, pre-COVID. When I was at HP and before that in Symantec, we worked the hot desk system with people working remotely a couple of days a week. It’s not new at that level but it is at the SME level, and we need more sophisticated ways of protecting ourselves at a price we can afford. And that’s been the focus for us, and we are now confident that we have solutions that fit an SMEs requirement, at a price they can afford.
Cyber resilience can mean different things to different people, depending upon their priorities, their perception of cyber security and the business they are in. This means that there are a lot of misconceptions about what it means, and I’m sure I’ll get some disagreeing with what I write here. And that’s OK, because it really can depend on your situation as I’ve said above. Essentially though it refers to an organisation’s ability to prepare for, respond to, and recover from cyber incidents, ensuring that critical operations continue despite attacks, failures, or unexpected events. Unlike cybersecurity, which focuses mainly on preventing attacks, cyber resilience combines prevention with the capability to withstand and adapt to adverse conditions, even if breaches or disruptions occur.
It encompasses five main aspects:
Identify: Understanding what an attack or scam might look like.
Protection: Implementing strong security measures to prevent cyberattacks and minimise vulnerabilities.
Detection: Quickly identifying and recognising cyber threats or breaches when they occur.
Response: Reacting effectively to contain and mitigate the impact of a cyber incident.
Recovery: Restoring systems and data to normal functioning after an incident, while learning from the event to improve future preparedness.
A cyber-resilient organisation is not only prepared to handle potential attacks but is also structured to adapt, recover, and continue functioning in the face of disruptions. This approach ensures minimal downtime, data loss, and damage to reputation.
Now let’s look at some misconceptions around cyber resilience.
Complete Immunity from Cyber Attacks: Cyber resilience does not mean that an organisation will be entirely immune to cyber threats. Rather, it focuses on minimising the impact and ensuring continuity in the face of such events. No system can be entirely hack proof.
Just Having Strong Cybersecurity: While cybersecurity is a crucial part of cyber resilience, the latter encompasses more than just security measures like firewalls or anti-virus software. It also involves having an effective strategy encompassing sound policies and processes, incident response plans, business continuity plans, and recovery strategies. A purely preventive approach, without considering recovery, does not constitute true cyber resilience.
A One-Time Effort: Cyber resilience is not a one-time project or a static state. It requires continuous assessment, updating of policies, and adaptation to new threats. It’s an iterative process of improvement and adjustment to maintain resilience against evolving threats.
Quick and Easy Recovery: While resilience involves the ability to recover, it does not guarantee that recovery will be quick or without challenges. It means that recovery is possible, but it might still take time and effort to restore normal operations depending on the severity of the incident.
An IT Department’s Responsibility Alone: Cyber resilience is not just about technical solutions managed by the IT department. It involves a holistic approach, including organisational culture, employee training, risk management strategies, and coordination across different business functions. It’s an organisational-wide commitment. In a nutshell, it’s a business issue, not an IT issue.
Understanding what cyber resilience is not helps organisations better align their strategies towards truly being prepared for and able to recover from cyber incidents.
Don’t get bogged down in this though, don’t think it’s way too difficult and not really something that an SME for instance, can afford to do. It’s a matter of scale and there are some things that a corporate business will need to do, that an SME doesn’t need to do, or perhaps can scale down.
Help is at hand and if you want to talk this over then do please give me a call.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
Recent Comments