Posts

The Cyber Resilience Centre logo

eSpida become a Platinum member of the Cyber Resilience Centre for the West Midlands.

eSpida, a leading technical consultancy and UK Cato Network Partner has recently become a platinum member of the Cyber Resilience Centre for the West Midlands (WMCRC).

As a Cyber Essentials accredited security consultancy, eSpida was approached by the WMCRC to join its growing network of specialists in order to improve awareness and build strong cyber strategy within the Midland’s SME market.

The WMCRC provides relevant resources and protection for businesses and third sector organisations and communities in this digital era. Using a combination of police officers and cyber talent, WMCRC supports and helps to protect small businesses, SMEs and supply chain businesses in the region against cybercrime.

As a leading provider of cyber security advice and technology solutions, eSpida was well placed to join the network. Rebecca Bradley, Commercial Director of eSpida commented, “ Cybercrime is a growing threat to the average SME. Companies are not always equipped to understand the mix of technology, people and policy needed to affect a really strong cyber strategy. We are really excited to become a platinum member of the Cyber Resilience Centre for the West Midlands as we are passionate about good security practices”

Also commenting on the partnership, Vanessa Eyles Detective Superintendent and Director of The Cyber Resilience Centre for the West Midlands said “It is my pleasure to welcome eSpida to the growing number of businesses who have registered to become members of the WMCRC.

“Our mission is simple, we exist to help businesses of all sizes (although we do have a focus on SMEs, micro-businesses, and sole traders) to better protect themselves in the fight against cybercrime. It is collaborations such as this one with eSpida that will provide us with a wider platform, to further raise awareness of how following basic cyber security steps can have a significant effect on an organisation’s ability to fend off cybercriminals.

“I am delighted to be working with the team at eSpida, and I look forward to exploring how we can reach businesses across the whole of the region in the coming months to tackle the threat of cybercrime.”

To find out more about the Cyber Resilience Centre for the West Midlands or how eSpida can help you to devise and implement a robust cyber security plan contact info@espida.co.uk or visit www.espida.co.uk

/0 Comments/by

IT Security webex: How to protect your organisation

Our webinar brings you an update on IT security.

With cybercrime on the rise, keeping your security strategy up to date is imperative to the protection of your organisation. And with the General Data Protection Regulation (GDPR) May 2018 deadline looming, data security is now critical to legal compliance.

Watch our webinar with our resident IT security expert, Nigel Crockford to learn:

  • The changing landscape of IT security
  • The security challenges facing your organisation and its leadership team
  • GDPR and the practical implications for business
  • How to build robust security strategy to meet tomorrow’s threat

For more information about data security and how we can help you to protect your business, please get in touch on 0344 880 6145 or email info@espida.co.uk

 

/0 Comments/by

Ransomware: headline news for the Oxford Dictionary, everyday news for IT teams

More than 1000 new words have been added to the Oxford English Dictionary (OED) for 2018. Words such as hangry and mansplaining! But a word you might not be surprised to see in the latest OED is ransomware, which the OED has described as:

A type of malicious software designed to block access to a computer system until a sum of money is paid.

Following incidents such as the 2017 WannaCry attack on the NHS, the British public now have a far greater awareness of cyber-attacks.  The publicity surrounding the attack almost undoubtedly contributed to ransomware being added to the dictionary.

It is interesting that the word ransomware has only now been announced by the OED, not only because it has been in use by IT professionals for some time, but also as two of its sister editions have contained this definition since at least July 2017, these being the Oxford Dictionary of English and the New Oxford American Dictionary.

A sign of the times

With nearly seven in ten large businesses identifying at least one breach or attack in the last 12 months, the statistics show that businesses across the UK are now being targeted more and more frequently by cyber criminals. The number of ransomware attacks is growing and businesses are becoming increasingly concerned with how to prevent such attacks.

Businesses which have identified attacks or breaches admit to suffering temporary loss of files, software and system corruption, third party system damage and websites sabotage.  Such incidents have frequently resulted in numerous counts of financial loss and damaged reputations.

The term ransomware has now become a word synonymous on every IT professional’s lips and rightly so should be recognised as a dictionary defined word.

Businesses of all sizes must continue to invest in cyber security and take a proactive approach to IT security in order to protect themselves from falling victim to ‘a type of malicious software designed to block access to a computer system until a sum of money is paid’.

And just in case you were wondering…

Hangry is being bad-tempered or irritable as a result of hunger and Mansplain is (For a man) to explain (something) to someone, typically a woman, in a manner regarded as condescending or patronising.

Visit www.espida.co.uk/it-security for more information or take a look at our Forcepoint partner page to see what cyber security solutions we can offer.

/0 Comments/by
IT security solutions

Security Best Practice

Most IT security professionals would agree that it is no longer a matter of if you get breached, it is a matter of when. And with the media awash with news informing us of businesses or government organisations suffering data breaches and high-profile attacks, security teams are being held accountable for addressing risks – externally as well as internally.

It is now more important than ever that IT departments take a structured approach to their organisations cyber security. While there are some basic network security measures that every IT department is aware of, such as the use of firewalls and antivirus software, there are also other best practices, policies and procedures that some organisations do not yet follow.

The following IT security best practices should all be taken into consideration:

Update of Software and Systems

Cyber criminals are constantly inventing different techniques and finding new vulnerabilities.  The majority of malware does not target new and unknown security vulnerabilities, it seeks out well-known and established exploits that have been fixed in the latest versions of firmware in the hope that organisations do not update.

To keep your network protected and optimised ensure that software and hardware security is up-to-date with the latest patches and firmware.

Backup of Data

Data backups are a basic security measure that has gained increased relevance over the past few years.  With the rise in Ransomware attacks, designed to encrypt all of an organisations data until the decryption key is paid for, a complete and current backup of all data is crucial.

Backed up data must be properly protected and encrypted with backups made frequently so if a backup does need to be utilised, the information is as up-to-date as possible.

Prevent Data Loss. Protect Your Data

A lot of organisations do rely on the trust and honesty of their employees. However, this does not stop data from leaving the organisation in one shape or form.  In truth users with or without knowing it allow data to be breached, leaked or stolen with more and more IT security teams admitting that the top security concern in recent years has been data leaving an endpoint.

It is now more important than ever to control user access, monitor activity and know what is happening with company data.

Monitoring User and Third Party Activity

Users with privileged accounts have an increased level of trust, but at the same time can pose one of the biggest threats to data security.  These users have the tools to pilfer sensitive data from organisations and go unnoticed. When undetected, insider threats can be costly to organisations.

The monitoring of user activity allows IT security teams to detect unauthorised behaviour and verify user actions so they do not violate security policies.

Educate and Train Users

When we talk about cyber security, users are generally considered the weakest link. However, raising user’s awareness around the cyber threats the business faces and educating users on cyber security best practice enables organisations to limit the risk of data breach and loss.

End user training can include topics such as:

  • The ability to identify malicious emails (Spam, Phishing).
  • The importance of creating strong passwords.
  • The risks surrounding the removal of valuable data from the company via various media.

Use Two Factor Authentication

Organisations are being encouraged to apply this security standard to their user accounts as added protection.  It employs an additional device such as a security token or mobile device (for soft tokens) to confirm the identity of the user.

Two factor authentication adds a second layer of security to your network and provides a very reliable procedure for user login activities.

Changing Default Passwords

Many systems now come with a set of default credentials hard coded into the device’s software. These are usually freely available to obtain on the internet and are relatively well known by cyber criminals.

Most malware targeting networks are looking for system that have not had the default credentials changed in order to hijack them.  The only way to ensure that your devices cannot be so easily hijacked and infected is to change all default passwords as soon as possible and ensure that the replacement passwords are complex and unique and are changed on a regular password management cycle.

Handling Passwords Securely

With two factor authentication providing user accounts with extra security, organisations cannot afford for users to view this as an excuse to overlook password handling security policies.

Employees need to be educated to ensure their passwords are long, complex and fully unique.  They must also not share credentials with one another. While they may find this convenient, it is placing the organisation in an unsafe position and at a heightened risk of data breach or leak.

While this seems a lot to implement, once the majority of practices are in place they require very little intervention.  They should be monitored in the background and will only require attention if a security issue arises.

Don’t wait for the worst to happen.  Adopt these security best practices and be prepared for the worst.

/6 Comments/by

What’s the next big thing in Cyber Security?

Cyber security on laptop

Twenty years ago, security in IT broadly only consisted of firewalls, antivirus, passwords and development patches. Hackers and data thieves soon found ways of attacking these simple devices to gain access to sensitive organisational data.

As a result, security providers and vendors have invested in the development and production of more advanced technologies in order to defend business networks. Many different security products are now available in the defence against cyber criminals such as anti-virus, spyware detection and threat detection software to name just a few.

So, what’s next?
This is the question constantly being asked, along with what will be the next big thing in cyber security? and what will people be talking about in the next year or so?

The answer broadly lies with the cyber attackers. For each method of attacking organisational networks they develop, the vendors will be developing their products and security solutions accordingly, in order to prevent the attacks.

Change is coming
Rather than taking a traditional reactive response to cyber threats, vendors are becoming proactive by developing software to deal with known activity. Having investigated the way in which attackers operate, vendors are introducing this methodology to remove the initiative from the attacker. Realising attackers collaborate between themselves, vendors have now moved into sharing information, such as knowledge and tools, between themselves which in turn decreases the response time to threats.

With this sharing of information, vendors can now look to the future one step ahead of the cyber criminals and by using a more proactive, defensive approach will be better prepared to foresee potential attacks. By adhering to the GCHQ code of conduct guidelines along ISO 27001/2 and by following known practices and a number of elementary processes, businesses can eliminate some of the lower risks.

With cyber criminals constantly developing new threats, it is imperative that organisations keep their cyber security active and up to date.

My recommendation
Businesses should start with basic security best practice, looking at access control as well as applications within the organisation, ensuring these are forced to update and patched as deemed appropriate for your business.

I would welcome your questions on best practice procedures. Please feel free to contact me at jon.dixon@espida.co.uk

/2 Comments/by