Category Archives: Risk Management

How to avoid being a target of script kiddies!

Posted on by

There is a huge difference between a cyber attack generated by a script kiddy running an automated system and one where you are being targeted by a dedicated hacker.

For one, if you are targeted by a dedicated hacker then you already know that you have something worth protecting and you have, hopefully, done something about it.

The biggest problems with cyber attacks on the internet are that 95% of them are coming from an automated system controlled or managed by trainees (script kiddies).

Automated systems have three reasons they are used:

  • They are easy to get.
  • They are easy to use.
  • They are easy to make money out of.

They are easy to get!

There are a number of ways for anyone to get hold of an automated system. They can download an operating system that has an automated system running on it. Kali, Parrot OS or Black-arch are all very good examples but there are others.

Designed as penetration testing tools, these systems have all of the requirements that they need to target organisations, multinationals, or anyone connected to the digital world.

Before you ask, yes it is all legal and above board as long as you are not targeting someone else.

To make these systems more effective they allow them to either download additional components from GitHub or design and program your own applications.

They are easy to use!

The old saying that whenever anything is free you are the product rings true with these systems as well. The creators of these systems keep track of people using them and incorporate any updates into their own releases.

To set up one of these systems all you need is a computer. Once you have administrator access to a computer you can download a virtual environment (VMware if you have some money or Virtual Box for free) and you can then install these operating systems as a virtual operating system.

You can even run the operating system on a microcomputer (Raspberry Pi) for under $100.

Once set up you now have access to the tools and capabilities that, if used correctly, can rival someone who has been in the industry for years. Almost like a novice woodworker creating a dovetail joint on their first try without knowledge of what to do.

No training, just using other people’s knowledge.

In addition, and a bigger issue, what they do not know can be learned or discovered by simply searching google.

The capability and effectiveness of these systems allow them to set up the automated attack and target a huge number of vulnerable systems based on blocks of internet-based addresses.

Simply they can find out if there is a targetable vulnerability just by using facets of the automated systems.

They are easy to make money out of!

These free operating systems have the capability of making money.

To make serious money, though, you need to work with partners. Working with partners can be both beneficial as well as detrimental to their own security.

When it comes to making money it is either through selling information on the dark web, selling cryptovirus decryption keys to vulnerable people or selling access to compromised systems to leverage other attacks.

How to avoid being a target of script kiddies.

To avoid being a victim you need to implement some protective strategies.

You need to apply the CareMIT business security methodology to the organisation but to start at the basics this is what you need to do:

  • Patch and update everything – operating systems, application and to really be secure remove anything that you do not use from the system. This is applied to computers, websites, servers, and smart devices.
  • Disable macros – do not allow macros to run on the computers
  • Use complex, unique and more than 12 characters for every site, service or system in the digital world
  • Use 2 factor or multi-factor authentication. If you manage websites or other cloud-based services make sure the third level of security is in place – captcha
  • Only allow good applications to run on the system. This is called application whitelisting and only approved applications are allowed to run. There are some anti-virus systems that allow you to do this.
  • The last one is critical to your sanity – DO A BACKUP. All the bad guys have to do is win once. A backup ensures that if and when they win they have not really won.

At the basic level, the users of these automated systems are just as vulnerable as the people that they are targeting. A severe case of “user beware”, because if you do not configure the system correctly you are just as vulnerable as your targets.

At the most fundamental level, we all know that most people between 13 and 30 have a limited ethical attitude and good and bad is debatable.

That’s why we have the proliferation of these systems.

Secure your business!

Get proactive!

Do the scorecard!

Read your report!

Linkto scorecard https://caremit.scoreapp.com

#ceo #ExecutivesAndManagement #ProfessionalWomen #CareMIT #cybersecurity #infosec

All organisations must face up to their business security requirements

Posted on by

Since small and medium businesses, charities and not for profit organisations are now the bread and butter of cybercriminals targeting.

Isn’t it about time that we started to look at the reasons?

Reason 1 – SME’s have a lack of expertise!

The digital world is complex.

Every area requires a different set of skills and knowledge.  There are areas where some of the skills and requirements flow from one area to another, but these are definitely an uncommon occurrence.

The skills to implement and manage a website are different from networking which in turn are different from the requirements for coding.   Its not the fact they are different, the problem is the required level of skill to do it correctly.

Anyone with a little bit of help can write code, but to write it correctly, securely and properly requires years of skill and practice.

When it comes to the business world, we have a significant requirement for using the digital world.  In most cases, we see the introduction of a digital component into an organisation as easy.

It is not.   To implement and configure is easy.   To implement and configure securely, correctly and in a way that will benefit the organisation takes more than a fundamental underlying knowledge.

Reason 2 – SME’s have a lack of time!

Most SME’s are doing more with less just to keep themselves in profit.   Throw in another complicated process or system and they now have more to do with the same amount of time.

Business security takes time.   To secure an organisation takes time.

A solution is to employ someone on staff to manage the ICT and we will then give him the role of security professionals.   Getting someone with the required skills will cost money.

The second alternative is to enter a service level agreement (SLA) with a Managed Service Provider (MSP) and contract the support of the OCT and security to someone else.   Again this requires the correct skills as well as culture.

Both options will free up some time.

Reason 3 – SME’s have a lack of money!

Security solutions for SME’s can be expensive.   When it comes to technology and the integration of different technologies into the business environment we see some significant costs.

Comparing the costs of a breach to the costs of putting the right technology in place, it is a no brainer, but not until after the fact.

SME’s have the same compliance and governance of multinational corporations but do not have the resources to implement tier 1 or 2 technological solutions.

They make do with what is available and inexpensive not realizing the impact of these additional vulnerabilities can have on their business.

We know the problems here are some solutions

To reduce all three of these issues, as already mentioned is a contractual agreement with an MSP or a Managed Security Solution Provider (MSSP).

They bring the required expertise, they free up time and in most cases they are a viable and cost-effective.

A better solution is to look for an Organisation that has normal MSSP skills but has the capability to add additional security components around your Organisation.

Why 2022 could be a bad cybersecurity year for SME’s

Posted on by

SME’s are a prime target for cybercrime.

They have reduced expertise, minimal money, and an attitude, we are too small to be a target, that leaves them wide open to a cyber event.

Our industry, the people who know and think we understand the bad guys have been pushing for an attitude change for the last 10 years. In a large number of ways, we have failed, especially in the SME space.

In some, we have failed significantly.

By the time we get called in, after a cyber event, it is way too late.

To late to recover, too late to respond and definitely too late, in a number of organisations, to get back to business as normal.

Most SMEs, after a cyber event and especially after a ransomware attack, have but 3 choices,

  • pay the ransom,
  • recover from backup and hope you have a decent backup (a decent, tested backup is vital, no matter the situation)
  • or go out of business.

Here are 3 cybersecurity strategies that every SME should implement to be more secure and avoid that devastating cyber event.

Training users

Increased awareness of business security in a workplace is vital in today’s business world.

Not many businesses know where to go to get that training.

Training needs to be done as an ongoing process.

Once or twice a year is inadequate. But training and education has to be easy, bite-size pieces, easily digested, easily implemented and easily followed.

In addition to ongoing training, you also need to incorporate business security into your onboarding process to instill the required cultural elements into new people on staff.

Want some free cybersecurity training, here is something that will definitely help
https://wizer-training.com/partner/caremit

Risk management and gap analysis

SME’s have a limited understanding of the new risks delivered to the business via our digital components.

The game has changed significantly in the last 10 years and we, as small and medium businesses, are constantly playing catch-up.

We are significantly hampered and handicapped by the impact and scale of our digital usage.

It is everywhere, used in every component and used all of the time.

To understand the risks without understanding the systems you need some help.

Here is some help for you.
Https://CareMIT.scoreapp.com

With the report, you can now implement a gap analysis and work out what you need to do to increase security around your organisation.

The report also ties in well with:

Implemented a framework

If you are looking for a better way to manage security within your Organisation, you need to look no further than a framework.

A framework is a documented system that allows an organisation to follow the bouncing ball and tighten up the security in a regimented way.

The more the components of the framework are implemented the more secure and mature the organisation.

Frameworks are easy to follow and implement and the one I recommend is the National Institute of Standards and Technology (NIST) cybersecurity framework.
https://www.nist.gov/cyberframework

Answer the 98 questions, honestly, and you now have a road map to implement cybersecurity in a significant way.

The NIST cybersecurity framework also gives you a number.

Between 0 – 4, it can be used as a comparison between businesses, supply chain components, and government departments so you can do business with like-minded organisations.

What can SME’s do?

It is not too late to implement any of these strategies. The bad guys are getting more and more clever, so time is running out.

They are targeting everyone who is connected to the digital world, the internet, with more sophisticated systems, a number of them are now fully automated.

Some of those automated systems have minimal human involvement after the initial set up.

From initial social engineering attack, all the way through to payment of ransom everything is automated and driven by machine learning.

Every SME should be implementing a training and education process, doing a risk and gap analysis and implementing a cybersecurity and business security framework.

With that everything else will follow.

The business will be more stable, the culture of the organisation will change and getting back to business as normal after an attack can be significantly easier.

The impact of a cyber event for an organisation implementing these 3 components or not is significant.

If you haven’t implemented these 3 strategies in the last 12 months, 2 years or 5 years then 2020 is going to be a bad year.

But it’s not too late.

Encryption and Backups are your fall back position

Posted on by

When it comes to business security there are 2 systems that will save you after the impact of a cyber event.   The first is a good backup and the second in encryption.

Neither of them is as foolproof as business owners think.

Understanding the importance of backups.

The whole point of a comprehensive back up regime is to be able to get back to business as normal as fast as possible.

A good backup will help you achieve that.   So will a good disaster recovery plan, a decent business continuity plan as well as building in as much resilience as possible into the organisation itself.

Like any plan or solution it has to be tested, it has to be stressed and more importantly, everyone in the organisation needs to know what to do, where information is and how to implement those plans.

Failing to test or improve from the experiences of real-time tests and war-games is usually where an organisation fails.

You cannot improve a system unless it is tested regularly.   Once tested you can rectify issues discovered during the testing.

You DO NOT want to have the cyber event as the first test of system failure and recovery.

What to do with backups.

When it comes to a backup it needs the following items in place.

  • A copy of all critical and non-critical data stored in another location.
  • A copy of that information only connected to the system when it is doing a backup
  • A process that has no human requirements except to check it has happened and fixing it when it fails (immediately)
  • A system that is regularly tested and improved.  In business everything changes, the systems and data need to be tested but the people involved as well.

Protecting your encryption keys

The second component is encryption.   Seen by many as the silver bullet of data security, it is just another deterrent.   If your data is stolen then encryption will ensure that the data is unreadable, unless the bad guys have the keys.

The most important component of encryption is the security of those keys, if the keys are stolen or get out the encryption is useless.

So protecting those keys is more important than protecting the data the keys are securing.

When it comes to SME’s, not for profit organisations and charities we often find the security keys, especially for securing websites, just lying around a system.   Usually, they are saved in a folder called certificates with no added security around those files.

Protecting your encryption

There are many ways of using encryption and all of them cannot be discussed here so here are a few ideas.

  • Make sure your encryption key is not hardcoded into the applications using it.
  • Make sure your encryption key is your property and not owned by a third party.
  • The encryption keys should never be stored on or in the same system using them.
  • Make sure there is an audit trail in their use.
  • Only use one administrative account to encrypt data, record that account and the password in an out of band location, only used for that specific role.
  • Your keys can be encrypted!
  • Cryptographic keys change regularly, create a policy, process and procedure around that requirement.
  • Back them up.   The keys can be stored on an encrypted thumb drive and stored in a secure location. IE – a safe (part of the policy?)

To stop a cyber event instead of just recovering from one you also need to implement other components.   To survive the onslaught of cybercrime, follow and implement the best practices documented all over the internet.

A plan B is important, just like insurance is important.   When everything else fails your recovery is critical.

The CareMIT Security Methodology will help you secure your systems, people and data.

Why you need an off-site backup

Posted on by

Off-site, secure, out of band backups are your only hope for recovery in a cyber event

Ransomware, the scourge of today’s business, is literally a click away from crippling your business and organisation.

“Attackers can reportedly execute the malware and begin encrypting most file types and removing all local backups. It is still unclear how much the demanded ransom is, but researchers have found that TFlower doesn’t append the encrypted files’ extensions.” Connor Madsen webroot. https://www.webroot.com/blog/2019/09/20/cyber-news-rundown-tflower-ransomware-exploiting-rdp

A determined crypto-virus attack on your organisation can reduce the organisations chance to make money, it can impact your reputation and can cause problems for months if not years.

Even an accidental infection, most result from an accident, can cause similar effects.

In the event of a crypto-virus attack, especially for small and medium enterprises, you have 2 options.

  • You pay the ransom – you may get your data back, you may get some of it back or you may get none of it back, we are after all talking about a criminal organisation that is holding your data to ransom.
  • You recover from your backup.

Paying the ransom is up to you, most security and ICT companies will say not to pay.

If you have a security or ICT company, or someone in your organisation that does the job they would have told you to do a backup.

Your back up has to cover the following:

  • It should be regular – depending on your requirements for the data and access to the data a back up should be completed every 24 hours.   A better solution is to have an incremental backup every 15 minutes.
  • It should have no human intervention – the backup has to run no matter what.  If you are backing up to a hard drive, connected to your device and you require someone to change drives then human error comes into it.   The old adage that the backup will fail the same day you need it is true.
  • It should be off-site – As in totally away from the business but also not connected to the business except when it is doing a backup.
  • It should be secure – all the data, no matter where it is stored should have encryption wrapped around it.   It should be encrypted at rest (stored on the location), it should be encrypted in transport (getting there and back) and it should be encrypted if you are going to use it.  This stops the information being stolen but also being accidentally accessed by the provider.
  • It should be tested regularly – you have done a backup and that’s all I have to do.   No, you need to test it regularly.   Do a regular restore to test that it works and also to ensure that you are backing up ALL of your essential data.   You do not want to be in a situation where a failure is your first test.

Achieving all of these components is difficult.   Try talking to us or a reputable ICT and security provider concerning your options!

Click here for your free trial of a secure, out of band off-site backup solution.

Why you need a new breed of Business security

Posted on by

Introduction

In the last 20 years, there has been a slow change in how the business approaches the management of the ICT component.

As business and technology changes there have been significant changes in the management process of these systems.   The more complex and costly the systems the more dedicated the support has to be.   We have gone from onsite support from staff (I know computers) to off-site support from a service provider.

SME’s no longer have the resources available to manage their ICT and a new breed of company has been slowly taking more and more control over these parts of your business.

Managed Service Provider (MSP)

Originally these organisations were known as ICT or IT companies.   They were usually run out of hardware and software stores and were more focused on those areas.

It was eventually realized that just managing the hardware and software of small and medium business and not for profit organisations was not enough.   When technology broke, the most organisation still could not afford a technician to come to the site and an IT company need to make their resources go further.

The managed service provider did a number of additional things:

  • They had systems that remotely monitored and managed (RMM) the technology within the organisation.   This allowed them to give feedback to the clients in the way of comprehensive reports on their network
  • They had helpdesk capability to fix issues as they arose from the RMM systems or issues that arose from the users.
  • They started to become proactive, not reactive.
  • In a number of ways they even became vendor managers.  They looked after their clients from the internet down to the user.

Managed Security Service Provider (MSSP)

The business has changed and the requirements for ICT support have changed, the MSP needed to do more.

To be competitive and to be more productive they started adding on services.   These services included if not delivered by the MSP:

  • off site backup,
  • managed firewall,
  • web application firewalls,
  • web site management,
  • managed Anti Virus and many more.

In most cases, they were a bolt-on action to the MSP requirements and were supplied to maximize profit and reduce cost.   In a large number of situations, the customer was not getting value for money because the MSP was tied to a specific vendor.

In the last 5 – 10 years, the bigger the perceived problem with security was the more clients were going to purchase systems from their trusted advised – their MSP.   Once again increasing profits by reducing costs.

Any MSSP that does this is actually exposing their clients to huge problems.   Most of the service level agreements (SLA) reduce this down to “all care no responsibility”

Managed Business security service provider (MBSSP)

SME’s and NFP organisations needed to approach business security in today’s business world from a new direction.

Business security has to be approached from the top down.    Management and board members HAVE to get involved.   Your MSP or MSSP who is not recommending risk management and cybersecurity frameworks is in fact doing a huge disservice to your organisation.

Risk management and a risk management process looks at all of the risks to the organisations and allows you to think and work through the process and deliver strategies to protect the organisation.   It includes the ICT and technology area but there is so much more that has to be incorporated into a risk management plan.

The second part is a cybersecurity framework.   A framework does a number of things:

  • It focuses management on the required tasks to secure the organisation.
  • It removes knee jerk reactions to perceived threats.
  • The more you implement the framework the more secure your organisation.
  • It has to be done with the involvement of all areas of the organisation from management down and from coal face up.
  • It can be managed with reduced costs, expertise and time constraints

Most frameworks have a baseline requirement.   When you start to implement the framework you have to know how secure you are before you can start to improve.   The baseline also allows you to look at priorities within the organisation.

Conclusion

If your organisation is still using an MSP or an MSSP to manage your security without looking at the risk components or without implementing a cybersecurity framework (we recommend the National Institute of Standards and  Technology (NIST) cybersecurity framework) then you need to rethink your business security requirements.

Talk to an organisation that is focused on MBSSP capability.

Secure your business!

Get proactive!

Do the scorecard!

Read your report!

Link to scorecard https://caremit.scoreapp.com

#ceo #ExecutivesAndManagement #ProfessionalWomen #CareMIT #cybersecurity #infosec