The post-pandemic trend of ‘work from anywhere’ may offer many benefits both to employer and employees alike, but for security teams across the board, it adds a myriad of issues and concerns regarding exactly how data can be kept safe.

The ability to be connected on any device with access to every application, anywhere at all, is a reality today. But this reality hugely increases the attack surface within any organisation.  Together with the ever-growing instances of phishing and ransomware attacks, the need for robust and co-ordinated security strategies grows ever more important.

Many organisations find themselves with piecemeal security solutions, continually bolting on the next ‘sounds great’ solution without any holistic thought.  This results in security gaps, fragmented visibility, and a complex system, practically impossible to manage.

There is no doubt that we humans are the biggest threat of all.  We make mistakes.

So, what can be done?  Here is a checklist of the 10 ‘must-have’ protections for users, devices, and access.

1. Email Security: Email is like sending a postcard. If you don’t mind the postman reading what is written on your card then it is fine, but would you put your bank details and PIN on a Postcard, obviously not. So, consider email in the same way. Always use an email security application to encrypt them, detect suspicious emails and block them, stop accidental emails going to the wrong person, or to check that attachments are not confidential.
2. Ongoing Cyber Security training: We all tend to forget things quickly and, in the heat of the moment, may not recall how to spot a suspicious link. Training should be on-going and one useful element is to use an application that generates spoof emails to maintain awareness, has the ability to monitor progress and, provides The Board with a measurement of the improvement of staff cyber awareness.
3. Endpoint Security: It is difficult to know what a remote user is doing, but by having an application on the endpoint which monitors the status of the device, checks that it is fully patched and that there are no rouge services running, can help to stop endpoints being compromised. Furthermore, adding services such as automatic back-ups, remote diagnostics and support, will enhance the remote user’s situation and reduce the support overhead of remote workers on IT Support Teams.
4. Access control: We all know the problems surrounding the issue of passwords and their management. Making access to networks easy but secure, is a goal all remote working solutions should strive for. Multi-Factor Authentication removes the password issue in a simple fashion and can be extended to encompass signal sign-on, across other platforms and cloud services.
5. Encryption: this is the only technology outlined within the GDPR rules and can significantly reduce the exposure of a data breach to a company. Encryption does not slow down a device, nor does it mean that data cannot be shared. It is simply there to protect the valuable asset of the data, whether it be in transit, at rest on a device or server, or in a cloud-based system, either managed by a third party or within your own cloud solution.
6. Backup & Disaster Recovery: Data has value and blocked access to it poses a real threat to business. Ensuring data is protected against ransomware, secured by encryption and access controls, held in multiple locations in different formats, all lead to data being available on demand, to any user or device, in as timely fashion as can be managed during any recovery process.
7. Threat intelligence: To be forewarned is to be forearmed. Therefore, understanding where threats may be, gives the business time to prepare and deploy measures to minimise risk.
8. Third Party Risk Assessments: The supply chain is critical to a business but should that chain have a weak link, it could open a door into the network and allow a hacker in. Consequently, it is important to ensure suppliers’ networks are also robust by adding some form of risk assessment on key suppliers to ensure businesses can operate together in a trusted environment.
9. Network Security: Data travels over networks, often in the public cloud, so should be protected by using a Virtual Private Network (VPN) to ensure that no third party can eavesdrop on communications or, insert data such as an altered invoice into the stream.
10. Application Security: Applications are easy to deploy but often we do not check that they are functioning correctly or may have higher administration rights than needed, leading to application exploits or open doors into networks. Any new application should be checked for its handling of security and follow the GDPR standard of a Data Protection Impact Assessment (DPIA) to verify the application. As a last resort a full code review should be undertaken which will highlight any code trap doors hidden within it by the developer.

If you need any advice or would like to discuss any of the security checklist components please give us a call on 0844 586 0040 or email [email protected]

Every organisation can benefit from added protection, we’ll be happy to advise you.

Should you rely on your cloud provider’s security?

Storing data in the Cloud has really only been ‘a thing’ during the last decade but most enterprises now have some kind of cloud presence.  So the question arises, just how secure is your data when there?

Many organisations consider that because data is stored in the Cloud by a third party, the burden of responsibility moves from themselves to their service provider, but they would be wrong, the final responsibility remains theirs.

Of course, cloud storage offers convenience, reliability, scalability, cost savings, and yes, security.  However, this needs to be underpinned by some baseline strategies before being moved across.

Firstly, ensure data is secured using multi-factor authentication.  This should be set up generally, but especially for administrator accounts, where hackers are particularly active due to their high-level access privileges.

As human error remains the number one cause of cyber attacks, ensuring employees are continually trained, kept up to date with security protocols, and employ strong passwords is critical, and, only allow access to areas essential for employees to carry out their work. Controlling who has access to data will reduce the chances of it falling into the wrong hands.

When an employee leaves the company, do not forget to remove all their access rights and delete them.

Know what data you have and where it is stored. This is important not only as a good security practice but for any Subject Access Requests you may receive under GDPR. If your data is scattered, your only resort is to use a data discovery tool to find it.

Realise the importance of each category of data and ask yourself what are the consequences should this data get leaked, tampered with, or deleted? Would you face regulatory fines, incur revenue losses, would it impact you operationally?

Email is critical to any business operations and we can’t live without it.  Be sure that your email service is as secure as it can be and remember, it’s always best to be sceptical of any email you get and keep in mind the spam warning signs.

Finally, back up! You can choose to back up with another cloud provider, or locally on an external hard drive or disk. You can also keep them off-site but make sure the data is encrypted for extra protection.

Data protection is not only an important part of maintaining trusting relationships with customers, suppliers, and stakeholders, it’s also a legal requirement, and you could suffer real consequences if you experience a breach because you’ve not taken the necessary steps to keep your data secure.

Relying solely on your cloud provider is not an option.

Every organisation can benefit from added protection. Call us on 0844 586 0040, or email [email protected] and we’ll be happy to advise you.

Do you know what data you have? Where it is and who uses it?

No, then you need to read this blog!

It is not easy to understand where unstructured data exists in the enterprise. There can be massive volumes of documents, spreadsheets, presentations, and emails, all typically scattered about the organisation.  And this represents not only a major security weakness but an expensive one at that, which now, in COVID times, means that data could be in places your organisation does not control, such as Dropbox. This is where the term ‘Shadow IT’ has come from. All these diverse locations for data and its volume represents not only a major security weakness but an expensive one at that.

Having huge amounts of data scattered across the enterprise can result in heavy costs in terms of storage, whether in data centres or third party storage facilities.

Add to that, the requirements of GDPR and, in particular, Subject Access Requests (SAR’s), and you can see what a nightmare situation unstructured data storage can become.

Data classification systems are the answer.  They are able to take the challenge down to a focused data set of in-scope data, that can amount to only 10 to 20% of the entire environment. They can ensure that all personal data is found, using a more efficient and targeted approach, which could result in a saving of some 40% in storage capacity and removing risky data from shadow IT locations.

Indexing file properties including activity logs, who has accessed what, and ACLs, who has read/write/browse permissions to specific files, facilitates a proactive approach to data protection. Combining in-depth monitoring and active controls to confine any suspicious activity before it becomes a risk is key, for example, a Ransomware attack.

Personal data can be managed according to the data owner’s request. Deleting, migrating, archiving, restricting, and correcting content.

Capturing sensitive data that is no longer needed on the primary storage network, but must be maintained for long-term retention requirements, can be moved to an archive that can be easily managed and will ensure sensitive data is not left unprotected on the network. Retention policies can be defined, and compliance teams can easily search and manage the content.

Without an integrated approach, there will be too many aspects to the workflow and too many areas that can fail when managing significant volumes of personal data.

Knowing what data is held, where it is and who uses it, is key to good data management. Without it, data storage will simply grow and grow, cluttering the network and costing vast amounts in storage solutions or worse still, data being held in multiple silos to keep costs down but, with the inevitable situation of data loss.

So, streamline data handling today, before it gets out of control.

Every organisation can benefit from added protection. Call us on 0844 586 0040, or email [email protected] and we’ll be happy to advise you.

We all need to be cybersecurity savvy these days, but how many of us understand the jargon often associated with it?

1. The Cloud

The Cloud is a term used for a large computer facility where computer space can be rented either in a shared form, where multiple companies would share one physical machine or, a dedicated computer used exclusively by one company. Often these computer facilities are located around the country or overseas, creating a mesh that provides resilience, should one computer facility fail.

The Cloud can also be referred to as the Public Cloud, but there is also the term Private Cloud and this refers to a computer facility that is owned by a company or, leased from another service provider. In general, Private Cloud facilities are used by one company only.

Generally, all Cloud facilities are accessed via the Internet rather than having dedicated communication lines into the facility from a company’s own buildings.

2. Mesh

In our homes and offices, we have a router that connects us to the Internet and we either plug an Ethernet cable from the router to our PC or, more commonly, we use WiFi to connect our devices to the router.

WiFi is fine in a small space but is not so good in a large area or a house with many rooms and floors, where both users and devices move around. Mesh networks are appearing, to overcome the failings of WiFi.

In a standard WiFi network each WiFi access point is a standalone system (i.e. it has no relationship with any other WiFi access point in your network) and so a device, such as a Smartphone, will try and hang on to a connection even when the signal is very low. Only when the signal is lost will the Smartphone try to find another WiFi access point. This means that if your phone is connected to a WiFi point in the lounge, and you move upstairs, your phone will try and stay connected to the lounge, not to the WiFi upstairs unless the signal is lost or you switch off the WiFi connection on the phone and then switch on again.

In a Mesh network, each Mesh access point is connected to all other Mesh points in your network and as you move around your home, it is the Mesh that connects you to the closest point as it is controlling your phone connection. By doing this you will always have a strong signal and will have no data loss due to losing a WiFi connection.

3. BYOD

This stands for Bring Your Own Device and refers to an employee or contractor using their own computer, Smartphone, or other such devices as opposed to using a company-supplied device.

There are benefits to individuals using their own devices rather than being forced to use a company-supplied unit and whilst there are the obvious cost savings for companies, often the hidden costs of technical support and data security are overlooked.

4. Crowd Sourcing

This term is often mistaken for Crowd Funding, where many hundreds or even thousands of people put small amounts of money into a company as shareholders in order to gain financial returns if the company becomes successful.

The term CrowdSource is used in a similar way, in that a vast amount of people and their devices send information to a central source that aggregates all the data together, to form a bigger picture, and to enhance a provided service. An example would be a navigation system, where the route plan is sourced from digital maps and GPS but, by overlaying crowdsourced data on traffic flows, reroutes or journeys and average speeds, taken from devices in vehicles, then fed back to the navigation systems and incorporated into the travel plan, allows them to dynamically route the journey to avoid congestion. It also eases the amount of traffic in an area for example, following an accident, as traffic will be routed around the incident until such time as traffic in the area clears or speeds up.

5. Credential Stuffing

Credential stuffing is a new form of attack to gain an account takeover through automated Internet attacks. It works by a hacker gaining access to a list of user ID’s and passwords and then systematically using each ID and password pair to log onto any website until they find a positive logon. Once gained they can take over the account and, if it is a financially interesting one such as a shopping site or bank, will proceed to exploit the user’s account.

Credential stuffing is dangerous to both consumers and enterprises because of the ripple effects of these breaches, such as system crashes due to the high volume of login attempts, loss of user confidence in online shopping and, possible loss of money both to a business or an individual.

6. GDPR

This stands for the General Data Protection Regulation that came into force in May 2018 and replaced the Data Protection Act. This regulation puts greater emphasis on companies to protect personally identifiable data and allow the data owner to have access to any data held on them by an organisation.

The regulation has improved the way data is stored and used and is being enforced by the Information Commissioner’s Office in the UK.

7. AI

AI stands for Artificial Intelligence and refers to the simulation of human intelligence in machines that are programmed to think like humans and mimic their actions, including learning and problem-solving.

The holy grail of Artificial Intelligence is for it to rationalise/balance ideas or issues and take actions that have the best chance of giving a positive outcome.

The fear is when or if AI takes away human controls, as it decides the human is not making the right decision. This might be fine on occasions but certainly not in others such as life or death situations.

8. Disruptive technology

This is a technology where its application significantly affects the way a market or industry functions. An example is The Internet. Pre The Internet, most of us visited shops to buy goods however, the introduction of the Internet significantly altered the way we shopped which saw the demise of busineses  unwilling to adapt to it.

9. Biometrics

The use of biometrics is a way to measure a person’s physical characteristics to verify their identity. It can include physiological traits, such as fingerprints, eyes, and voice, or behavioural characteristics, such as the unique way you type on a keyboard.

These characteristics are electronically stored and used to identify a person.

Biometrics can be blended together to form a very strong form of user authentication, vital in our digital world where user identity, in electronic form, is key for areas such as Internet banking.

10. Open Source

Originally referred to Open Source Software (OSS), It has now been shortened to Open Source, but remains software code that is designed to be publicly accessible so anyone can see, modify and distribute the code, as they see fit.

Unlike commercial software, such a Microsoft Word or Adobe Illustrator, it refers to code owned by the inventory/company with users paying to have access to it.

Confusion often arises as some Open Source code is offered ‘free of charge’ whilst for others, a paid-for licence is required.

In general, payment is requested when a company develops further Open Source code and then provides technical support or enhancements to that code.

If there are any other ‘Jargon’ related queries/questions you have or anything you are confused or concerned about in relation to Cyber Security please do not hesitate to get in touch and we will endeavour to help.

Oh no, it isn’t! Oh, yes it is!

All of us have experienced big changes in our lives thanks to Covid 19.  And, few of us will have failed to come up against the video conferencing phenomena, whether for business or as a way of communicating with friends.

TV channels have produced endless interviews featuring ‘professionals’ at home including cabinet ministers, pop stars, virtual choirs of 400 plus people, children’s birthday parties with entertainers, even Royalty had a go, all in little boxes on a screen!

And, whilst it may be jolly good fun, how many of us are thinking about what we are showing behind and around us? How we are opening up our homes to hackers or other ‘badies’ who get a chance to review what we have. It is so easy for them to take a screenshot and then take their time to process the image, zooming in on details which usually, would never be seen, unless you were inside the house.

Consider for example the personal information you may have on show. Individual’s photographs should be turned over so as to protect identity. Just think about the GDPR aspects of PII data, as this is still in scope for the regulation and could lead to a data breach and ICO investigation.

What is displayed behind you can say a lot about you and your hobbies. This is a good source of information for a hacker, who will use it to try and guess your password theme. For example, if you have a model of an E Type Jaguar and books on the history of the mark, there is a good chance your passwords might be linked to the brand.

A hacker can also gain information to furnish a phishing email campaign, using relevant information that it is likely that you will find of interest and therefore, more likely to click on a link. If you have a lot of books by a particular author for instance, you could be the target of a phishing campaign with content relevant to that author, including a call to action that you can’t resist.

And, often when online, other technology used in the house can be seen. Printers are often in view giving a hacker a head start about routes to hack, by sending a spoof message appearing to come from your printer manufacturer or known backdoors in devices, to allow for remote connections.

On-line visual communications are here to stay so we must get better at thinking about what others can see behind us, ensuring that we are happy to share that information. When in doubt, keep it simple, use a pale wall to frame your background, make sure you are the star not the information you are giving away unknowingly!