Last week, we wrote about managed detection and response, and how it benefits SMEs, at a price they can afford. In that article, we did use a scenario where there was an inadvertent data breach, but the article concentrated more on how breaches can be detected, rather than prevented. This week, we want to expand on how we can detect and prevent data leaks, and if they do sneak through, there is no such thing as 100% security, then how we can encrypt your most sensitive data so that any impact of a data breach is minimised.
Company profile
A small but growing haulage and cold store company that offers haulage of fresh produce from the grower to a cold store, and then onwards to the wholesaler. It services growers mostly in their local area, a radius of about 4 counties in all directions. This area covers a large agricultural sector which relies heavily on getting its produce to the wholesaler promptly, with minimal time in cold storage.
Phase 1: The Quiet Entry (Weeks 0–2)
An employee in the accounts team receives what looks like a legitimate email from a known software provider asking them to “re-authenticate” their account. The link leads to a convincing fake login page.
The employee unknowingly enters their credentials.
No alarms are triggered. The company does not have multi-factor authentication (MFA) enabled on this system.
Phase 2: Undetected Access (Weeks 2–8)
Using the stolen credentials, the attacker logs into the firm’s cloud-based CRM system. Because access controls are overly broad, the compromised account can view and export large volumes of client data.
The attacker:
- Gradually downloads customer records to avoid detection
- Accesses archived documents containing invoicing data and financial statements
- Sets up a forwarding rule in the employee’s email to monitor communications
There is no real-time monitoring or anomaly detection in place, so this activity goes unnoticed.
Phase 3: Data Exploitation (Weeks 6–10)
The stolen data is sold on the dark web. Some clients begin experiencing:
- Fraudulent loan applications in their name
- Unauthorised bank transactions
- Phishing attempts using highly personalised information
Still, the SME remains unaware.
Phase 4: The Discovery (Week 10)
A long-standing client contacts the firm after his accountant flags suspicious activity linked to financial activity, which the accountant deems suspicious.
He says:
“The fraudster replicated your invoice template but with different bank details. The invoice matched the activity between us which only we would know. How did they do that?”
Initially, the company assumes it’s an isolated incident. But within days, two more clients report similar issues.
Phase 5: Internal Panic & Investigation (Weeks 10–12)
The company initiates an internal review and brings in external cybersecurity consultants. They discover:
- Unusual login activity from foreign IP addresses
- Large volumes of data exports
- The compromised employee account is identified
At this point, leadership realises the breach has been ongoing for weeks, possibly months.
Potential Consequences
- Regulatory & Legal Impact
- Mandatory reporting to regulators (e.g., data protection authorities)
- Potential fines for failing to protect personal data (e.g., under GDPR-like frameworks)
- Investigations into inadequate security controls
- Lawsuits from affected clients
- Financial Losses
- Direct costs:
- Incident response and forensic investigations
- Legal fees
- Customer notification and credit monitoring services
- Indirect costs:
- Loss of business
- Increased Insurance Premiums
- Potential Compensation Payouts
Reputational Damage
- Loss of client trust, especially critical in ‘just in time’ delivery systems
- Negative media coverage
- Clients moving to competitors
- Difficulty acquiring new customers
- Operational Disruption
- Systems taken offline during the investigation
- Staff diverted from normal operations
- Implementation of urgent security upgrades
- Client Harm
- Identity theft
- Financial fraud
- Emotional distress and loss of confidence
- Internal Consequences
- Accountability questions for leadership
- Potential recruitments or restructuring
- Pressure to overhaul cybersecurity policies
- Long-Term Strategic Impact
- Shift from growth to damage control
- Mandatory compliance upgrades
- Board-level scrutiny of risk management
Key Underlying Failures
The breach wasn’t just bad luck; it stemmed from:
- Lack of multi-factor authentication
- Overly broad access permissions
- No monitoring or alerting for unusual activity
- Limited employee phishing awareness training
Summary Note
What makes this scenario particularly dangerous is that the company didn’t discover the breach itself; the client did. That delay significantly worsened the damage, turning what might have been a contained incident into a full-scale crisis.
How can this be prevented?
I have already said that there is no such thing as 100% security, and if anyone tells you otherwise, you need to take a long, hard look at them and recognise BS when you see it. What we are trying to do is reduce your risk to a level you find acceptable for your business. What we call the risk appetite. That appetite will differ between businesses depending upon what they do and what can damage them, rather than the business next door.
Most Data Loss Prevention (DLP) systems are designed for the corporate market, are expensive and have a considerable admin and maintenance overhead. All the things that SMEs simply can’t afford and don’t have the staff to run. We took a good look at this and did a lot of research on the market. We came up with a solution that works in terms of cost and overhead. It allows us to offer a managed service at a price and service level that SMEs are comfortable with.
One of the things that we come up against pretty much every time we get into discussions with a prospective client is that they aren’t quite sure what data they are holding, and where it’s stored. Now this seems strange. You will no doubt argue that you are very clear about what you hold and where it is. Well, maybe, but during the 14-day free trial we offer, I am pretty sure that we will discover things that will surprise you.
How are we different?
What we are offering is a unique, comprehensive, and autonomous data security platform that can transform how organisations secure their sensitive data. Unlike legacy DLP systems that are based on an event-driven approach and require extensive ongoing rules management built for LAN perimeters, our system is different. It is based on analysing data risks and applying pre-emptive encryption that handles both external threats and insider carelessness, all in a world of no security perimeters, providing full coverage no matter where your staff are operating from, the office, home or on the move. Moreover, our set-and-forget method requires little to no maintenance and can be up and running, securing data, in less than 3 working days.
Key principles
Perimeter-less world with hybrid cloud and on-prem usage
The local area networks and the notion of a security perimeter are no longer valid with the transition to hybrid cloud, work-from-home, and zero-trust architecture. In such a setup, sensitive files are spread across on-premise repositories (File Server, NAS) and different cloud-based repositories. These cloud-based repositories are divided between the ones that you manage (managed cloud, such as organisational OneDrive), shadow IT (such as communication apps like Slack or WhatsApp), and 3rd party portals. We provide an answer to this new data landscape with our cross-platform discovery functionality, coupled with the data flow monitoring capabilities.
Remediate Data Risk rather than handle files
We provide a detailed breakdown of the data risk and leverage the data risk for data
flow monitoring, auditing and remediation. This approach greatly simplifies the process.
Pre-emptive vs Reactive
Most DLP solutions try to prevent a data leakage event by blocking the exfiltration of the file. This approach has a couple of shortcomings:
- It does not help with an external threat, like ransomware stealing data.
- It requires an initial extensive effort of setting up all the blocking rules with ongoing maintenance.
Our pre-emptive approach provides an answer for both shortcomings by encrypting files automatically.
How does it work?
It is a cloud-based management platform coupled with a lean agent for workstations
(both Windows and Mac), File Servers, NAS and Terminal Servers, and a sidecar Docker
instance for cloud-based file shares (. i.e., OneDrive).
Step 1: Data Risk Discovery and Quantification
Based on predefined privacy regulations and Personal Identifiable Data (PII) definitions, the system immediately starts scanning for sensitive data using smart patterns. It then quantifies data risk per PIl type in financial terms.
Step 2: Data Risk Monitoring and Auditing
Tracks and audits data risk in real-time by continually monitoring incoming and outgoing sensitive data flows from and to the perimeter-less organisation.
Step 3: Data Risk Remediation by Encryption
Its patented transparent encryption process automatically secures sensitive data across all endpoints, cloud apps, 3rd party portals, and shadow IT. The entire process, from initial deployment through data risk analysis to remediation by automatic encryption, takes as little as 72 hours.
The system not only pre-emptively encrypts sensitive private data in files, but it also transitions the data to a safe harbour, per all privacy regulations requirements. The solution helps organisations comply with all statutory data privacy regulations.
So, what does it do for you?
- Sensitive File Discovery. SMEs frequently have an incomplete picture of where sensitive data is dispersed and who has access to it. The system locates and maps sensitive data across all your systems, devices, and the cloud.
- Data Risk Quantification
Actifile calculates the data risk for every PIl type by applying an algorithm that multiplies every PII record by its potential total damage, then aggregates that across all the files and PIl records of the organisation. The aggregation is across file types, file locations, and different silos to provide a complete data risk quantification. The quantification is always up to date, in real time.
- Real-Time Data Flow Monitoring
The system works silently in the background, monitoring real-time data flow across your entire IT ecosystem through user activities at the endpoints. This real-time monitoring shows how much data is being exfiltrated outside the organisation or imported into it. The monitoring capability does not require any type of integration to the sending or receiving application or website.
• Full Audit and Indelible Log
We automatically log all data-related events, including data ingress and egress and the creation of sensitive data. You can instantly audit back to specific dates, times, and locations. The log is never deleted, covering you in the event of a breach. You also have the option to generate alerts on specific events and to integrate the alerts to 3rd party systems, such as SOC or SIEM.
- 3rd Party Integration and Reporting
3rd party event integration: Everything that we capture can be seamlessly integrated
into a third-party security central system (SOC or SIEM). Users can capture and correlate all events that happen within the organisation.
Online and offline reporting: Conveniently export system reports and analyses in PDF format and white label them as required.
• Risk Remediation by Encryption
Automatic encryption is a fast and convenient remediation process that secures sensitive data across your entire IT ecosystem, including remote devices and the cloud. Even if data is stolen or misplaced, the AES 256 encryption mechanism prohibits bad actors from opening or using the file. Invisible decryption allows employees to automatically use encrypted files with no latency and without the need for a password. Your employees can work without disruption, but sensitive data remains useless to any hostile actor. Automatic decryption by channel enables users to automatically decrypt any encrypted file when it’s attached to an application. The system easily meets the demands of modern high-tech working environments. Delayed encryption gives you the flexibility to balance security with the demands of daily workflows. You can create a pragmatic, tailored approach to the management of sensitive data.
In a nutshell, this service is designed to protect your data from being stolen or inadvertently leaked by employee action. It is a layer below intrusion detection and prevention, stopping the scenario outlined above, where a cybercriminal had infiltrated the system and was exfiltrating data without the knowledge of the organisation. If they had been using this system, their data would have been encrypted and useless to the attacker.