Tag Archives: cybersecurity

Why we need to rethink Business Security

Posted on by

Security is an IT problem.

How many managers, owners, C Level Executives and board members agree with this statement?

More than 50% of small and medium businesses and not-for-profit organisations think that the ICT department is the go-to people when it comes to protecting your business’s crown jewels.

There has been a significant push in the last 5 to 10 years to get SMEs away from this thinking and to think about business risk, compliance, governance and business security.

Yes there is still a significant place for the ICT management of security around technology.   They are the ones who have to work with limited resources, doing more and more with less and less, and producing the same level of protection year in and year out.

When it comes to a cyber event, the problem in today’s business world is that not everything can be secured with technology.

At a basic level, there are 6 areas that create a secure business environment, technology and frameworks is one of them.   The others are risk management, people and education, policy and governance, resilience and finally continuous improvement.

As you can see, technology is only a small part of the solution.

The normal situation for SMEs and Charities is to think that ICT department knows it all.   We have had similar situations ever since computers have become an integral part of the business.

People who “know computers” were called on to fix the business infrastructure simply because of the know computers.   So a web designer was asked to fix a printer or a programmer was asked to set up an internet connection.   Yes, they could do it but in today’s world it is so much more complicated and complex.

Business security needs to be addressed by someone who knows security.   Someone who understands risk!   Someone who understands the fundamental security practices required to protect the organisation.

You would never go to an unqualified accountant to do your tax return, or an unqualified electrician to rewire your house, or even an unendorsed mechanic to repair you new BMW.

When it comes to protecting the business, especially from a cyber event, we rely on people who have minimal understanding of what needs to be done to create a secure business environment.

Where to start your Business Security / Cybersecurity Journey

Posted on by

Start

Time

3-hour program

What is done

Audit on assets and risk management.

What you get

  • Report on where your organisation is in relation to business security
  • Roadmap to implement basic changes to your business organisation
  • A number of process, procedure and policy templates
  • A number of Plans templates

Tools we use

  • Care-app diagnostic tool
  • Questionnaire similar to basic SWOT
  • Proprietary diagnostic tools
  • Open-source intelligence gathering tools

What do you need to do

  • Implement changes
  • Discuss with management
  • Implement proactive responses to cybersecurity

 

Threshold

Time

8-hour program

What is done

 

What you get

  • Implementation of Internet policy
  • Implementation of online security awareness program
  • In depth Risk analysis
  • In depth Risk mitigation process
  • Full blown digital SWOT

Tools we use

 

What do you need to do

 

 

Baseline

What is done

 

What you get

 

What do you need to do

 

 

Beyond

What is done

 

What you get

 

What do you need to do

 

 

Cybersecurity – Too much Cheese, not enough whiskers!

Posted on by
Cybersecurity is a touchy subject.
Everyone wants the government and those in politics to do something about it.
When it comes to cybercrime the solution is not that easy.
We all think that cybersecurity (Digital Security) is unimportant!
That’s an IT problem/issue!
Its someone else’s problem!
Someone else will look after it.
The anonymity of the digital world makes anything and everything possible.   We can no longer be sure of who we are communicating with, and even the friends we know could have been compromised making any conversation insecure.
“Why should I protect myself in the digital world” is a question we hear daily in the industry.   I have done enough, I have anti virus!    This attitude comes from C level Execs, Board members, managers in all level of industry and commerce as well as people at the coal face.
The announcement from the government shows, once again, that we are not looking at a solution to the problem but another way to endorse the attitudes of the big business and government departments.
The attack surface in the digital world is huge.   The introduction of IoT will compound the issues associated with protection 100 fold.
Think of a beach and each grain of sand is an application, website, IoT device, Operating system or smart device.   The problem is visibility, how do we know what is happening below the surface, behind the scenes?  We don’t!   No one on the planet can!
I have friends who can hack a smartphone (yes any smartphone) record where you are and what you are saying and you would not even know it was happening.   Nothing on the screen, no flashing apps, nothing!
Attitudes need to change!
Cybersecurity has to be holistic!   It has to include any and all components of a business in the protection of that business.
There is no silver bullet that will put down the Cybercrime werewolf.   Anyone that sells you a silver bullet is exposing your organisation to untold problems.   Not just because you have bought into the hype, but you have also forgotten that there are other ways to compromise a system that what they are protecting you against.
Trust no one, if you are connected to the digital world no matter the device or the reason.   Trust No One!

The best way to find out how vulnerable to a cyber event your organisation is.   Use the CareMIT Digital Diagnostic Tool or come to one of our regular quarterly “Security Board Meetings“

If you have been exposed to a ransomware attack “turn it all off” is exactly what happens.

Posted on by

If you have been exposed to a ransomware attack “turn it all off” is exactly what happens.

You can no longer “work”!

You may no longer have access to data.

You may no longer have access to systems.

You may no longer have access to the greatest communication system ever invented – the internet!

It is better to be in a controlled situation where you have the power and the ability to learn than to be in a situation where it has happened and you no longer have control.

Yes, it is a huge decision for management and boards but you DO realise that all of this technology that every business relies on can disappear in a heartbeat.

So much can be learned especially when you have the ability to turn it all back on again.

A 1-hour test will give you an insight into how your business will survive.

That is the most important part of the test.

The amount of information that can be gathered in a “turn it all off” scenario is substantial.

  • How do you recover?
  • How long will it take?
  • What are the priority systems?
  • How can you function without the systems?
  • How long can you function without the systems?
  • What manual systems can be used?
  • How can those manual systems be added to recovered systems?
  • What contingencies do you have in place?
  • How do you communicate with customers, suppliers, and vendors?

How many perceived ideas went into your #businesscontinuity and #disasterrecovery plans?

If you thought – “we will worry about that when it happens” – then you are already in trouble!

Do I have your attention yet?

An understanding of the true impact of a “turn it all off” scenario can be hinted at by role-playing.

With so many organisations thinking “it will not happen to us” or “we are too small to be targeted” that role-played scenario will open everyone’s eyes.

Need help with writing, implementing and/or proving your BC and DR Plans PM me ASAP

Do boards members get cybersecurity wrong?

Posted on by

Do boards members get cybersecurity wrong?

My industry has a major issue when it comes to taking highly complex and alien concepts and putting them into a language that normal business people can understand.

Cybersecurity/business security is a complex, expensive and time-consuming process if you want to get it right.

There are no short cut, it is never complete and you have to have contingencies for any and every event.

There is also a huge difference between the IT world and the risk-based cybersecurity requirements of your business.

As a board member do you:

𝐓𝐫𝐮𝐬𝐭 “𝐈𝐓 𝐞𝐱𝐩𝐞𝐫𝐭𝐬” 𝐭𝐨 𝐤𝐧𝐨𝐰 𝐜𝐲𝐛𝐞𝐫?

Cyber and IT are different!

IT is all about keeping the lights on and the revenue engines running.

Cyber and business security is all about the risk to the business from the digital space.

What are the risk to the assets of the business, the people, information, property and your reputation?

Once you know the risks to the assets then you can mitigate them with good strategies.

𝐓𝐡𝐢𝐧𝐤 𝐲𝐨𝐮 𝐤𝐧𝐨𝐰 𝐦𝐨𝐫𝐞 𝐚𝐛𝐨𝐮𝐭 𝐜𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐭𝐡𝐚𝐧 𝐭𝐡𝐞 𝐞𝐱𝐩𝐞𝐫𝐭𝐬?

We are often faced with people outside the industry telling us that they know more about the bad guys and their capabilities than we do.

Would you tell a mechanic that you know more about cars, or an accountant more about taxes or a solicitor more about law?

We use subject matter experts for a reason!

For some reason, everyone knows more about cyber and does not see the industry as experts in the field.

𝐔𝐧𝐝𝐞𝐫𝐬𝐭𝐚𝐧𝐝 𝐜𝐲𝐛𝐞𝐫 𝐟𝐢𝐧𝐚𝐧𝐜𝐢𝐚𝐥 𝐥𝐢𝐭𝐞𝐫𝐚𝐜𝐲?

There is a simple equation that we use regularly in the industry.

Spending $1 before a cyber event is equivalent to spending $9 after an event.

97% of cyber-attacks are preventable but to prevent them you need to be proactive.

𝐈𝐦𝐩𝐥𝐞𝐦𝐞𝐧𝐭 𝐈𝐧𝐬𝐮𝐟𝐟𝐢𝐜𝐢𝐞𝐧𝐭 𝐨𝐯𝐞𝐫𝐬𝐢𝐠𝐡𝐭 𝐨𝐟 𝐝𝐚𝐭𝐚, 𝐜𝐮𝐬𝐭𝐨𝐦𝐞𝐫𝐬, 𝐚𝐬𝐬𝐞𝐭𝐬, 𝐚𝐧𝐝 𝐛𝐮𝐬𝐢𝐧𝐞𝐬𝐬 𝐜𝐚𝐩𝐚𝐛𝐢𝐥𝐢𝐭𝐲?

If you do not know your assets then you cannot protect them.

Understanding your assets is the first step in protecting your organisation from a cyber event.

𝐇𝐚𝐯𝐞 𝐈𝐧𝐚𝐝𝐞𝐪𝐮𝐚𝐭𝐞 𝐮𝐧𝐝𝐞𝐫𝐬𝐭𝐚𝐧𝐝𝐢𝐧𝐠 𝐨𝐟 𝐜𝐲𝐛𝐞𝐫 𝐫𝐢𝐬𝐤, 𝐦𝐢𝐭𝐢𝐠𝐚𝐭𝐢𝐨𝐧 𝐚𝐧𝐝 𝐦𝐨𝐧𝐢𝐭𝐨𝐫𝐢𝐧𝐠

The risk to every organisation from the digital space is significant.

A simple noncriminal event – lost laptop, printer failure or corrupt hard drive can cause major issues.

Understanding the protection requirements takes an understanding of what your assets are, what are the risks to those assets how can those risks be mitigated and visiting the whole process again every three to six months.

𝐔𝐧𝐝𝐞𝐫𝐬𝐭𝐚𝐧𝐝𝐢𝐧𝐠 𝐭𝐡𝐞 𝐮𝐬𝐞𝐟𝐮𝐥𝐧𝐞𝐬𝐬 𝐨𝐟 𝐚 𝐜𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐟𝐫𝐚𝐦𝐞𝐰𝐨𝐫𝐤

Implementing a framework to secure an organisation is essential in ensuring the organisation is protected.

It reduces the chances of things being overlooked as well as reducing the requirements for knee-jerk reactions to things happening in real-time.

Ransomware and why it has the impact it does

Posted on by

Ok incoming RANT

On the last 3 Mondays, we have had to clean up 5 fully encrypted networks.

Small to Medium organisations, non-profits and businesses.

Each with a server with more than 10 computers and some cloud-based systems.

Their IT department or person who knows computers was in charge.

They were telling management that they were secure.

No tested backup

No resilience

No awareness training

No management systems.

No anti-virus

No updates

Where does that leave them?

At the moment, in a heap of trouble.

When it comes to cybersecurity, talk to an expert.

Everyone is a target of cybercrime, just some are more secure than others.

Not sure what to do – start with this audit here: https://Action.scoreapp.com

Cyberattack – Why are we so vulnerable

Posted on by

By the end of 2022, it is predicted that not for profits, associations, charities and SMEs will face more than 50,000 cyberattacks per day.

99% of those attacks are automatic, random generated attacks that can be counteracted by available basic systems (AV, Firewalls, SPAM filters, SPAM blockers).

These automatic random attacks are created by in-training cybercriminals and cyber activists (script kiddies).

Although the numbers are astounding they also indicate that we need to be vigilant at all times.

Because we still need to address that 1%.

That approximate 500 attacks are targeted at YOU and your organisation.

That is focused on gaining access to your stuff, stealing your money or encrypting your data.

How do we stop that?

We do not and can not stop it by believing “it will never happen to me”, “we are not a target” “we have nothing worth stealing”

We stop it by being proactive.

We stop it by taking security seriously.

We stop it with increased awareness!

We stop it with capability.

Doing nothing is not an option.

If you are frozen like a kangaroo in the headlights of a fast-moving truck then you need a push

A push in the right direction.

A direction that delivers better business security.

Like any complex and dangerous journey, we start with a single step.

That first simple step is to have a conversation with someone like me.

Cyberattacks

Ransomware – why is it such an issue?

Posted on by

In 2020 we saw a 100% increase in ransomware attacks.

In 2021 we saw a 100% increase in ransomware attacks.

Ransomware attacks are literally doubling each year.

This year can we expect any differently?

With those sorts of statistics, we should be afraid, very afraid.

But we are not.

You would think that we would be concerned.

But we are not!

In fact, in most cases, we make it overly easy for a cybercriminal to steal our stuff.

We need to look at this another way as the bad guys have changed – again.

On the internet, there is now “Ransomware as a service”.

As a criminal, If you have a little bit of money you can get a system that creates and delivers malware to anyone on the internet.

With the success of ransomware, they are guaranteed to make money.

We have to do more.

More than what we are doing because it is not good enough

We still use bad passwords.

Have you done a password review?

We have complete backups.

Have we ever tested them?

We have patched systems and operating systems.

Are there any systems that have not been patched?

How do you avoid a ransomware attack?