Coronavirus – How can we help?

Covid-19 is in the news throughout the day, social media alerts on every platform. We are now officially in ‘Lockdown’ and we need to make sure as many of our employees can work from home, safely & securely.

How can we help your business continuity in uncertain times?

As a remote worker myself; I know of the many benefits this can bring but also know that you need to make sure that you have the right security parameters in place to make working from home as seamless and secure as possible.

If your business does not currently have facilities to offer home working to your staff, Digital Pathways are offering a FREE service to identify and scope out what would be required to facilitate remote working, as well as for those businesses that are looking to expand their current set up to add additional homeworkers to an already existing solution.

Please be aware!!!

We are hearing of increased threats and cyber-attacks taking place with regard to email phishing, scam emails and hackers utilising weak security defences on unsecured networks as more and more people are working from home.

One particular email supposedly coming from Public Health England offering a free hand sanitiser if you click the link.

Please DO NOT click links unless you can confirm it is from a reliable source, check this by hovering over the email sender.

More information and guidelines are available here in our recent blog on email scams.

How we can help

If your organisation already has the facilities for remote working, we can help with:-

• Increasing licences or adding more connections.
• Access Control
• Additional hardware requirements.
• Two Factor Authentication  (2FA/MFA) to help with securing remote access.
• Endpoint security
• Encryption solutions including device, cloud, application and email encryption
• Advanced Threat Detection and Vulnerability Management

If your organisation is looking at a remote working environment for your staff and don’t know where to start

We can help

• With a scoping exercise to identify what would be needed to facilitate secure remote access and home working
• With identifying any additional equipment or hardware that might be needed
• With email protection
• With endpoint protection
• With security monitoring
• With staff online training for working from home

We also have a range of Managed Security Services for businesses that do not have any internal security resource.

During this time of uncertainty and concerns we are offering a FREE scoping exercise to all businesses in need of assistance in preparation, planning and projects to enable remote working environments.

If you have any concerns about remote working or need any advice or recommendations on working from home securely or are looking to put in place the facilities for your teams to be able to work from home securely and efficiently, please do not hesitate to get in touch either call 0844 586 0040 or email [email protected]. We are here to help in these uncertain times.

 

 

Given a security camera or voice-activated device this Christmas?  Here’s what you need to know!

The ultimate Christmas present and just what you always wanted, a voice-activated device to cater to your every command and a security camera tool to help keep you, your family or your business safe.

Hoorah!

You’ve set them up and are enjoying making use of their many benefits.

If you work from home or are using your new connected device in a corporate environment, please be aware.

Do you know who else is using them too? 

No, not other members of your family, not even friends. Total strangers, hackers, yes, hackers!

There have been several reported incidents recently, mainly in the USA, where hackers have gained access to these devices and have been able to monitor activity within the home and even to speak directly to children in their own bedrooms. Very scary stuff indeed.

Such devices are often not designed with security as a key feature as it is not as sexy as having a high-resolution camera or massive storage capabilities. Also, a low price point, when it comes to sales, means features are removed and sadly, security is often one of those to go or to be reduced in scope or quality.

So, if you have been the recipient of such a device, here are some essential steps to take, in order to ensure the hackers don’t invite themselves into your home.

1. Check your security settings. Any quality device will allow you to view the security options and make changes. Never leave a device at ‘factory settings’ as these are the starting point for any hacker attack.
2. Look at the passwords you are using.  Passwords should be strong, that is to say that they should, ideally, be long, include upper and lower case letters, numerals and special characters.  Try to avoid personal information and do not fall into the trap of opting for your birthday or pets name!  Default passwords should be changed immediately.
3. And, ensure that you regularly review and change your passwords.
4. If you find it hard to think of suitable passwords or have difficulty in remembering them, try using a password manager such as LastPass. These services can generate strong passwords for you as well as storing them, where only you have access.
5. Definitely establish two-factor authentication security, if an option. This process involves you not only entering a strong password but also a unique, one time used password, which is sent via text or a code and taken from your Smartphone.  This code is then used to establish your identity. These password generators are often free and are available from many companies such as Google and Microsoft.
6. A voice-activated device will usually connect to your internal network to gain access to the worldwide web, so always check your router settings and ensure you have enabled strong passwords and encryption (you will see terms such as WEP in your settings for the encryption).
7. Be aware of any device being activated in an unusual or unexpected manner. If you have not sent instructions for it to do something, it is possible that someone else did.
8. Check your router’s activity log to see if any device is communicating out to the world wide web. This could indicate your device has been compromised and is sending out your personal data. Or, it could be being used along with thousands of other devices to be used to attack other web sites, as was the case with Spotify, Netflix, and PayPal, who were temporarily shut down due to such an attack.
9. Switch off any features you don’t need on a device or router such as remote access. Many options appear as default settings. The less that are enabled, the smaller the attack footprint there will be.
10. Change the device or router name so it does not identify the manufacturer or ISP, this makes it harder to identify from the outside. Also never use your surname or address as an identifier, this will expose your personal information which could be used against you

Words of wisdom from Colin Tankard, our Managing Director at Digital Pathways,

“These voice-activated devices have become commonplace in many of our homes and are a useful and helpful addition. However, we must consider their downsides too. Remember, many of these devices are driven by voice command and consequently, are also listening. There have been accusations of companies ‘listening’ in, storing data in order to send through tailored advertisements.”

“A voice-activated device and systems that monitor activity, such as CCTV, are good at alerting you to intruders but they are two-way and can be used by outsiders to watch you. So when installing these, consider not only all of the security steps above but also, where you locate them. If your device is compromised you might not want your bedroom or bathroom activities seen!

“Such technology is only likely to grow and evolve.  The onus of keeping safe must rest with us. Employ the simple password control strategy backed up with two-factor authentication and you are in a much safer space.”

Cybercrime is an increasing threat to both business and the individual.  In fact, it is estimated at currently costing some £4billion per annum, a figure that will continue to grow.

As a result, there have been a plethora of defence solutions flooding the market place and this has caused its own difficulties, in that the cyber defence solutions environment now requires significant maintenance, relying on a limited skill pool.

On top of this, regular routine tasks like reconfiguration, additions, conversions and migrations have become increasingly time-consuming and expensive.

Subsequently, not only have costs have been rising but the defence environment has become hard to both manage and control.

Help Is Available

SIEM systems help, providing a way to manage, correlate and deliver context from the many alerts generated by normal and abnormal network activities. It is often bolstered by Security Orchestration, Automation and Response (SOAR), which leverages the power of automation to add consistency in operational security processes and can provide huge cost savings and efficiencies.

 A Universal Cyber Defence Platform

But now, Digital Pathways can offer a universal cyber defence management platform to meet these challenges.

The iCyber-Shield Platform can:

*   Reduce the cost of defence maintenance and management

*   Reduce the meantime to detect and react to threats by at least 70%

*   Give total one-stop management control of all cyber defence resources

*   Efficiently and economically manage change

*   Enable a platform for migration of devices and systems without downtime or risk

*   Allow best of breed choices

*   Control custom application and legacy devices

*   Facilitate the automation of many cyber defence tasks

*   Ensure compliance to regulation (PCI etc).

It provides the ability to view and manage all cyber defence resources through one ‘pane of glass’, as well as exercising control, which makes the execution of routine tasks such as reconfiguration, migration and extension virtually a ‘one-click’ operation.

It also introduces the capability of automation of routine processes and the possibility of AI guided defence management actions to improve threat detection and resistance.

Through ‘Playbooks’ we can enable the threat landscape faced by any organisation to be handled in a way that matches business dynamics on a day-to-day basis. For example, during peak times the drive to take off-line critical systems can be outweighed by business drivers. In these cases, an alternative approach to protection might be required, such as introducing a ‘honeypot’ to divert the attack, giving the organisation time to deal with the threat, whilst maintaining a level of business continuity.

 Gaining Control

The iCyber-Shield capability will enable enterprises to gain control and management of their cyber defence environment economically, and effectively, thus dramatically reducing the risk of damaging and expensive cyber attacks.

If you are looking for a single ‘pane of glass’ cyber defence solution, this could be the answer.

 

 

Artificial Intelligence (AI) and Machine Learning (ML) in Cybersecurity

The buzzwords, Artificial Intelligence (AI) and Machine Learning (ML) are often interchanged. However, they are not the same thing, which can lead to confusion.

What is Machine Learning?

Machine Learning is a type of Artificial Intelligence (AI) that allows software applications to become more accurate in predicting outcomes, without being explicitly programmed.

What is Artificial Intelligence?

Artificial Intelligence (AI) is the process of simulating human intelligence, using machines, especially computer systems. The process includes learning (the acquisition of information and rules for using the information), reasoning (using the rules to reach approximate or definite conclusions) and self-correction.

AI is already used in many circumstances including in our buildings. For example, to control the environmental needs of people working within an office where, by monitoring of the volume of people in any area, AI can control whether or not the air-conditioning should be switched on or, if the lowering of shades or the opening of windows, will suffice.

And, AI will continue to expand into our daily business and personal lives.

Can Artificial Intelligence (AI) programmes ‘go rogue’?

But, although the benefits look good, there is a fear that such AI programmes could ‘go rogue’ and turn on us or, be hacked by other AI programmes.

Hackers love Artificial Intelligence (AI) and Machine Learning (ML) as much as everyone else in the technology space and are increasingly using it to improve their phishing attacks. The need for innovative and robust data security therefore becomes even more important.

Imagine a hacker taking over a building’s security system by accessing the system’s intelligence and having all key personnel move to one room, under the auspice of a ‘gunman threat’. Once the key people are in the room, through the AI’s skill in facial identification, it is locked by the system and ransom threats sent to all the computer screens in the building, using Ransomware tactics, to make people react quickly i.e. ‘the ticking count down clock’.

Although AI looks good, many of our current systems are not so ‘smart’ and use old technology. Simply bolting on AI will not give the perceived benefits, as it will be held back by the lack of integration. Given the high cost of system replacement, such as Heating Ventilation Air Conditioning (HVAC), it will be sometime before there are the platforms available to exploit the benefits of AI.

The GDPR and Artifical Intelligence (AI) Conundrum

The General Data Protection Regulation (GDPR )poses another conundrum. Will it be permissible to A let a user give an application permission to make automated decisions on their behalf, such as recommendation systems? These were first implemented in music content sites but now extend to many different industries.

For example, the AI system may learn of a user’s content preferences and push content that fits those criteria. This can help companies reduce bounce rate, by keeping the user interested. Likewise, you can use the information learned by your AI to craft better-targeted content to users with similar interests.

However, GDPR will see the AI application as holding User Personally Identifiable Information (PII), which might include age, gender and location, to present the information it has learnt from one user to others, with similar profiles. The GDPR requires that the data be secure and used appropriately. But, with the AI program constantly learning and sampling data, this becomes a problem.

And, if a user does give permission for their data to be modelled, will it be accompanied by a comprehensible explanation of how the AI makes decisions and how these decisions may impact that user? This would be very difficult to achieve as GDPR calls for ‘clear language’ and AI code learning is far from easy to explain.

From a technical perspective, the level of granularity GDPR requires, in explaining automated decisions, is unclear. Until the picture is clarified, some innovators may choose to forge ahead with super algorithms. Others, worryingly, may ban European citizens from using some highly valuable functionality.

Three laws of robotics

When thinking about automating important decisions and giving high-stake autonomy to AI machines, particular attention should be given to constraining their behaviour by defining what is desired, what is acceptable and what is not acceptable. This is what the Three Laws of Robotics of the science-fiction writer, Isaac Asimov, say:

1. A robot may not injure a human being or, through inaction, allow a human being to come to harm
2. A robot must obey the orders given by human beings, except where such orders would conflict with the First Law
3. A robot must protect its own existence as long as such protection does not conflict with the First or Second Laws.

The need for human intervention

AI power will need to be controlled and the three Laws of Robots need to be the mantra for AI programs. It should be mandated in all code that the AI programs should ask for human intervention when unusual situations are detected, or when the computed uncertainty in predictions/decisions, is above a certain threshold. This may go against the vision of AI, but until we can have total trust in the underlying code being used to develop it, we must show caution. Remember, humans, are still writing the code and can make mistakes or, more worryingly, add code that will allow for future control of the AI, for malicious means.

It is almost impossible to say how an organisation can have trust in any AI unless they have access to the source code and the ability, or contacts, to read and debug it. As AI is introduced it will fall on the facilities teams to question what level of code review has been undertaken within the AI module. This might be possible if the designer of the AI is a large vendor who can show in-depth test results and other customer implementations but, most AI vendors leading the technology revolution are small and do not have the client base, or the volume, of test data.

At this point, a difficult decision needs to be taken by management as to how far they ‘dip their toe’ into AI. A bit like autonomous cars, they do work but governments are still wary of allowing legislation to be brought in, to allow the technology.

AI is with us and will increasingly be integrated into our lives. Whilst the potential benefits are far-reaching, making lives better, the environment cleaner and providing efficiency to our personal and business lives, we must be aware of the possible threats it can create and take the appropriate action from the very beginning.

Need advice on Artificial Intelligence and Machine Learning? 

Every organisation can benefit from added protection if you have concerns with regard to Artifical Intelligence and Machine Learning give us a call on 0844 586 0040, or email [email protected], and we’ll be happy to advise you.

The term a ‘man in the middle attack’ is becoming well known as more instances of them take place.

What is a ‘Man in the middle attack’?

What exactly does ‘man in the middle attack’ mean?  It is when a cyber-criminal secretly intercepts and possibly alters communication between two parties, who both believe they are directly communicating with each other.

A common example is where the cyber-criminal uses bogus emails to trick solicitors into issuing the proceeds of a house sale, to their own bank account, rather than the bona fide person.

Another example, is where an Internet connection is intercepted, often by a user not checking that they are using a valid Wi-Fi. The hacker uses a device to emulate the valid Wi-Fi in, say, a hotel and the unsuspecting victim connects to this. The hacker allows them to browse as normal until the victim goes to a site of interest, such as a bank account. Then the hacker will allow the user to log on to their account but will break the connection to the victim keeping the link to the bank open. The victim thinks the connection was lost due to the hotels’ poor Wi-Fi but the hacker continues to empty the victim’s bank account.

These kinds of attacks highlight weaknesses in an organisation’s data security strategy. Either the business has been hacked with malware, which allows the monitoring of systems, it may be due to an insider attack, where someone with internal system access is selling information to third parties, or simply poor user education or monitoring.

Data protection rackets

Increasingly today, incidents of data protection rackets, where malware is embedded and cunningly hidden, are being reported.  These attacks are designed to be undetected by the organisation and the data held by the organisation scanned. The objective is, that when valuable data is found or a file changed, such as an intellectual property modification, the content is sent to the hacker who can then sell on the information to competitors. Another data mine is where an organisation is bidding for a large contract and the hacker gains access to the proposal and sells it to other competitor bidders, so they can undercut. Over time the hacker might make the organisation aware of its activities and use this, just like the old fashioned protection rackets during the prohibition era, demanding money not to send out information.

And, a ‘man in the middle attack’ is not confined to email correspondence. It could also include voice communications, as most telephone systems use VOIP (Voice Over Internet Protocol).

Systems must be strengthened

Steps must be taken to strengthen systems against such attacks. Strong internal controls and audit procedures are needed in order to stop malware infiltrating systems in the first place, taking over the network.

Adopting advanced threat protection is vital as it stops bad processes starting, instantly blocking malware attacks. It can signal any unusual behaviour of staff and systems i.e. showing when an application is sending out data when it should not.

And of course, robust internal controls and checks should be employed when using support companies as well as the checking of system logs and user access, to understand who is touching the data, ensuring that access to it is normal. Anything odd should raise a flag.

Emails should be secure, especially if personally identifiable information is being sent and use clarification techniques, such as send and receive reports. These should not be under the control of the receiver, such as in Outlook, where a receiver can block read receipts.

Adopting Cyber Essentials Plus

The Cyber Essentials Plus Certification can offer solutions too. A government information assurance scheme, operated by the National Cyber Security Centre (NCSC), launched in 2014 and has become a key element of excellence for cybersecurity, in all its forms.

It does this by encouraging organisations to adopt good practice in information security and includes a simple set of security controls to protect information from threats coming from the Internet.

The Cyber Essentials Plus Certification requires verification of cybersecurity, carried out independently by a Certification Body, a more rigorous form of certification.

Joining up to the scheme can ensure that systems are regularly assessed and weaknesses dealt with so as to stop any security breaches, not just ‘man in the middle’.

Every organisation can benefit from added protection.

Give us a call on 0844 586 0040, or email [email protected], and we’ll be happy to advise you.