SMB Cyber Security Challenges and Solutions

SMB Cybersecurity challenges

 

SMB businesses face a unique challenge in terms of the cybersecurity landscape. They are increasingly being targeted by cyber attackers because of their weaker cybersecurity defences and the fact that they may be an easy back door into a large enterprise’s network.  

It is evident that the best approach to enabling a robust and effective security posture is to coordinate personnel, processes and technology to work in harmony and effect the maximum effectiveness. In this respect SMB businesses have specific challenges to overcome which can include; 

  • Lack of talented personnel – this is a problem that large enterprises also have but it is magnified in SMBs 
  • Complexity – integrating security systems can be a complex task especially in the typical environment where there are multiple disparate vendor systems. In truth sometimes, a single vendor solution has its own compatibility issues 
  • Executive Commitment – there is still a high level of inertia at executive level wrt committing to resource for cybersecurity. It’s like an insurance policy, it proves its worth only when you have an incident – but in many cases, this could be too late 

Mobile Challenge 

Businesses have recognised that there is a major challenge around mobility and the shift to mobile working as well as the workspace embracing mobile devices. At least 50% of IT Security teams consider protection of mobile-based threats to be very challenging.  

To overcome the mobile challenge and also as a means of bolstering security without increasing resources many security teams are turning to the cloud. In fact, some 70% of SMB businesses now host some workloads in the cloud and of those surveyed, 68% have said they did so to improve the security. Other benefits included scalability and reduced administration, but the number one reason was security. This is good providing the businesses understand their own obligations to secure user access and data in the cloud – something that a cloud provider will not be responsible. Also, there is the question of how the cloud providers security process may interoperate with the customers process to ensure incidents are alerted immediately and there is a clear demarcation of responsibilities. The NCSC have published some good guidance on selecting cloud providers. 

Personnel Challenges 

Many businesses face a shortage of trained and skilled security personnel that are able to analyse security incidents in a timely and implement the necessary mitigation. In fact, surveys have revealed that over 50% of security alerts/events are being ignored. 

An increasing trend to solve this challenge is to outsource security analyst tasks to a cloud or specialist security provider. In this way the business can effect specialist level assistance without having to try and employ security personnel in a market where the shortage is increasing – a challenge faced also by vendors and large enterprise. If outsourcing works well, they can get rapid, impartial analysis and recommendation. 

Establishing the capabilities and suitability of the specialist provider is in itself a challenge because the security teams need to understand what will constitute a good service both from a process and technical level. 

Another approach being taken to mitigate the skills shortage it to employ AI and Machine Learning. This technology is increasingly being deployed to detect and respond to anomalies at machine speed, giving greater protection against new attacks. 

The Takeaway 

The challenges faced by SMBs given a strategic approach can be addressed over time with a combination of people, processes and technology. Going forward it is important for SMBs to drive incremental improvements in cybersecurity especially in the context of a strategy. Different layers of security can be improved over time in line with budgets and therefore the gains can be consolidated over time.

Cloud Security Webinar

3 Cyber Attacks Affecting Small-Medium Businesses [2018]

CyberAttacks SMB

According to a recent benchmark survey, more than 50% of all cyber attacks result in financial damages of more than $500,000

Which could include lost revenue, lost customers, lost opportunities, and out-of-pocket expenses. This level of damage is enough to put many small and medium-sized businesses out of operation permanently.  

 

Cyber attackers are increasingly focusing their attention on SMB businesses as they see them as a soft target with less sophisticated cybersecurity protection and a lack of in-house skills to defend from attacks. In addition, SMBs are oftentimes targeted as a route to initiate attacks on the more lucrative larger enterprise business where they expect to get access to a potential treasure trove of data. Exploiting the less sophisticated defences of SMBs is often an easier option than the more sophisticated and greater resources that may face attackers of enterprise businesses. 

 

Another unsurprising statistic taken from business surveys stated that more 50% of businesses would become unprofitable within a month of if they lost access to essential data. 

 

Downtime after an attack was also a major issue, 40% of businesses that experienced a cyber attack experienced downtime of more than 8 hours and the attack took down more than half their systems. Because of the interconnected nature of SMB networks, an attack on one system can quickly spread throughout the business and impact other systems.  

 

SMB organisations worry most about these 3 things 

  • A well-crafted phishing attack targeting an individual 
  • Advanced persistent threats such as unknown malware 
  • Ransomware 

 

There were many other concerns that ranked closely behind the ones highlighted. These included cloud computing, proliferation of mobile devices, insider data exfiltration and compliance constraints to name a few. 

 

SMBs that experience a Ransomware oftentimes pay the ransom because they typically do not have the expertise to recover the data and are also unable to operate their business without access to data for a sustained period of time. 

 

A new and fast-growing threat is crypto mining, where attackers drop malware on endpoints and use their resources for crypto mining which can be lucrative as well as largely untraceable. There is also less likelihood of a criminal prosecution if they are caught. 

 

The threat of insiders though relatively small is quite significant and needs growing attention. The survey found that approximately 0.5% of users posed an inside threat. As businesses move towards cloud computing, the potential for losing valuable intellectual property increases dramatically because SMBs are not as savvy about implementing cloud security as their large enterprise cousins. The proliferation of cloud has seen security Data Centre systems reworked into a cloud platform but with very little thought about security. There is also a misunderstanding about where security responsibility lies for cloud data in terms of what the service and the customer is responsible. 

 

Our next blog will provide more insights into SMB security challenges and what the could be doing to overcome them. In the meantime check out 10 Ways To Secure Your Business From Cyber Attacks

8 Steps To Secure Your Network

How to secure a network

Do you ignore your network or infrastructure? An unprotected network is akin to having a road network with no speed cameras, no CCTV, no traffic lights and no pedestrian crossings. It might be nice for a short while but pretty soon chaos will reign.

 

Cybersecurity is most effective when there is a synergy between policies, procedures and technology working in sync to provide the maximum available protection. There is generally a lot of focus on endpoint protection as there should be, it is the most common point of infiltration and compromise.

 

Implementing network security is an essential component in your security architecture and a way of creating layers of security that give some confidence that you have multiple ways of stopping attacks. 

 

These are some of the important network security best practices you can implement right now, many of which won’t even cost you any extra expenditure.

 

  1. Protect local passwords – password access to your infrastructure devices should be protected, default logins should be changed with a strong password policy as well as encryption so that a copy of the configuration does not also reveal the password

 

2. Notification banner – you should create login notification banners so that all connections to the device are aware that they need to be authorised to access the device

 

3. Use authentication servers – making use of authentication servers enables proper control and auditing of who is logging in and what they are doing. Authentication servers also have the capability to be quite granular enabling you to be prescriptive about what people can or can’t do when they log in to your network. This is especially useful for tracking any of your contractors

 

4. Admin access – administrator access should be restricted and monitored, a limited number of users should have administrator access to a system. The administrator access should also be audited via an authentication server. Administrator privileges should immediately be removed for a user who no longer requires them

 

5. Disable unused services – network devices by default will have a range of services switched on and accessible, most of this is legacy and many of these services are not generally required. Unnecessary services should be disabled as a matter of policy because they can be exploited to compromise your security

 

6. Access control – access to your network should be controlled, shadow IT is a growing threat to IT security, one way to combat this is to disable unused network ports and limit connections to known devices. In addition, the use of access control lists on routers/firewalls is a must to ensure that you are only allowing traffic that is legitimate. This feature alone could contain the spread of virus/malware across devices

 

7. Maintain accurate time – ensuring all systems are synced at the same time is good practice for a number of reasons. Incorrect time and date could stop systems from working due to certificate invalidity, in addition, event correlation depends on accurate time so in the event of a breach investigation, precise correlation of events will be impossible

 

8. Maintain good logging – logging of events provides vital operational information as well as retrospective investigation. Logging is often a blind spot for many organisations – there is no longer an excuse as there are inexpensive solutions available for both on-premises or cloud-based logging services                                                                                                            

 

A common theme about security implementation is that many features available on deployed systems are not enabled for a multitude of reasons, time being the primary one. Many of the features highlighted above are included for free in most business-grade solutions and therefore implementing a good level of network security is actually not too high a mountain to climb.

Cisco Umbrella, DNS security

How to deploy next-gen endpoint protection- 10 key features

endpoint protection

Learn 10 endpoint protection features you should have in place to secure your business.

Anti virus protection has been one of the staples of cybersecurity protection every since virus attacks were spawned in the 90s.  

 

AV protection alone is no longer good enough because most vendors say they are effective against 99% of attacks which means at some stage they will be victims of a successful attack. That 1% of attacks use advanced techniques to breach security such as exploiting legitimate processes, or fileless malware injected when you visit an infected website. 

 

Endpoint protection is no longer a case to deploy and forget given the constantly changing nature of attacks. Modern endpoint protection now needs to eliminate blind spots and block unknown threats as well as stop known malware. 

 

Given that nearly all attacks must involve endpoint compromise at some stage, getting this component of the security solution right can go a long way towards ensuring your security posture is as high as it can be. 

 

A good endpoint protection solution should be agile and have elements of automation to ensure known and unknown threats are blocked. Some of the important features that need to be in place are outlined below. 

 

  1. Next Generation AV capability – endpoint protections systems need enhanced AV capability which has the ability to detect new attacks in real time – it, therefore, needs to look at behaviour and not just signatures of known attacks #
  2. Use multiple malware detection techniques – effective protection against malware needs multiple detection and protection techniques, these could include AV type signatures, fileless malware detection, sandboxing, machine learning, cloud lookup, vulnerable software classification and more. The more techniques the better as long as functionality is not compromised 
  3. Prevent fileless malware – most malware is carried in regular attachments such as word, pdf, excel however emerging attacks are fileless and endpoint protection needs to protect against attempts to hijack legitimate applications 
  4. Endpoint Detection and response – endpoint detection now needs to be more than responding after the event and after the attack has occurred. The solution does need to monitor all activities on the endpoint and be able to identify the beginnings of an attack based on unusual behaviour and respond accordingly. This will apply especially for new/unknown attacks that are appearing for the first time, signature-based techniques alone will not protect against these 
  5. Cloud Intelligence feed – the dynamic nature of attacks means that malware can use resources spun up and torn down on public cloud infrastructure in minutes, new endpoint protection systems need also to access constant feeds of threat updates from intelligence systems and specialist threat hunters 
  6. Cloud architecture – use a cloud-based architecture to make use of big data and up to date intelligence feeds. Also, enable user base to scale up seamlessly across fixed and remote locations as well as mobile clients.
  7. Share Intelligence across systems – once malware is detected on endpoint security systems the information should be shared with other systems such as email/web/network security devices to prevent further attempts or infection. The endpoint security should also be able to take feeds from these systems 
  8. Protect all endpoint types – all systems accessing data should be comprehensively protected, this must include Windows/MAC/Linux/Android and iOS especially given that mobile devices account for over 50% of web access 
  9. Dynamic analysis and sandboxing – unknown threats detection can be greatly enhanced with the ability to execute and test malware in a sandbox environment, the results can be fed back to endpoint protection 
  10. Log everything – a logging solution should be in place and logs from all critical assets sent to the logging solution. This will provide an invaluable tool for any future analysis especially when a breach occurs 

Surveys have indicated that most security systems have only a small subset of their features activated. Oftentimes features are not activated due to lack of knowledge or concerns that it may affect performance. Sometimes costs may be an issue because some features require additional licencing.

 

Not enabling features needs to be weighed up against the impact of a successful breach for which the costs in terms of financial, reputational and confidence may well outweigh the costs of doing it properly in the first place.

Cisco Umbrella

Be more GDPR compliant– tune up your Next Generation Firewall?

GDPR | Next Generation Firewall

Does effective cyber security protection and GDPR compliance mean that existing solutions will need replacing?

That depends on what you have deployed and how you have configured it. The changing nature of the cyber security threat does call for an agile and adaptable protection approach that will increasingly make use of automation and machine learning. In addition, the requires of GDPR call for an effective cyber security regime that protects data effectively and has monitoring and detection systems in place. 

 

A comprehensive approach requires multiple layers of protection not just to address the different types and areas of threats but also to provide an element of redundancy. Threats that may not have been picked up by say your endpoint protection solution may be detected by your network layer security solution for example. Research has indicated that most deployed security products only 10% of their features enabled and correctly configured.  

 

While some features just may not be relevant for a particular deployment, the main reasons why many businesses just don’t switch these features on include;  

  • Difficulty configuring the features
  • Lack of adequate skill set
  • Concerns it will slow down performance
  • Don’t understand how the features will benefit them 

 

It’s worth flipping the conversation on its head and viewing things in terms of the benefits, which once they are clear enough, turning on the required features becomes a no brainer. We are overwhelmed with all kind of statistics about the cost of cyber attacks – one startling one is a US government indicates that 75% of small business suffer a cyber breach, while the cost of the average cyber attack is over $1m. So, there are massive benefits to getting security right in terms of avoiding reputational damage and worst still sever financial costs or potential fines.  

 

Going back to the original question – do you need to replace the solutions already deployed. First, you need to look at what you have, how its configured and how much more you can do with it.  

 

A good area to start with is your firewall, if you have a well-featured Next Generation Firewall (NGFW) in place, you just need to make sure it is configured for maximum protection. Here are some of the features you need to enable to make it close to 90% effective – if you don’t enable them it would be analogous to having keys to all your business premises doors and windows but leaving all but a few ajar. 

1. Turn on Intrusion Protection Systems (IPS)

By default, your NGFW may have intrusion detection enabled (IDS) but given that most people don’t understand the alerts even if they are monitoring them, it’s worth automating the protection by enabling IPS.  You can implement a IPS to block attacks such as worms, virus and downloadable exploits/attachments.

 2. Enable network-based anti-virus protection

The feature will use deep packet inspection to identify threats. This is particularly useful to have a second bite at stopping threats not picked up by endpoint security. Also, some devices such as IoT types devices may be more vulnerable to such an attack but are unable to run anti-virus software. 

 3. Enable Malware protection

Malware may not be blocked by other technologies such as IPS or AV and therefore a good anti-malware engine must be deployed to help in the fight against this principal threat. Next Generation Firewall malware protection features can include indications of compromise based on event correlation, site reputation and sandboxing reports. 

 4. Use security intelligence feeds

This feature enables integration of near real-time global intelligence feeds to identify and block bad domains and emerging malware sites before they cause damage 

 5. Enable Sandboxing

Sandboxing is a useful tool in identifying and preventing attacks, it provides the ability to run and analyse executable code in an isolated environment. The results can be fed back to the NGFW to block or allow a file

6. User and Application Control

Compliance regulations mandate auditing capability that logs who, what, when users are accessing systems. You can configure a Next Generation Firewall to log and control what your users are doing and when they are allowed to. Importantly it can also manage and minimise the impact of non-productivity applications such as Netflix during business hours. 

7. Web Filtering and Protection

Blocks individual sites or categories that are either suspect or have no business relevance e.g. adult content, job portals etc. Suspect sites are also commonly used to inject malware onto unsuspecting visitors.

8. Segmentation of the network

Segment your internal networks into logical groups and protect each segment via an interface on your Next Generation Firewall. That way you will protect against lateral spread if a virus/malware gets in.

9. Log everything

A logging solution should be in place and logs from all critical assets sent to the logging solution. This will provide an invaluable tool for any future analysis especially when a breach occurs 

 

 

If you are not utilising the above capabilities it will leave you susceptible to threats that could otherwise have been mitigated. Make sure your security team is familiar with Next Generation Firewall capabilities and take full advantage of the available features to ensure your network is protected against the full spectrum of threats. Get more bang for your NGFW buck.

Free eBook: A View of the Cybercrime Threat Landscape

 

$2,235,018 per year

The average amount SMBs spent in the aftermath of a
cyber attack or data breach due to damage or theft of IT
assets and disruption to normal operations.

The amount is staggering, and enough to jeopardize the viability of
many companies. Yet the business benefits that come with the internet,
Cloud computing and other applications are impossible to forego
and remain competitive.

That’s why business owners and executives are asking one question:

  • Is our internet safe?

If your service provider can’t demonstrate how it is making you
company less likely to become a victim of cybercrime, then it is time
to consider alternatives.

In this eBook, we’ll outline what companies are up against
today, and how Cisco Umbrella can help bring you peace of mind.

Download the eBook here!

5 Key Cyber Security Elements For Your Business

Digitisation has meant the wholesale adoption of cloud services.

We are going to cover 5 key cyber security elements to help your business navigate the changing IT landscape. These elements are;

  1. Automation
  2. Lifecycle Approach
  3. Integrated Systems
  4. Layered Architecture
  5. Insight and Analytics

Digitisation is solving problems, creating opportunities and rewriting the way in which your business engages with your customers. At the forefront of the cloud services revolution is storage and SaaS. These functions give you the ability to design, build and deploy a new application. This is happening right now at unprecedented speed and scale.  

Cloud services bring with it great flexibility to your business along with a number of other benefits. While at the same time extending the cyber security attack surface and hence opportunities that the ‘bad guys’ have to compromise your users and data. At the same time, the sophistication of attacks is increasing as attackers take advantage of the very benefits that attracted you to the cloud.

Attackers have access to stolen credentials, host malware on legitimate cloud platforms such as AWS, Google and can generate legitimate certificates for illegitimate purposes thus appearing to be credible.

Your business needs a robust and advanced security architecture built on the back of an executive-sponsored cybersecurity policy to combat the threats. The security architecture needs to be an extension and enhancement of your existing security posture enabling seamless support of your users, data and applications anywhere they choose to work from.  

Surveying the common systems that you may already be deployed for cybersecurity protection, we are likely to see the following components; 

 

  • Perimeter Firewall – protecting your inside hosts from external threats/connections by using network address translation and stateful packet inspection 
  • Anti-Virus Protection – endpoint protection against known virus signatures 
  • Anti-Malware Protection – endpoint protection against known malware types 
  • Email Protection – scanning of email content to protect against malware attachments, phishing and spam  

 

As the IT systems and services landscape changes, it is necessary for your protection systems to be constantly reviewed and changes made where necessary to be relevant to the rapidly evolving landscape. The approach of IS teams to protection is evolving to the meet the emerging threats in the digitisation/cloud era whereby technology is now just a tool of the cybersecurity policy.

Your evolving approach should be about taking a holistic view that can adapt ahead of or in line with the threats. Five important elements of this evolving approach are outlined below. 

 

 

  • Automation – potential attacks now need to be stopped in their tracks automatically and cannot wait for attacks to be identified and mitigated by human interaction. In the digitisation, cybersecurity must have the ability to automatically learn about new threats and decide which ones to block while alerting the monitoring systems 

 

  • Lifecycle approach – security solutions must provide a methodology that addresses the 3 phases of a cyber attack, preventing attacks before they happen, detecting and blocking attacks in motion while also collecting details of security events through all phases in order to conduct detailed analysis and learn lessons from attacks 

 

  • Integrated systems – systems need to be integrated in order to share intelligence so that all components in the system of protection can update their configuration to reflect emerging threats and trends 

 

  • Layered Architecture – protection systems of necessity need to be based on a layered architecture thus following a methodology and approach designed around the business assets, priorities and policies. An architectural approach will incorporate multiple interconnected protection mechanisms and technologies to mitigate threats and stop attacks, such an approach will also provide the same levels of protection irrespective of whether a user is working remotely or on business premises 

 

  • Insight and Analytics – systems need to have a complete and comprehensive view of IS environment including who is connected, when and from where they are connected, and what they are doing. The system also needs to include incident and event monitoring to aid in an investigation of incidents and importantly provide the detailed information that may be required to report breaches of sensitive data under compliance regulations such as GDPR 

 

A number of new technologies have emerged which underpins the evolving approach to protection such as security internet gateway and cloud access security broker. These technologies and the role will be reviewed in our next blog.

Cisco Umbrella

10 Ways To Secure Your Business From Cyber Attacks

Cyber Attack

The cyber security threat landscape is constantly changing with the ever growing number and scale of attacks.  The consequent measures necessary to combat the threats need to be robust, comprehensive and agile. Simply put, it is about developing an effective approach and constantly testing and refining it. The sections below covers 10 essential recommended steps that should be taken to achieve a effective level of cybersecurity and is based on Guidance from NCSC.

Executive Risk Management

Because of the vital role that technology plays in most organisations today, information and their supporting systems need to properly categorised in the business risk profile. The impact of information and systems compromise could be more critical than many other types of business risks and result in reputational and financial damage.

It is important for the risks to be defined and communicated from executive level thus conveying the importance of information and systems.

Further essential steps that the Board should take include;

  • Establish a governance framework
  • Identify risks and approach to risk management
  • Apply standards and best practices
  • Educate users and maintain awareness
  • Constantly review policies

 

Education and Awareness

Training and awareness can help to establish a security conscious culture in the organisation. This could help to reduce the number of people clicking links in phishing emails or writing down passwords on post-it notes. Lack of awareness could result in; users connecting personal removable media that is compromised, users being subjects of phishing attacks, users seeing security as prohibitive and therefore trying to circumvent it. User ignorance to handling sensitive information may result in legal and regulatory sanction as will failure to report certain breaches.

Effective management of the user awareness risk include some of the following;

  • Create a user security policy as part of the overall corporate policy
  • Include cyber security in the staff induction – making them aware of their personal responsibilities to comply with the security policy
  • Security risk awareness – maintain awareness of ongoing security risks and guidance
  • Formal training and assessment – staff in security roles should embark on ongoing formal training and certification to keep up to date with the challenges they face
  • Incident reporting culture – enable staff to voice their concerns and report poor security practices

 

Secure Configuration

Systems that are not securely configured will be vulnerable to attack. A baseline secure configuration of all systems is essential to reduce risk of attacks and the potential for compromise. A lack of secure configurations and updated patching carries risks such as; unauthorised system changes occurring, exploitation of software bugs in unmatched systems and exploitation of insecure systems.

To avoid poor system configuration it is necessary for effective security controls be put in place such as the following;

  • Use supported software
  • Develop and implement policies to update and patch systems
  • Maintain hardware and software inventory
  • Maintain operating systems and software
  • Conduct regular vulnerability scans and act on results in a timely manner
  • Establish configuration  and control management
  • Implement white listing and positively identify software that can be executed
  • Limit privileged user accounts and user’s ability to change configurations

 

Network Security

Network connections could expose your systems and technologies to attack. A set of policies, architectural strategy and technical controls will help to reduce the chances of a successful attack which could include exploitation of systems, compromise of information in transit, propagation of malware, damage or illegal posting to corporate systems.

To effectively manage network security it is important to follow best practices and industry standard design principles at least.

All inbound and outbound traffic should be controlled, monitored and logged. This could be done with an advanced or next generation firewall, intrusion prevention techniques and anti-malware at the perimeter – in addition to endpoint anti-malware

Internal network protection is often ignored especially in the case of small networks. They should however include the following techniques

  • Segregate networks into groups based on functions and security roles
  • Secure wireless networks – only secure authorised devices should be allowed access to corporate networks
  • Secure administration – ensure administrative access is secure and defaults are changed
  • Monitor the network – monitor all traffic with intrusion prevention systems so that indications of attacks can be blocked and altered immediately
  • Testing and assurance- conduct regular penetration testing and simulate cyber attack exercises to ensure controls work

 

Managing User Privileges

Controlling user privileges to the correct level is important to ensure they have what they need to work effectively. Users with unnecessary rights should be avoided and is generally a major risk. If these accounts are compromised it could have a severe impact on your cyber security. Some of the potential harm that could be caused by such a compromise include; users could accidently or deliberately misuse their privileges and cause unauthorised information access

Attackers could also exploit these privileges to gain administrative level access and even negate security controls to increase the scope of their attack.

Some sensible steps that should be taken to manage these risks include;

  • Effective account management – manage the lifecycle of accounts from start to finish when staff leave, including temporary accounts
  • User authentication and access control – issue and enforce an effective password policy and incorporate two factor authentication for secure systems
  • Limit privileges – give users the minimum rights that they need
  • Limit the use of privilege accounts – limit the access to privileged rights and ensure administrators use normal accounts for standard business use
  • Monitor and logging – monitor user activity and log all events to an audit and accounting system for future analysis
  • Education – educate users of their responsibilities to adhere to corporate security policies

Incident Management

A security incident is inevitable for all organisations. An effective systems of incident management policies and processes will reduce any likely impact, enable speedier recovery and improve business resilience. Without an effective management system in place, some of the possible risks of an attack include;

  • Greater business impact of an attack through failure to realise the attack early enough and consequent slowness to respond resulting in more significant and ongoing impact
  • Potential for continuous or repeated disruption due to failure to find the root cause
  • Failure to conform with legal and regulatory standards which could result in financial penalties

It is important to manage the risk by taking some of the following steps;

  • Establish an incident management capability using in-house or specialist external service provider, create a plan and test its effectiveness.
  • Define reporting requirements
  • Define roles and arrange specialist training to ensure the correct skill base
  • Establish and regularly test a data recovery strategy including offsite recovery
  • Collect and analyse post incident evidence for root cause analysis, lessons learned and evidence for crime and/or compliance reporting

Malware Prevention

Malware is the most common form of security compromise and it is a fact that all organisations interact with known malware sites. The risk of malware can include; email with malicious content or links to malicious sites, web browsing to sites containing malicious content, introduction of malware through uncontrolled devices such as USB media or smartphones.

Inadequate controls for protection against malware could result in business disruption and/or loss of access to critical data.
Malware risks can be managed effectively using some of the following techniques;

  • Create and implement effective malware policies
  • Control import and export of data and incorporate malware scanning
  • Use blacklisting to block access to known malicious sites
  • Establish a defence in depth approach which includes security controls for endpoints, anti-virus, content filtering to detect malicious code, disable browser plugins and auto run features, ensure baseline security configurations are in place
  • Users should be educated regularly to understand the risk of malware, their role in preventing it and the procedure for incident reporting

Systems Monitoring

Systems monitoring provides the ability to determine how systems are being used and whether they have been attacked or compromised. No or poor monitoring prevents organisations from; detecting attacks against infrastructure or services, slows reaction to an attack resulting in increased severity of an attack, cause non compliance with legal or regulatory requirements
Systems monitoring risks can be prevented by taking the following steps;

  • Develop and implement a monitoring strategy based on the business risk assessment
  • Ensure that all systems are monitored, should include the ability to detect known attacks as well as having heuristic capabilities
  • Monitor network traffic to identify unusual traffic or large uncharacteristic data transfers
  • Monitor user activity for unauthorised use of systems
  • Fine tune monitoring systems to collect relevant events and alerts
  • Deploy a centralised logging solution with collection and analysis capability, and automated anomaly and high priority alerts
  • Align policies and processes to manage and respond to incidents detected by monitoring systems

Removable Media

Removable media such as USB memory devices are often involved in introduction of malware or removal of sensitive data. A comprehensive cyber security strategy must implement controls such as those listed below to effectively manage the risk posed.

  • Devise and implement a policy to govern the use of removable media. A standard for information exchanged on corporate systems should use appropriate and protected measures
  • If essential, the use of removable media should be limited only to designated devices
  • Automatically scan removable media for malware before any data transfer
  • Issue removable media formally to users and prohibit use of personal media sticks
  • Encrypt information at rest on removable media
  • Manage reuse and disposal of media to ensure data is effectively deleted or media destroyed and data retrieval prevented

Remote Working

Remote working for staff or remote support from suppliers is an effective and popular trend but can expose organisations to risk. Mobile working will necessitate the transfer of data across the Internet, sometimes to public spaces. These risks could lead to; loss or theft of data if mobile devices get stolen, compromise of credentials or data if screens are overlooked in public places, loss of user credentials if stored on a device, remote tampering through insertion of malware or monitoring of activity
Some of the recommended controls are listed below;

  • Create a robust policy to address the risk, this should include identifying who is authorised, what kind of information they can access, increased monitoring for remote connections
  • User training to include; awareness of the risks, securely storing and managing credentials, incident reporting
  • Develop and apply a secure baseline for remote devices
  • Encrypt data at rest and data in transit for remote/mobile devices

 

5 Basics of Cloud Security

The basic objective of a cloud security strategy is to provide a method to monitor and protect the flow of information to and from cloud hosted services. There has been and will continue to be a shift towards public and private cloud services as the age of digitisation is increasingly being embraced by organisations. 

 

According to Cisco’s Annual Cyber Security report, one of the principle reasons why organisations are deciding to host corporate applications in the cloud is increased security. 

 data security

On the other hand many small and medium organisations are adopting cloud technology without a clear strategy resulting in the blurring of edges of responsibility between the cloud provider and the organisation. In the eyes of cloud security providers, there are clear responsibilities and boundaries as illustrated in the graphic below. 

 

Security in the cloud is a shared responsibility: Cloud Security, DNS, IaaS PaaS Saas 

Cyber attackers are increasingly taking advantage of this blurring of the boundaries to exploit systems. It is important to undertake a proper risk assessment before cloud services are adopted. This will enable a clear understanding of the risks and a consequent strategy to mitigate the risks.  

 

The basic approach to cloud security will be based on the risk profile, it essentially needs to address the different phases of the cyber security threat, namely before, during and after an attack. It should be an extension of the organisations security approach to the on-premise information systems and data which generally address the question, who is allowed access to what information. 

 

Some of the key features that need to be addressed with a cloud cyber security approach include; 

  • Visibility and Control
  • Securing Cloud Applications
  • Extended Protection
  • Virtualise the Security Architecture
  • Threat intelligence

 

Visibility and Control 

Users will try to use whatever they can to get the job done. Organisations need visibility and control of what applications are being used in the cloud and remotely, especially with the growth of new SaaS applications. Visibility enables an understanding of what is being used in line with policy, what is out of policy and what is a threat. Visibility is the first step to controlling and securing the organisations environment based on what services should be provided. 

 

Securing Cloud applications 

As SaaS applications are increasingly being deployed in public clouds such as Amazon Web Services and Azure, it is vital to ensure that the cloud platform is secure. Even though the cloud providers will deploy their own security solutions, organisations also need to implement independent security systems to secure the user and the data as this is not the responsibility of the cloud provider. In it’s recent cyber security report, Cisco identified that a major growth area for cyber attacks was the misuse of legitimate cloud services to host malware. Hence the need to secure services in public clouds cannot be understated. 

 

Extended Protection

As remote connectivity and branch networking trends increase in popularity, the security solution should be adaptable to extend the necessary features such as firewalling, threat management and anti-malware capabilities to the edge of the network as opposed to the current centralised deployment model. This functionality should be provided on endpoints, remote connections and remote offices and vitally to devices working off site such as Internet Cafes. 

 

Virtualise the Security Architecture 

The need for security is now pervasive at the client, the branch, the HQ as well as public and private clouds where SaaS applications are located. This necessitates the capability for a virtualised security architecture where the panoply of security functionality can be deployed easily at any location. This approach also enables the organisation to scale security at speed which will meet business demands for rapid deployment of new services while avoiding security being an afterthought. 

 

Threat intelligence 

Most organisations deploy security components from multiple vendors. An intelligent approach to securing information and systems in the emerging environment must make use of threat intelligence to overcome any cross vendor incompatibilities. This is the ability to take intelligence feeds from other sources such as other security vendors feeds and make context based threat assessments relating to your organisation and what it means for you. This assessment can naturally feed into automated protection mechanisms. 

 

In our next blogs in this series, we will cover off some best practices approaches to cloud security and discuss some of the technologies being used. 

 

Penetration Test: the new cyber test in town

penetration test, cymulate

 

When was the last time you had a penetration test of your network or a vulnerability assessment? Penetration testing has traditionally been an annual event for most organisations. Of late we have seen vulnerability assessments delivered as a service with the ability to run tests on demand. Invariably vulnerability assessments are still run once a year oftentimes due to resource shortage and in many instances it’s just not a high priority because nothing bad has happened – or at least we are not aware of it. 

 

On the other hand, industry security statistics would indicate that the general approach to security could well be a disaster waiting to happen, or worst still a disaster that has happened but just not discovered yet. Yes we know that enterprise organisations and some medium sized organisations have a highly security regime in place and manage security according to best practices. Despite the efforts of the aforementioned organisations the numbers are still overwhelmingly in favour of the bad guys as illustrated below. 

 

  • 100% of organisations interact with known malware sites – simply put, everyone is likely to be infected at some stage 

 

  • 99 days average time to detect a breach of a pool of known vulnerabilities  

 

  • 4 hours average time it takes cyber attackers to steal data 

 

  • 365 days – time between vulnerability assessments and penetration tests 

 

For sure both vulnerability assessments and penetration test have proven to be valuable tools in the arsenal for protecting IT systems from compromise, but only when used effectively and frequently enough. 

 

One challenge however that either approach may find very difficult to keep up with is the rate of change as newer, more sophisticated and persistent threats and exploits appear on an almost daily basis. 

 

An emerging approach to confront the threats head on while enabling organisations to take the initiative is to deploy a solution that conducts a series of simulated attacks based on known and emerging threat vectors. With this type of approach, you can now address the question “how do you know your security systems are working?”.  

How many times have you seen a detailed and impressive list of access control lists only to be undone by the second to last line “permit ip any any”. 

 

Without comprehensive and persistent testing, any assurance of cyber security is based purely on assumption and best guess.  

Yes you have defences in place such as firewalls, endpoint security, anti-malware solutions but how do you know that they are really effective against known/unknown cyber threats. The assumption is that you have the right defences in place to protect from vulnerabilities and they security solutions are optimally configured. You only truly know for certain when an attempted breach has been attempted, detected and blocked. On the other hand you may have been hacked and you either never know or you don’t know for months after the event when the hackers have stolen day and moved on to other victims. 

 cyber security statistics

 

A simulated attack is a method of safely checking whether your systems are safe and your data is protected from vulnerabilities. The simulation can run a range of attack vectors to test your defences against a range of vulnerabilities. Simulated attacks that are successful will give you a clear understanding of your current vulnerabilities and how to mitigate them – it gives you actionable intelligence of the holes in your cyber defences. It can also validate the security controls that are in place and be used to test your security incident response procedures. Remember cyber defences is not just about preventing attacks, it’s also about what you do when the attacks occur to remediate and recover. 

 

A simulated attack service can also be used to undertake real time validation especially when changes are made or as you become aware of new vulnerabilities. When run as a cloud service, it can be run repeatedly to provide ongoing security posture assurance. A simulated attack service is definitely a service worth considering augmenting a comprehensive security posture assessment approach that includes penetration testing and vulnerability assessment. Simulated attacks can be seen as an emerging solution that is geared to match the rapid and changing nature of cyber threats. 

 

Cymulate, penetration test 

5 Takeaways from the Carphone Warehouse Breach

The Carphone Warehouse breach is the biggest so far announced in the post GDPR era.

What are the salient points to note from this breach? 

  1. 6 million records accessed 
  2. NCSC, ICO, FCA investigating 
  3. 3 million records accessed in 2015 breach 
  4. Cyber security risk identified by board in last FY report 
  5. If GDPR applies, maximum fine of £420m could apply 

 

A recently announced massive cyber attack at Dixons Carphone Warehouse has resulted in significant unauthorised access to millions of records including personal data. It appears that two breaches occurred which resulted in; 

 

  • 6 million customer records being stolen including 5.9 million payment card details  
  • 1.2 million customer records including name, address, email 

 

In January Carphone Warehouse were fined £400,000 for a breach that occurred in 2015 when 3m customer records (including personal details) and 1,000 employee records were stolen. 

 

Dixons say the breach was only discovered in the week leading up to the announcement and it actually occurred in the July 2017. Under the Data Protection Act they would be liable to a maximum fine of £500,000. Under the new GDPR regulation the fine could rise to a maximum of £420m based on last years’ global turnover of £10.5bn. 

 

In their most recent report, Dixons identified information security as a risk and their potential vulnerability to malware and cyber attacks. They identified potential consequences that could include reputational damage, reduced cash flow, financial penalties, reduced revenue and profitability, loss of competitive advantage. Dixons did appear however to be heading in the right direction to manage the risk ensuring senior management oversight including a Strategic Improvement Plan and increased investments targeted at managing the information/cyber security risk. 

 

The independent regulator the ICO is investigating the current breach along with the FCA and NCSC. The ICO has said it is yet to determine whether GDPR or the 1998 Data Protection regulations will apply. 

 

The NCSC is working on how the breach has impacted UK citizens and what measures can be taken to prevent such a breach re-occurring. They have also published guidance on what to do for people who think they have been affected by the breach. 

 

The CEO Alex Baldock has apologised saying that they have fallen short of expected standards. He confirmed that they have called in cyber experts to investigate as well as relevant authorities and the unauthorised access has now been blocked. 

 

Anyone affected or concerned about their personal data being accessed and how it could be used should contact Action Fraud. 

 

The breach came to light as a result of a massive attempt to compromise the cards in a card processing system, this means that someone tried to use the card details to take unauthorised payments. 

 

Dixons shares fell 6% following the announcement of the breach. 

 

Useful Resources

GDPR Readiness Test [Checklist]
GDPR 12 Step to take NOW [Infographic] 
9 Steps to Implement a Security Management Tool [eBook]