Tag Archives: Business Security

Why we need to rethink Business Security

Posted on by

Security is an IT problem.

How many managers, owners, C Level Executives and board members agree with this statement?

More than 50% of small and medium businesses and not-for-profit organisations think that the ICT department is the go-to people when it comes to protecting your business’s crown jewels.

There has been a significant push in the last 5 to 10 years to get SMEs away from this thinking and to think about business risk, compliance, governance and business security.

Yes there is still a significant place for the ICT management of security around technology.   They are the ones who have to work with limited resources, doing more and more with less and less, and producing the same level of protection year in and year out.

When it comes to a cyber event, the problem in today’s business world is that not everything can be secured with technology.

At a basic level, there are 6 areas that create a secure business environment, technology and frameworks is one of them.   The others are risk management, people and education, policy and governance, resilience and finally continuous improvement.

As you can see, technology is only a small part of the solution.

The normal situation for SMEs and Charities is to think that ICT department knows it all.   We have had similar situations ever since computers have become an integral part of the business.

People who “know computers” were called on to fix the business infrastructure simply because of the know computers.   So a web designer was asked to fix a printer or a programmer was asked to set up an internet connection.   Yes, they could do it but in today’s world it is so much more complicated and complex.

Business security needs to be addressed by someone who knows security.   Someone who understands risk!   Someone who understands the fundamental security practices required to protect the organisation.

You would never go to an unqualified accountant to do your tax return, or an unqualified electrician to rewire your house, or even an unendorsed mechanic to repair you new BMW.

When it comes to protecting the business, especially from a cyber event, we rely on people who have minimal understanding of what needs to be done to create a secure business environment.

Where to start your Business Security / Cybersecurity Journey

Posted on by

Start

Time

3-hour program

What is done

Audit on assets and risk management.

What you get

  • Report on where your organisation is in relation to business security
  • Roadmap to implement basic changes to your business organisation
  • A number of process, procedure and policy templates
  • A number of Plans templates

Tools we use

  • Care-app diagnostic tool
  • Questionnaire similar to basic SWOT
  • Proprietary diagnostic tools
  • Open-source intelligence gathering tools

What do you need to do

  • Implement changes
  • Discuss with management
  • Implement proactive responses to cybersecurity

 

Threshold

Time

8-hour program

What is done

 

What you get

  • Implementation of Internet policy
  • Implementation of online security awareness program
  • In depth Risk analysis
  • In depth Risk mitigation process
  • Full blown digital SWOT

Tools we use

 

What do you need to do

 

 

Baseline

What is done

 

What you get

 

What do you need to do

 

 

Beyond

What is done

 

What you get

 

What do you need to do

 

 

Cybersecurity – Too much Cheese, not enough whiskers!

Posted on by
Cybersecurity is a touchy subject.
Everyone wants the government and those in politics to do something about it.
When it comes to cybercrime the solution is not that easy.
We all think that cybersecurity (Digital Security) is unimportant!
That’s an IT problem/issue!
Its someone else’s problem!
Someone else will look after it.
The anonymity of the digital world makes anything and everything possible.   We can no longer be sure of who we are communicating with, and even the friends we know could have been compromised making any conversation insecure.
“Why should I protect myself in the digital world” is a question we hear daily in the industry.   I have done enough, I have anti virus!    This attitude comes from C level Execs, Board members, managers in all level of industry and commerce as well as people at the coal face.
The announcement from the government shows, once again, that we are not looking at a solution to the problem but another way to endorse the attitudes of the big business and government departments.
The attack surface in the digital world is huge.   The introduction of IoT will compound the issues associated with protection 100 fold.
Think of a beach and each grain of sand is an application, website, IoT device, Operating system or smart device.   The problem is visibility, how do we know what is happening below the surface, behind the scenes?  We don’t!   No one on the planet can!
I have friends who can hack a smartphone (yes any smartphone) record where you are and what you are saying and you would not even know it was happening.   Nothing on the screen, no flashing apps, nothing!
Attitudes need to change!
Cybersecurity has to be holistic!   It has to include any and all components of a business in the protection of that business.
There is no silver bullet that will put down the Cybercrime werewolf.   Anyone that sells you a silver bullet is exposing your organisation to untold problems.   Not just because you have bought into the hype, but you have also forgotten that there are other ways to compromise a system that what they are protecting you against.
Trust no one, if you are connected to the digital world no matter the device or the reason.   Trust No One!

The best way to find out how vulnerable to a cyber event your organisation is.   Use the CareMIT Digital Diagnostic Tool or come to one of our regular quarterly “Security Board Meetings“

If you have been exposed to a ransomware attack “turn it all off” is exactly what happens.

Posted on by

If you have been exposed to a ransomware attack “turn it all off” is exactly what happens.

You can no longer “work”!

You may no longer have access to data.

You may no longer have access to systems.

You may no longer have access to the greatest communication system ever invented – the internet!

It is better to be in a controlled situation where you have the power and the ability to learn than to be in a situation where it has happened and you no longer have control.

Yes, it is a huge decision for management and boards but you DO realise that all of this technology that every business relies on can disappear in a heartbeat.

So much can be learned especially when you have the ability to turn it all back on again.

A 1-hour test will give you an insight into how your business will survive.

That is the most important part of the test.

The amount of information that can be gathered in a “turn it all off” scenario is substantial.

  • How do you recover?
  • How long will it take?
  • What are the priority systems?
  • How can you function without the systems?
  • How long can you function without the systems?
  • What manual systems can be used?
  • How can those manual systems be added to recovered systems?
  • What contingencies do you have in place?
  • How do you communicate with customers, suppliers, and vendors?

How many perceived ideas went into your #businesscontinuity and #disasterrecovery plans?

If you thought – “we will worry about that when it happens” – then you are already in trouble!

Do I have your attention yet?

An understanding of the true impact of a “turn it all off” scenario can be hinted at by role-playing.

With so many organisations thinking “it will not happen to us” or “we are too small to be targeted” that role-played scenario will open everyone’s eyes.

Need help with writing, implementing and/or proving your BC and DR Plans PM me ASAP

Do boards members get cybersecurity wrong?

Posted on by

Do boards members get cybersecurity wrong?

My industry has a major issue when it comes to taking highly complex and alien concepts and putting them into a language that normal business people can understand.

Cybersecurity/business security is a complex, expensive and time-consuming process if you want to get it right.

There are no short cut, it is never complete and you have to have contingencies for any and every event.

There is also a huge difference between the IT world and the risk-based cybersecurity requirements of your business.

As a board member do you:

𝐓𝐫𝐮𝐬𝐭 “𝐈𝐓 𝐞𝐱𝐩𝐞𝐫𝐭𝐬” 𝐭𝐨 𝐤𝐧𝐨𝐰 𝐜𝐲𝐛𝐞𝐫?

Cyber and IT are different!

IT is all about keeping the lights on and the revenue engines running.

Cyber and business security is all about the risk to the business from the digital space.

What are the risk to the assets of the business, the people, information, property and your reputation?

Once you know the risks to the assets then you can mitigate them with good strategies.

𝐓𝐡𝐢𝐧𝐤 𝐲𝐨𝐮 𝐤𝐧𝐨𝐰 𝐦𝐨𝐫𝐞 𝐚𝐛𝐨𝐮𝐭 𝐜𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐭𝐡𝐚𝐧 𝐭𝐡𝐞 𝐞𝐱𝐩𝐞𝐫𝐭𝐬?

We are often faced with people outside the industry telling us that they know more about the bad guys and their capabilities than we do.

Would you tell a mechanic that you know more about cars, or an accountant more about taxes or a solicitor more about law?

We use subject matter experts for a reason!

For some reason, everyone knows more about cyber and does not see the industry as experts in the field.

𝐔𝐧𝐝𝐞𝐫𝐬𝐭𝐚𝐧𝐝 𝐜𝐲𝐛𝐞𝐫 𝐟𝐢𝐧𝐚𝐧𝐜𝐢𝐚𝐥 𝐥𝐢𝐭𝐞𝐫𝐚𝐜𝐲?

There is a simple equation that we use regularly in the industry.

Spending $1 before a cyber event is equivalent to spending $9 after an event.

97% of cyber-attacks are preventable but to prevent them you need to be proactive.

𝐈𝐦𝐩𝐥𝐞𝐦𝐞𝐧𝐭 𝐈𝐧𝐬𝐮𝐟𝐟𝐢𝐜𝐢𝐞𝐧𝐭 𝐨𝐯𝐞𝐫𝐬𝐢𝐠𝐡𝐭 𝐨𝐟 𝐝𝐚𝐭𝐚, 𝐜𝐮𝐬𝐭𝐨𝐦𝐞𝐫𝐬, 𝐚𝐬𝐬𝐞𝐭𝐬, 𝐚𝐧𝐝 𝐛𝐮𝐬𝐢𝐧𝐞𝐬𝐬 𝐜𝐚𝐩𝐚𝐛𝐢𝐥𝐢𝐭𝐲?

If you do not know your assets then you cannot protect them.

Understanding your assets is the first step in protecting your organisation from a cyber event.

𝐇𝐚𝐯𝐞 𝐈𝐧𝐚𝐝𝐞𝐪𝐮𝐚𝐭𝐞 𝐮𝐧𝐝𝐞𝐫𝐬𝐭𝐚𝐧𝐝𝐢𝐧𝐠 𝐨𝐟 𝐜𝐲𝐛𝐞𝐫 𝐫𝐢𝐬𝐤, 𝐦𝐢𝐭𝐢𝐠𝐚𝐭𝐢𝐨𝐧 𝐚𝐧𝐝 𝐦𝐨𝐧𝐢𝐭𝐨𝐫𝐢𝐧𝐠

The risk to every organisation from the digital space is significant.

A simple noncriminal event – lost laptop, printer failure or corrupt hard drive can cause major issues.

Understanding the protection requirements takes an understanding of what your assets are, what are the risks to those assets how can those risks be mitigated and visiting the whole process again every three to six months.

𝐔𝐧𝐝𝐞𝐫𝐬𝐭𝐚𝐧𝐝𝐢𝐧𝐠 𝐭𝐡𝐞 𝐮𝐬𝐞𝐟𝐮𝐥𝐧𝐞𝐬𝐬 𝐨𝐟 𝐚 𝐜𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐟𝐫𝐚𝐦𝐞𝐰𝐨𝐫𝐤

Implementing a framework to secure an organisation is essential in ensuring the organisation is protected.

It reduces the chances of things being overlooked as well as reducing the requirements for knee-jerk reactions to things happening in real-time.

The stupidity of certification

Posted on by

The stupidity of certification

We are obsessed with certification and qualification in the business world.

In the late 90s, Microsoft certification was the number one qualification in the IT space.

The MCSE (Microsoft Certified System Engineer) was the top one that I held from 1998 - 2006

This high-end cert had a few problems.

A person who had been working with Microsoft software in a business environment often failed the exam because of the difference between the reality of the business world and Microsoft’s rosy glass interpretation of what business had to do to make it run.

Anyone could pass the exam if they studied enough or had access to the answers being sold on the internet.

They did not have to have practical knowledge of NT4 (what a beast) to get a job as a network engineer.

That problem is still around.

Technically wise, cybersecurity certs have a similar problem.

You would think the difference between a certified security engineer and cybercriminals would be close.

They are not.

A certified security engineer lives in a world of frameworks, asset management, risk management, alerts, reports and responses.

The cybercriminal does not even need to be a cybercriminal, all they need is a driving focus to get into a system.

To think outside the box.

To find a vulnerability that no one else has found, work out how to exploit it, complete a proof of concept document and release it to the world with the words “look what I did”, that is all that they need.

Not a certification in place.

Not a qualification in sight!

Just a drive and focus on doing something on the digital world that will get them to notice, the kudos for doing it and the learning that comes with it.

I would bet my uncertified unpapered team against your certs anytime.

I wonder who would win.

Do a podcast they say, it’s easy they say. Sure it is!

Posted on by

Do a podcast they said, it’s easy they said!

Sure it is!

A touch of sarcasm there I am afraid.

My first idea for a podcast was to interview people who had been targeted, exploited and/or who had experienced a cyber event.

It would be full of information about, no wait…..

No one is going to talk about being breached!

That conversation, if they had lost thousands of dollars or worse closed their doors, would be way tooooo painful.

Although it would be of huge benefit to others and my target audience it would definitely be detrimental to the interviewee’s health

If they survived, talking about it would have a negative impact on their revenue, reputation and brand.

Not the best idea I have had.

Scratch that!

Second idea!

Let’s interview people in the industry.

A bit of research on the interwebs and it confirmed a long-standing realization that not-for-profit organisations, charities and small and medium businesses are treated shoddily by the cybersecurity industry.

After a couple of conversations, I soon realized that the best in cyber had very little understanding of the space that is occupied by organisations with less than 50 staff.

There are a number of people that are in the cyber industry who are wholly based in normal business and who understand cyber and smaller organisations.

I actually hope that I can interview them, but

Most do not understand the challenges and problems associated with a struggling small and medium business environment.

Where making a simple decision could mean that you have a cash flow issue, a marketing issue, a cyber problem or a going out of the business problem

So number 3 idea was born

There are two areas where everyone has problems in cyberspace.

The first are NFPs, Charities and SMEs.

Second, are the elderly and mature.

Coming soon as a podcast and video:

“Need help – ask Roger”

Cybersecurity for normal small businesses.

Some straight answers to cyber questions that the others are reluctant to answer.

A podcast about how to build resilience and security into your business from the basics up.

Get answers to the questions that you need to ask about business security

And to make myself even busier I thought,

“An old persons take on protecting their digital stuff”

The most under-protected user of the digital world are the elderly, retired and mature

This area of the population are uneducated and ill-informed but most important they are innocent to the true capability of the cyber-criminal.

This makes them the number one target for the cyber creep.

They are under constant attack through scams, extortion and fear-mongering.

Hopefully going to be launching them both this month, see lockdown has some advantages.

The first episodes of both of them went live this week all I have to do is find the URL for them

#nonprofits #smallbusiness #ExecutivesAndManagement #AccountingAndAccountants #ProfessionalWomen #ceo  #CareMIT #cybersecurity #infosec