Category Archives: Technology and Frameworks

A Critical Challenge for SMEs and Nonprofits – A cybersecurity crisis

Posted on by

Small and medium-sized enterprises (#SMEs) and #nonprofits are on the brink of a cybersecurity crisis. 

The converging forces of heightened expectations, stringent regulations, advanced threats, and multiplying vulnerabilities are brewing a perfect storm, one that these organizations are ill-equipped to weather with their current resources.

Firstly, there’s a rising tide of expectations from customers, donors, and stakeholders for robust data protection. 

People are more aware and less forgiving of cybersecurity lapses, and the reputational damage from a breach can be irreparable. 

For SMEs and nonprofits, this means cybersecurity is not just a technical issue, but a core business concern.

Simultaneously, regulatory bodies are tightening the noose with more rigorous data protection laws. 

Compliance is no longer a choice but a necessity, laden with potential legal ramifications and financial penalties for non-compliance. 

However, navigating these regulations requires resources and expertise that many SMEs and nonprofits simply do not have.

Moreover, the sophistication of cyber threats is escalating. 

Cybercriminals are no longer lone hackers but part of organized syndicates using advanced tactics. 

They specifically target SMEs and nonprofits, perceiving them as ‘soft targets’ due to their limited cybersecurity measures.

Lastly, the digital landscape is expanding. 

With the rise of remote work, cloud computing, and IoT, the number of vulnerabilities to be managed has skyrocketed.

Each new technology and process adds another layer of complexity to an already strained cybersecurity infrastructure.

This scenario leaves SMEs and nonprofits in a precarious position. 

The required investment in cybersecurity – in terms of finances, personnel, and technology – is skyrocketing, far outpacing what most can afford. 

The gap between what is needed and what is available is widening, turning fears into nightmares.

Addressing this challenge requires a radical rethinking of priorities and strategies.

Collaborations with cybersecurity experts, leveraging community resources, and advocating for supportive policies are steps in the right direction. 

Cybersecurity must be viewed not as a cost but as an investment in the organization’s sustainability and trustworthiness. 

The time to act is now because the cost of inaction is simply too high!

𝐇𝐨𝐰 𝐭𝐨 𝐓𝐮𝐫𝐧 𝐘𝐨𝐮𝐫 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐌𝐚𝐠𝐢𝐜 𝐓𝐫𝐢𝐜𝐤𝐬 𝐢𝐧𝐭𝐨 𝐚 𝐑𝐞𝐚𝐥 𝐒𝐩𝐞𝐥𝐥𝐛𝐨𝐨𝐤

Posted on by

Picture your cybersecurity efforts as a magic show.

The spotlight’s on, the audience is holding its breath, and with a flourish, you pull out a rabbit – your point-in-time cybersecurity activities – from your hat.

Everyone claps, awed by your skills.

But here’s the catch – it’s all an illusion.

Magic tricks can wow an audience, but they won’t keep real threats at bay.

Here’s why.

Penetration testing and insurance audits, like well-practiced magic tricks, might give you an instant feeling of accomplishment.

They’re visible, tangible, and satisfy that immediate need for reassurance.

But here’s the twist: they only capture a single moment in time.

It’s like taking a snapshot of a bustling city – it might tell you how things look at that particular moment, but it doesn’t account for the constant, dynamic motion that’s the essence of the city.

Similarly, these activities can’t possibly account for the evolving landscape of cybersecurity threats that’s as unpredictable as a magician’s hat.

So, how do you transform these magic tricks into a reliable ‘spellbook’ that can truly protect your business?

It’s time to augment them with best practice solutions.

Best practices provide a roadmap that guides your business through the labyrinth of cyber threats.

They’re not flashy magic tricks, but rather the behind-the-scenes efforts that ensure the magic happens.

They include continuous monitoring, employee training, regular updates and patches, and maintaining an effective response plan.

This blend of the magical (point-in-time activities) and the mundane (best practices) creates a well-rounded cybersecurity strategy.

Just as a magician enchants an audience with a blend of showmanship and sleight of hand, your business needs to balance the tangible, instant gratification of point-in-time activities with the less visible, continuous effort of best practices.

How does an Australian non profit organisation know how to stop a cyber event from happening again?

Posted on by

Preventing a cyber event from happening again is a critical step for nonprofit organizations in Australia.

Here are some steps that nonprofits can take to stop a cyber event from happening again:

Conduct a security assessment:

Nonprofits should conduct a security assessment to identify any vulnerabilities in their IT systems and data.

This may involve using security software tools or hiring a cybersecurity expert to perform the assessment.

Review policies and procedures:

Nonprofits should review their policies and procedures related to cybersecurity, data protection, and incident response.

This can help identify areas for improvement and ensure that the organization has appropriate controls in place to prevent future incidents.

Implement security measures:

Nonprofits should implement security measures to prevent cyber events, such as strong passwords, two-factor authentication, and regular software updates.

Nonprofits should also ensure that their systems and software are properly configured and patched.

Provide training and education:

Nonprofits should provide ongoing training and education to staff to ensure they are aware of the latest cyber threats and know how to prevent cyber events.

This may include training on how to recognize and report suspicious activity, as well as how to use security software tools.

Monitor systems:

Nonprofits should monitor their IT systems and data for any unusual activity or anomalies.

This can help identify potential security incidents before they become major problems.

Have an incident response plan in place:

Nonprofits should have an incident response plan in place to respond quickly and effectively in the event of a cyber event.

This plan should include procedures for notifying stakeholders, collecting evidence, and recovering data and systems.

Regularly review and update security measures:

Nonprofits should regularly review and update their security measures to ensure they are up to date and effective against the latest threats.

In summary, nonprofits can stop a cyber event from happening again by conducting a security assessment, reviewing policies and procedures, implementing security measures, providing training and education, monitoring systems, having an incident response plan in place, and regularly reviewing and updating security measures.

In light of Latitudes latest breach – Cybersecurity: When Enough is Never Enough

Posted on by

In an increasingly interconnected world, digital security has become paramount.

The rapid pace of technological advancement and the ever-evolving nature of cyber threats make it challenging to stay ahead of the curve.

Despite our best efforts to safeguard our digital assets and information, the reality is that we can never fully eliminate the risks.

The main challenge in addressing cybersecurity lies in the fact that threats are constantly evolving.

Cybercriminals are continually honing their skills and devising new methods to bypass security measures.

The rise of the Internet of Things (IoT), artificial intelligence (AI), and machine learning (ML) has opened up new avenues for cybercriminals to exploit.

As our reliance on technology grows, so too does the number of potential vulnerabilities in our systems.

The human factor also plays a critical role in the cybersecurity equation.

People are often the weakest link in the security chain, with many breaches resulting from human error or negligence.

This underlines the importance of continuous training and education in cybersecurity best practices, as even the most sophisticated defenses can be rendered useless by simple human mistakes.

Given these challenges, what can organizations and individuals do to improve their cybersecurity posture?

While achieving complete immunity from cyber threats may be impossible, there are several steps we can take to minimize our risk:

✅ Adopt a multi-layered security approach: Implement a variety of security measures to protect digital assets, including firewalls, intrusion detection systems, encryption, and strong password policies.

✅ Emphasize ongoing education and training: Ensure employees are well-versed in cybersecurity best practices to prevent human errors that lead to breaches.

✅ Foster a culture of cybersecurity: Encourage employees to take ownership of their digital security and instil a sense of shared responsibility for protecting the organization's data and systems.

✅ Continuously monitor and update security measures: Regularly assess security posture and update measures accordingly to address new and emerging threats.

✅ Collaborate and share information: Work together with other organizations, governments, and cybersecurity experts to identify and respond to threats more effectively.

While it may be impossible to eliminate all cybersecurity risks, recognizing that enough is never enough can drive us to be ever more vigilant in our efforts to protect our digital assets.

By adopting a proactive, multifaceted approach to cybersecurity, we can minimize our risk and stay one step ahead of cybercriminals.

Why SMEs need an MSP

Posted on by

In 2023 and beyond, cyber threats will continue to be the biggest risk to small businesses.

These threats can come in the form of malware, ransomware, phishing attacks, and other forms of cybercrime, and they can have severe consequences for small businesses.

In a survey conducted by the National Cyber Security Alliance, 60% of small businesses reported being a victim of a cyber attack, and more than half of those attacks resulted in financial losses.

One of the main reasons that small businesses are at such high risk is that they often lack the resources and expertise to properly protect themselves.

Many small businesses do not have dedicated IT staff or cybersecurity professionals on hand, making them more vulnerable to attacks.

They may also have limited budgets for cybersecurity measures, which can leave them exposed to threats.

Another reason that small businesses are at risk is that they often have weaker cybersecurity defenses.

Small businesses may not have the same level of security measures in place as larger organizations, making them an easier target for cybercriminals.

This can include things like outdated software, a lack of firewalls, and insufficient training for employees on how to identify and prevent cyber threats.

A managed service provider (MSP) can play a critical role in helping small businesses reduce the risk of cyber threats.

One of the main ways that MSPs can help is by providing proactive monitoring and management of a small business’s IT systems and networks.

This can include things like identifying and addressing vulnerabilities, implementing security measures such as firewalls and antivirus software, and monitoring for suspicious activity.

In addition, MSPs can help small businesses implement a disaster recovery plan in the event of a cyber attack.

This can involve regularly backing up data and having a plan in place for how to restore systems and recover from an attack.

This can be particularly important for small businesses, which may have a harder time recovering from a cyber attack due to limited resources.

MSPs can also provide training and education on cybersecurity best practices to small business employees.

This can include things like teaching employees how to identify and prevent phishing attacks, how to create strong passwords, and how to recognize and report suspicious activity.

This can help small businesses create a culture of cybersecurity awareness and reduce the risk of attacks.

Overall, a managed service provider can help small businesses reduce the risk of cyber threats by providing proactive monitoring and management of IT systems and networks, implementing a disaster recovery plan, and providing training and education on cybersecurity best practices.

By working with an MSP, small businesses can take steps to protect themselves from cyber threats and reduce the potential impact of these threats.

3 reasons that cybersecurity is in the state it is!

Posted on by

Cybersecurity is at a low level for several reasons.

One reason is that organizations, governments and individuals are not investing enough in cybersecurity measures.

This can include not allocating sufficient budget or resources for cybersecurity training, hiring, and technology.

Another reason is that many organizations and individuals do not have a clear understanding of the cyber threats they face, and as a result, do not prioritize cybersecurity.

Additionally, many companies and individuals are still using outdated software, hardware and systems that are vulnerable to cyber-attacks which could have been prevented if they were updated.

Furthermore, the sophistication and complexity of cyber attacks are increasing at a faster rate than organizations and individuals can keep up with.

All these factors combined have led to the current low level of cybersecurity.

Lowest entry-level ever

Today, the entry-level for cybercrime is at an all-time low.

This is due in part to the increasing availability of easy-to-use tools and resources that allow individuals with little technical expertise to engage in cybercrime.

For example, there are now numerous online forums, tutorials, and hacking tools that can be easily accessed and used by anyone with an internet connection.

Additionally, the rise of the dark web has made it easier for individuals to purchase and use malicious software, such as malware and ransomware, for criminal activities.

Furthermore, the increasing use of automation and AI in cybercrime has made it easier for cybercriminals to launch large-scale attacks and target a wide range of victims.

All these factors have led to the lowering of the entry-level and increase of cybercrime which is a major concern for organizations, governments and individuals.

Education and training from the wrong direction

Education and training that is delivered in a top-down manner, where the information and knowledge is passed down from the top level of an organization to the bottom, can fail for several reasons.

One of the main reasons is that it does not take into account the unique needs and perspectives of the individuals or groups who are being trained.

The information may not be tailored to their specific role or level of understanding, making it difficult for them to apply it effectively in their work.

Additionally, top-down education and training can lead to a lack of engagement and buy-in from the individuals or groups who are receiving the training.

Without their active participation and interest, the training may not be as effective in achieving its goals.

A bottom-up approach, on the other hand, is more inclusive and empowering, and it starts with the needs and perspectives of the individuals or groups who are being trained, ensuring that the training is more relevant and meaningful to them.

Software was written for the first to market, not as a secure platform

Software that is written with the primary goal of being the first to market may not prioritize security.

This means that the software may have vulnerabilities or weaknesses that can be exploited by cybercriminals or hackers.

These security flaws can lead to data breaches, loss of sensitive information, and other types of cyber attacks. Additionally, software that is not designed with security in mind may not comply with industry regulations or standards, which can lead to legal and financial repercussions for the company that developed the software.

To avoid these issues, it is important for companies to balance the need for speed to market with the need for a secure and compliant software platform.

Additional

AI

Artificial intelligence (AI) will have a significant impact on both cybersecurity and cybercrime.

On the cybersecurity side, AI can help organizations and individuals detect and respond to cyber threats in real time, by using advanced machine learning algorithms to analyze large amounts of data, identify patterns, and make predictions about potential attacks.

Additionally, AI-based systems can also be used to automate many security processes, such as patch management and incident response, which can help organizations and individuals become more efficient and effective in defending against cyber attacks.

On the other hand, AI can also be used by cybercriminals to launch more sophisticated and automated attacks, such as spear-phishing, social engineering, and malware campaigns.

AI-based malware can also be designed to evade detection by traditional security systems and can spread quickly across networks.

Additionally, AI can also be used to enable new forms of cybercrime, such as deepfake generation, which can be used to impersonate individuals or organizations in order to steal sensitive information or money.

Therefore, AI can have a significant impact on both cybersecurity and cybercrime and it’s important for organizations and individuals to stay aware and adapt to the new technology.

Do a podcast they say, it’s easy they say. Sure it is!

Posted on by

Do a podcast they said, it’s easy they said!

Sure it is!

A touch of sarcasm there I am afraid.

My first idea for a podcast was to interview people who had been targeted, exploited and/or who had experienced a cyber event.

It would be full of information about, no wait…..

No one is going to talk about being breached!

That conversation, if they had lost thousands of dollars or worse closed their doors, would be way tooooo painful.

Although it would be of huge benefit to others and my target audience it would definitely be detrimental to the interviewee’s health

If they survived, talking about it would have a negative impact on their revenue, reputation and brand.

Not the best idea I have had.

Scratch that!

Second idea!

Let’s interview people in the industry.

A bit of research on the interwebs and it confirmed a long-standing realization that not-for-profit organisations, charities and small and medium businesses are treated shoddily by the cybersecurity industry.

After a couple of conversations, I soon realized that the best in cyber had very little understanding of the space that is occupied by organisations with less than 50 staff.

There are a number of people that are in the cyber industry who are wholly based in normal business and who understand cyber and smaller organisations.

I actually hope that I can interview them, but

Most do not understand the challenges and problems associated with a struggling small and medium business environment.

Where making a simple decision could mean that you have a cash flow issue, a marketing issue, a cyber problem or a going out of the business problem

So number 3 idea was born

There are two areas where everyone has problems in cyberspace.

The first are NFPs, Charities and SMEs.

Second, are the elderly and mature.

Coming soon as a podcast and video:

“Need help – ask Roger”

Cybersecurity for normal small businesses.

Some straight answers to cyber questions that the others are reluctant to answer.

A podcast about how to build resilience and security into your business from the basics up.

Get answers to the questions that you need to ask about business security

And to make myself even busier I thought,

“An old persons take on protecting their digital stuff”

The most under-protected user of the digital world are the elderly, retired and mature

This area of the population are uneducated and ill-informed but most important they are innocent to the true capability of the cyber-criminal.

This makes them the number one target for the cyber creep.

They are under constant attack through scams, extortion and fear-mongering.

Hopefully going to be launching them both this month, see lockdown has some advantages.

The first episodes of both of them went live this week all I have to do is find the URL for them

#nonprofits #smallbusiness #ExecutivesAndManagement #AccountingAndAccountants #ProfessionalWomen #ceo  #CareMIT #cybersecurity #infosec

Cybersecurity for the C suite executive (CEO, CFO,COO)

Posted on by

Cybersecurity for the C suite executive (CEO, CFO, COO).

Lets look at the facts!

No matter the size, shape or industry of an organisation.

No one is fully prepared for a full-on, bare knuckles, cyber ninja assault.

We are not talking about a random attack.

An attack that is being perpetrated against your organisation with Metasploit and a new copy of Kali.

This attack is from Mr. Creepy!

He knows what he is doing.

He knows what he is after.

But, more importantly, he also knows how to get it.

He has studied your organisation for months to find your weaknesses.

He has the skills and resources (very important) to break in and steal your crown jewels.

These are the people who give my industry grey hairs and stress lines.

Thinking that there is no way that you would be targeted by a professional is a grave mistake.

Because It no longer needs to be a professional!

They are quite happy to train others in the required skills.

They are quite happy to sell others their expertise.

They are quite happy to tell others where they are going wrong.

They have created capabilities and skills that they have incorporated into something to sell.

This increases the capability of the inexperienced cybercriminal immensely.

Want to avoid being on the radar as a prime target then YOU NEED TO DO SOMETHING.

Here is something to start with.

Cybersecurity checklist

#nonprofits #ExecutivesAndManagement #AccountingAndAccountants #ProfessionalWomen #ceo #CareMIT #cybersecurity #infosec

Why 2022 could be a bad cybersecurity year for SME’s

Posted on by

SME’s are a prime target for cybercrime.

They have reduced expertise, minimal money, and an attitude, we are too small to be a target, that leaves them wide open to a cyber event.

Our industry, the people who know and think we understand the bad guys have been pushing for an attitude change for the last 10 years. In a large number of ways, we have failed, especially in the SME space.

In some, we have failed significantly.

By the time we get called in, after a cyber event, it is way too late.

To late to recover, too late to respond and definitely too late, in a number of organisations, to get back to business as normal.

Most SMEs, after a cyber event and especially after a ransomware attack, have but 3 choices,

  • pay the ransom,
  • recover from backup and hope you have a decent backup (a decent, tested backup is vital, no matter the situation)
  • or go out of business.

Here are 3 cybersecurity strategies that every SME should implement to be more secure and avoid that devastating cyber event.

Training users

Increased awareness of business security in a workplace is vital in today’s business world.

Not many businesses know where to go to get that training.

Training needs to be done as an ongoing process.

Once or twice a year is inadequate. But training and education has to be easy, bite-size pieces, easily digested, easily implemented and easily followed.

In addition to ongoing training, you also need to incorporate business security into your onboarding process to instill the required cultural elements into new people on staff.

Want some free cybersecurity training, here is something that will definitely help
https://wizer-training.com/partner/caremit

Risk management and gap analysis

SME’s have a limited understanding of the new risks delivered to the business via our digital components.

The game has changed significantly in the last 10 years and we, as small and medium businesses, are constantly playing catch-up.

We are significantly hampered and handicapped by the impact and scale of our digital usage.

It is everywhere, used in every component and used all of the time.

To understand the risks without understanding the systems you need some help.

Here is some help for you.
Https://CareMIT.scoreapp.com

With the report, you can now implement a gap analysis and work out what you need to do to increase security around your organisation.

The report also ties in well with:

Implemented a framework

If you are looking for a better way to manage security within your Organisation, you need to look no further than a framework.

A framework is a documented system that allows an organisation to follow the bouncing ball and tighten up the security in a regimented way.

The more the components of the framework are implemented the more secure and mature the organisation.

Frameworks are easy to follow and implement and the one I recommend is the National Institute of Standards and Technology (NIST) cybersecurity framework.
https://www.nist.gov/cyberframework

Answer the 98 questions, honestly, and you now have a road map to implement cybersecurity in a significant way.

The NIST cybersecurity framework also gives you a number.

Between 0 – 4, it can be used as a comparison between businesses, supply chain components, and government departments so you can do business with like-minded organisations.

What can SME’s do?

It is not too late to implement any of these strategies. The bad guys are getting more and more clever, so time is running out.

They are targeting everyone who is connected to the digital world, the internet, with more sophisticated systems, a number of them are now fully automated.

Some of those automated systems have minimal human involvement after the initial set up.

From initial social engineering attack, all the way through to payment of ransom everything is automated and driven by machine learning.

Every SME should be implementing a training and education process, doing a risk and gap analysis and implementing a cybersecurity and business security framework.

With that everything else will follow.

The business will be more stable, the culture of the organisation will change and getting back to business as normal after an attack can be significantly easier.

The impact of a cyber event for an organisation implementing these 3 components or not is significant.

If you haven’t implemented these 3 strategies in the last 12 months, 2 years or 5 years then 2020 is going to be a bad year.

But it’s not too late.

Why you need a new breed of Business security

Posted on by

Introduction

In the last 20 years, there has been a slow change in how the business approaches the management of the ICT component.

As business and technology changes there have been significant changes in the management process of these systems.   The more complex and costly the systems the more dedicated the support has to be.   We have gone from onsite support from staff (I know computers) to off-site support from a service provider.

SME’s no longer have the resources available to manage their ICT and a new breed of company has been slowly taking more and more control over these parts of your business.

Managed Service Provider (MSP)

Originally these organisations were known as ICT or IT companies.   They were usually run out of hardware and software stores and were more focused on those areas.

It was eventually realized that just managing the hardware and software of small and medium business and not for profit organisations was not enough.   When technology broke, the most organisation still could not afford a technician to come to the site and an IT company need to make their resources go further.

The managed service provider did a number of additional things:

  • They had systems that remotely monitored and managed (RMM) the technology within the organisation.   This allowed them to give feedback to the clients in the way of comprehensive reports on their network
  • They had helpdesk capability to fix issues as they arose from the RMM systems or issues that arose from the users.
  • They started to become proactive, not reactive.
  • In a number of ways they even became vendor managers.  They looked after their clients from the internet down to the user.

Managed Security Service Provider (MSSP)

The business has changed and the requirements for ICT support have changed, the MSP needed to do more.

To be competitive and to be more productive they started adding on services.   These services included if not delivered by the MSP:

  • off site backup,
  • managed firewall,
  • web application firewalls,
  • web site management,
  • managed Anti Virus and many more.

In most cases, they were a bolt-on action to the MSP requirements and were supplied to maximize profit and reduce cost.   In a large number of situations, the customer was not getting value for money because the MSP was tied to a specific vendor.

In the last 5 – 10 years, the bigger the perceived problem with security was the more clients were going to purchase systems from their trusted advised – their MSP.   Once again increasing profits by reducing costs.

Any MSSP that does this is actually exposing their clients to huge problems.   Most of the service level agreements (SLA) reduce this down to “all care no responsibility”

Managed Business security service provider (MBSSP)

SME’s and NFP organisations needed to approach business security in today’s business world from a new direction.

Business security has to be approached from the top down.    Management and board members HAVE to get involved.   Your MSP or MSSP who is not recommending risk management and cybersecurity frameworks is in fact doing a huge disservice to your organisation.

Risk management and a risk management process looks at all of the risks to the organisations and allows you to think and work through the process and deliver strategies to protect the organisation.   It includes the ICT and technology area but there is so much more that has to be incorporated into a risk management plan.

The second part is a cybersecurity framework.   A framework does a number of things:

  • It focuses management on the required tasks to secure the organisation.
  • It removes knee jerk reactions to perceived threats.
  • The more you implement the framework the more secure your organisation.
  • It has to be done with the involvement of all areas of the organisation from management down and from coal face up.
  • It can be managed with reduced costs, expertise and time constraints

Most frameworks have a baseline requirement.   When you start to implement the framework you have to know how secure you are before you can start to improve.   The baseline also allows you to look at priorities within the organisation.

Conclusion

If your organisation is still using an MSP or an MSSP to manage your security without looking at the risk components or without implementing a cybersecurity framework (we recommend the National Institute of Standards and  Technology (NIST) cybersecurity framework) then you need to rethink your business security requirements.

Talk to an organisation that is focused on MBSSP capability.

Secure your business!

Get proactive!

Do the scorecard!

Read your report!

Link to scorecard https://caremit.scoreapp.com

#ceo #ExecutivesAndManagement #ProfessionalWomen #CareMIT #cybersecurity #infosec