Tag: cybersecurity

How careful planning can take the pain out of ransomware breach response

Posted on by QuoStar

How careful planning can take the pain out of ransomware breach response

There is plenty that organisations can do to enhance their resilience to ransomware breaches. But no preventative strategy can ever be 100% guaranteed to succeed. The modern corporate attack surface is simply too porous and expansive, and threat actors too persistent, for that. That’s why network defenders should also be primed and ready for a worst-case scenario.

As we explained in our previous blog, an attack can strike at any time. And when it does, those in charge are often trapped in a whirlwind of confusion. The key to successfully managing such a situation lies with forward planning.

Planning for a breach

Ransomware is among the most common and acute cyber-threats facing UK businesses. And the threat will continue to grow with the advent of AI, the National Cyber Security Centre (NCSC) recently warned. For smaller businesses its impact can be particularly destructive. A 2022 study revealed that a fifth of US and European businesses had nearly been forced into bankruptcy by a historic attack. Last year one of the UK’s largest privately owned logistics firms entered administration due to “disruption” caused by a ransomware compromise.

Yet it doesn’t need to be this way. It all starts with putting the right team together. Ideally, it should include key representatives from the IT and security function, PR and legal – and possibly also HR and customer service stakeholders. That’s because, when a ransomware attack hits home, it can impact disparate parts of the business.

PR is essential to help organisations manage their external communications strategy. HR should be on hand to manage internal comms and cross-departmental collaboration. And legal will dispense critically important advice on engaging with regulators, managing potential customer/employee class action suits, and more. For most organisations, customer service will also need to be involved to manage the fallout for end customers. If any piece fails, there could be significant financial and reputational repercussions, including customer churn, regulatory fines and lawsuits.

The average cost of a UK data breach is calculated at $4.2m (£3.3m) today. But in some cases, ransomware has caused losses measured in the tens of millions. From a regulatory perspective, organisations need to think not just of data protection watchdog the Information Commissioner’s Office (ICO) but also any relevant industry-specific bodies, like the Financial Conduct Authority (FCA).

Putting the pieces in place

Every organisation is different, and there’s no single agreed format that an incident response team should take. Most important is that everyone has a clearly defined role that they understand, and that they are working under unequivocal instructions from an incident response lead. In many cases, this will be a senior individual from the IT team. Crucially, they need not only experience of working under pressure – and ideally in crisis incident response situations – but must also be given the authority to lead for the duration of an incident. That means even members of the organisation and board senior to that individual must respect their decision making.

The next thing a team needs is a plan. This is where many organisations fall down, by attempting too much. No one can predict how or when a ransomware breach will take place, and what its impact may be on the organisation. But many try, by building out complex incident response plans which will likely be redundant as soon as attackers strike. The key to success is rather to keep things simple and high level. The incident response team will need to improvise, but within their own clearly defined roles. It’s also important to ensure any pre-written plan is accessible in a crisis – ie, not stored on a server that has been encrypted by ransomware.

In a similar way, organisations shouldn’t overthink things by scheduling frequent incident response training exercises. In a typical organisation there are mini incidents occurring all the time which can be used to hone the skills of team members. Once a driver has passed their test, they aren’t forced to sit another one every six to 12 months: simply by being behind the wheel they continue to practice and improve the required skills.

Communicating clearly

Above all, when working through post-ransomware breach response, organisations must foreground the importance of clear communication. That could mean:

  • Communication between incident response team members
  • Communication with the board and senior managers (they should be kept updated at frequent intervals)
  • Communication with the wider community of employees – to ensure they follow policy by limiting what they publish online about an incident, and to maintain morale during what could be a long road to recovery
  • External comms. It’s vital that a senior spokesperson is chosen as part of the incident response team. This individual should be the face of the organisation during the breach response. External comms is critically important to prevent rumour and speculation, especially in the early hours and days following a breach

This is by no means a comprehensive checklist for post-ransomware breach response. But it’s somewhere to start.

For a more detailed briefing on what to expect from a ransomware attack and how to respond, register today for our upcoming reality check webinar: Assessing the real impact of a Ransomware attack.

Assessing the real impact of a Ransomware attack, webinar registration

A whirlwind of confusion: what happens in the first hours of a ransomware attack

Posted on by QuoStar

What to expect when ransomware actors come knocking

The global economy might still be struggling to get back on track. But the finances of the cybercrime underground are in rude health. Payments from ransomware victims exceeded $1bn last year – a record high. And that’s just for the cryptocurrency wallets forensics analysts were able to track. The real figure is undoubtedly much higher. In this context, all organisations should plan for the day when they too will be compromised by ransomware actors.

Unfortunately, many still do not. And their lack of preparedness is something threat actors thrive on. During the post-breach response period, they will do everything in their power to ramp up victims’ confusion, in order to extract maximum financial returns.

Network defenders must stay calm and stick to their plan. When it comes to ransomware, forewarned is forearmed.

The worst-case scenario

There are several ways in which an organisation could end up a ransomware victim. RDP compromise, email phishing and exploitation of software vulnerabilities are still the top three attack vectors for threat actors. But the first the organisation may actually see of an attack is likely to be a ransom note on a networked PC – or potentially an entry in a ransomware data leak site detailing how much data has been stolen.

From the start, network defenders are on the back foot. They may have no prior experience of dealing with a ransomware breach. Their adversaries, on the other hand, are usually seasoned professionals with stacks of domain expertise. Their operations behave more like regular SMBs than one may imagine. And in some cases, their resources can match those of high-flying enterprises. One infamous group, Conti, reportedly spent $6m (£4.8m) annually on salaries, tooling and support services.

Many questions to answer

Victim organisations will have a relatively short time frame in which to act. This kind of time-based pressure is a classic social engineering technique designed to rush victims into making irrational decisions. A clock may count down the minutes they still have left to purchase a decryption key. Or for breaches where only data was stolen, until that data is ‘leaked’ to the world.

In the meantime, business leaders will be frantically asking their IT teams to answer their questions:

  • How do we deal with this?
  • Who can help us?
  • How much of the business is impacted?
  • How much data has been exfiltrated?
  • How much downtime can we expect?
  • Has the story been reported in the media/on social media?

Unfortunately, without a clear, pre-rehearsed incident response plan and team in place, such questions can be tricky to answer. And the threat actors will be doing what they can to continue wrongfooting their victims. Among the tactics designed to sow confusion and force payment may be:

  • Exaggerating how much sensitive data they have been able to exfiltrate
  • Threatening to launch a distributed denial of service (DDoS) attack
  • Contacting customers and partners and asking them to demand the company pays a ransom
  • Threatening to inform regulators about the breach

Such efforts are becoming increasingly persistent, and novel. In one case, a ransomware group hijacked a US university’s emergency broadcast system to send staff and students text messages and email alerts that their data was stolen and would soon be released. In another, they hijacked and defaced the victim organisation’s website to display a ransom note to the world. In a third case, a ransomware group claimed it was willing to alert crooked traders about a breach before it was made public, so that they could short the listed firm’s stock.

Such efforts have one single goal in mind: to throw a spanner in any recovery plans and put network defenders on the back foot. If they can frighten the organisation in to paying the maximum ransom demand rather than a lower negotiated figure, all the better.

Struggling to respond

Organisations caught in this whirlwind of confusion will find it extremely difficult to successfully respond unless they have prepared for something like this worst-case scenario. Yet unfortunately, government data tells us that just a fifth (21%) of UK businesses even have an incident response plan in place, rising to 47% of mid-sized firms. Fewer than two-fifths (37%) have cyber-insurance.

This matters, because despite the news headlines, most ransomware victims are not big-name brands or government agencies, but SMBs. The median size for a breached organisation stood at just 230 employees in Q4 2023. Some 36% of victims in the period had fewer than 100 staff members. There is a ruthless logic to this. Smaller firms are less likely to have the resources and expertise needed to protect against ransomware attacks in the first place, or contain and recover from them rapidly if they are breached.

The truth is that no organisation is safe from ransomware today. But a compromise doesn’t have to precipitate an existential corporate crisis. The message is simple: plan today to avoid a whirlwind of pain tomorrow.

To find out more on what a ransomware attack could entail for your organisation, and how to mitigate and respond effectively, sign up to our forthcoming reality check webinar: Assessing the real impact of a Ransomware attack.

 

Assessing the real impact of a Ransomware attack, webinar registration

 

 

 

Reassessing IT Security in Professional Services: A Board-Level Imperative

Posted on by Robert Rutherford

Doing “the basics” is not enough

The landscape of IT security has shifted significantly, yet a sense of apathy remains, rooted in the scaremongering sales tactics of the past decade. Today’s reality is starkly different: every firm and individual is a potential target, and the consequences of lax security are not just damaging but potentially catastrophic, leading to public embarrassment, hefty fines, and severe business disruptions.

Alarmingly, many professional services firms are not adhering to even the basic tenets of Cyber Essentials, a fundamental cybersecurity framework. Worse still, some firms rest on the mistaken belief that compliance with such frameworks alone guarantees security. Cyber Essentials really is ‘just the basics’ – not a badge of being secure.

Technical controls like advanced firewalls and detection systems are prevalent but often give a false sense of security. The analogy of a fortress with an open back window is apt; firms have robust protections in certain areas but unknown critical vulnerabilities in others. The security measures are not as integrated and comprehensive as they should be.

A glaring gap in many firms is the absence of a solid GRC framework and an Information Security Management System (ISMS). IT security is not just about technology; it’s about ongoing processes, risk management, evaluations, reporting, and testing.

Implementing an ISMS, particularly one aligned with ISO 27001, is essential for establishing a strong cybersecurity posture. Utilising key elements of this standard can significantly bolster a firm’s defence against cyber threats, even if you don’t certify against the standard. There’s no reason why every firm shouldn’t at least have a risk register and details of the security controls associated with countering those risks. It seems odd not to do it when you understand how much common sense it makes.

Despite the technical aspects of cybersecurity, the problem is not confined to the IT department, it is a challenge that must be tackled at the board level. Many firms still erroneously view Information Security and Cyber Security as IT issues when they are, in fact, most certainly broad organisational concerns.

It is vital for the business and IT to have a clear understanding of the organisation’s risk posture; identifying all risks faced by the business and the controls necessary to manage them. Regrettably, this level of understanding is often absent within a number of IT and business leadership teams, leading to insufficient risk management strategies. As an example, I’d argue that a significant number of firms don’t appropriately assess the security of their supply chain. This is almost as if they’ve delegated accountability to their suppliers for their firm’s operation; that’s a big statement to make i.e.  ‘we are going to close our eyes and hope they’ve got it under control’.

The issue is compounded as many IT teams are currently overwhelmed in firms. They were historically tasked with maintaining operations but are now also burdened with managing numerous transformation projects post-COVID, along with a vast information security landscape to get control of. Many are really struggling, yet the board won’t assign the necessary focus or budget to really get hold of it.

Reassessing IT Security in Professional Services

Conclusion

Professional services firms must urgently re-evaluate their approach to IT security, transitioning from outdated perceptions to a holistic, board-level governance model. This shift is critical not just for the integrity of their IT infrastructure but for the survival and competitiveness of the firm in an increasingly digitized and threat-prone world.

Resolution

In response to the demands of professional service firms, QuoStar’s CISO service has been built to manage all of the key areas highlighted, from the ground up. It’s a comprehensive support service to give the IT team and the firm’s board real confidence that they are managing cyber security appropriately and effectively. In addition, it delivers:

  • Ongoing senior IT security leadership and guidance.
  • IASME or ISO 27001 implemented and managed (if desired).
  • The ability to effectively manage and respond to cyber-security threats.
  • A defined, ongoing roadmap for cyber-security protection.
  • All key documentation, policies and processes agreed and in place.
  • All key parties engaged in security standards implementation.
  • An overall definition of cyber-security strategy and tactics.
  • All key stakeholders understand the business objectives.
  • The ability to formally evidence management of cyber-security
  • Continual review & evaluation of the threat landscape to control your risk profile.

Schedule a complimentary review with a CISO.

Microsoft Inspire 2023: Announcements Round-up

Posted on by QuoStar

Microsoft’s premier annual event, Microsoft Inspire 2023, recently concluded, providing industry leaders and partners alike with a glimpse of Microsoft’s vision for the future. There’s no doubt that Microsoft wants to empower individuals worldwide to work in a new AI-driven way, expanding the scope of AI technology to help everyone in various aspects of their roles. In this recap blog, we’ll highlight some of the key takeaways from the event and how it sets the stage for a secure and AI-driven business landscape.

Advancing AI ambitions

Regardless of your feelings about AI technology, it’s hard to ignore the platform change that Satya Nadella (Chairman and CEO at Microsoft) laid out in the keynote speech. The next big shift in our way of working is here – using natural language as our interface with technology, facilitated by AI.

The event marked the launch of two groundbreaking AI-driven solutions, Bing Chat Enterprise and Microsoft 365 Copilot, promising to redefine how we work, delivering increased efficiency for business advantage through AI-driven insights and automation.

During the event, Microsoft detailed the functionalities and pricing of these new tools:

  • Bing Chat Enterprise: Think of it as Google on steroids, working with both public and private data while maintaining appropriate data governance to ensure your IP is not leaked. Currently available in preview, we expect this to roll out in late 2023 or early 2024 for Microsoft 365 E3, E5, Business Standard, and Business Premium users at no additional cost. For those rare clients without some form of M365 licensing, the standalone offering will be available for $5 per user per month.
  • Microsoft 365 Copilot: While Bing Chat Enterprise will reference business data and aid you in your day-to-day tasks, Copilot takes it to the next stage of evolution It offers integrated AI that can work with and for you in your native applications, through a natural language interface. Hand off those menial tasks and focus on the exciting stuff. Microsoft has initially released Sales Copilot, with the promise of wider integration to come and we finally know how much it will cost. $30 per user per month for Microsoft 365 E3, E5, Business Standard, and Business Premium clients. While it may feel expensive for some, how and who you deploy it for will be key.
  • New AI capabilities across Microsoft 365: AI is coming to the rest of the M365 suite, enhancing productivity and engagement with features like Copilot in Teams Phone and Chat, Microsoft Viva updates, Windows 365 Frontline, Microsoft 365 Backup, and Microsoft 365 Archive.

To learn more, read the blog post by Colette Stallbaumer, General Manager, Microsoft 365 and Future of Work here.

Microsoft Chairman and CEO Satya Nadella speaks to partner attendees at Microsoft Inspire 2023.  Judson Althoff, Microsoft executive vice president and chief commercial officer, speaks to partner attendees at Microsoft Inspire 2023.

Embracing the future of security with AI

Emerging technologies are rapidly evolving, and cybersecurity has become more crucial than ever before. Microsoft Inspire cast a spotlight on the future of security powered by AI, highlighting the unique opportunity to harness AI’s power alongside an end-to-end security solution for building a resilient security posture with rapidly adaptable defences.

Based on Microsoft’s internal data, cyber-attacks are rapidly adopting automation through AI-assisted tools. The number of password attacks detected by Microsoft has surged significantly, growing over threefold in the past year, from 1,287 per second to more than 4,000 per second.  As a result, the cost of cyberattacks is continuously rising. If organisations stick to outdated security measures and only rely on past strategies, they may leave vulnerabilities in their security posture.

Partners and clients were introduced to valuable resources to strengthen their defences against ever-changing threats. They showed how using AI can help to spot and stop potential risks before they become a problem. They also emphasised the importance of safeguarding critical data and customer information. Throughout the event, it was clear that Microsoft is dedicated to empowering businesses with smart security solutions.

For the full details, read the announcement here to learn more.

Nicole Dezen, Microsoft corporate vice president and chief partner officer, speaks to partner attendees at Microsoft Inspire 2023.

 

Conclusion

Microsoft Inspire 2023 revealed a series of key announcements and technologies, showcasing the tech giant’s dedication to AI advancements and comprehensive security solutions. From fortified cybersecurity measures to innovative AI tools elevating collaboration and productivity, Microsoft is continuously pushing the boundaries in the tech space.

As the digital landscape continues to evolve, embracing these transformative technologies becomes crucial for achieving business success in today’s competitive environment. Sure, these technologies can be exciting, but we get it – they can also feel overwhelming, and you don’t have to navigate it alone.

Whether you want to secure your business against evolving cyber threats or explore how AI can enhance your operations, our team of experts is ready to support you every step of the way. Reach out to us here.

 

How to safeguard your cyber insurance cover – and your business

Posted on by Robert Rutherford

The risks of – and the potential fallout from – a cyber-attack is enough to keep any company director awake at night. 

The costs of a breach can be huge, costing UK enterprises an average of £4.09 million per breach, according to IBM’s Cost of a Data Breach study.  

These figures are not surprising when you consider lost productivity and revenue, response, forensics, recovery, communications, data breach fines, and various other costs. Even a company with 100 employees can be looking at hundreds of thousands of pounds, just to get back to where they were before an event, such as from a ransomware attack.  

Together with the significant reputational damage that can follow a data breach, the level of risk and likelihood means that most organisations have some form of cyber insurance to cover these substantial costs.  

 But as the number of cyber insurance pay outs grows, insurers are looking at ways to not pay out, or at least not for the full amount of damage. This is understandable in cases where a board has been negligent and not managed the risks, just as a motor insurer would not pay out where a driver had failed to get an MOT or put road legal tyres on their car.  

Your responsibility to control risk

All cyber insurance providers expect policy holders to take responsibility for evaluating and mitigating risks.  

Insurers expect best-practice cyber security controls to be in place, which typically includes the ‘absolute basics’ such as Cyber Essentials. This also means keeping on top of security operations year-round, not just a tidy up and certification every year or so. 

If the basics are not in place at the time of a breach, then many insurers will not pay out. On top of this, the ICO and other regulators are likely to hand out significant fines. These amounts aren’t insignificant, as the ICO alone can hand out a data breach fine of £17.5 million, or 4% of an organisation’s total annual worldwide turnover, whichever is higher. 

Cyber security basics should be viewed as seriously as other risk controls in your business, such as a fire alarm that is regularly serviced and tested. 

Common cyber security measures

For a cyber liability policy to pay out in a breach scenario you need to check the small print.  However, here are common areas that are going to have an impact on any claim: 

Patches and Updates

  • Firewall Protection – IT equipment must be protected from unauthorised access by a suitable firewall. The firewall needs security updates and other updates at least once a month, if not automatically. An insurer will almost certainly not pay out if the firewall is not up to date at the time of a loss.
  • Software updates –It’s best practice to patch and update software and it is a standard cyber insurance term to mitigate known vulnerabilities. Important updates to firmware, operating systems, and other software must usually be installed within 14 days of being released by the vendor or provider. Some insurers will insist on seven days, which can be a tough clause to manage in some environments, so keep an eye out for this.
  • Tablets, phones, and other devices – It’s important that tablets, phones, and any other devices with access to your network are updated or kept off the corporate network. Your organisation is responsible for who and what connects to its network. If your network is breached from an insecure work or personal device, then your insurance could be void. 
  • Outdated operating systems – Outdated operating systems and software that is no longer supported by the vendor in terms of security updates is going to invalidate insurance if they are breached. 

Users and Passwords

  • Change default passwords – If you have default passwords or use the password that came with an IT device when it was purchased, then your policy will be invalid. There are large databases on the internet that list all these default passwords, and these are always a go-to for hackers and automated attacks.
  • Individual ID and password –It can be common for some users to share logins and passwords to certain systems, and for conference room PCs to have shared logins. These shared credentials are unacceptable as they are a common cause of a breach. It also makes the source of a breach difficult to trace.
  • Limiting access – System users should only have access to what they need, particularly logon credentials with enhanced security rights, such as administrator rights. It’s particularly important that users don’t have administrator rights on the device they log in to as that’s an easy way for an attacker, who may be an employee, to gain control of a machine and then the wider network and systems. Organisations will need to prove that administrator accounts are controlled and that passwords are changed regularly.
  • Work laptops should be controlled – Only authorised users should be able to use work devices. This will need to be controlled via policy and login restrictions. An employee’s child downloading and installing a game with ransomware on to a work device could lead to the insurance being invalidated.

Data Backup

Cyber insurance policies will always cover the backup and protection of data. They will typically include: 

  • Two copies of backup data at different locations – It’s standard to expect two separate copies of backup data to be stored. One can be local to the IT environment, but another should be taken or backed up off-site, such as on a cloud backup platform. It’s increasingly common for insurers to ensure that backup data is air-gapped, so if someone gains access to your systems, they cannot get access to the backups. It’s common for ransomware attacks to seek and encrypt backups quickly.
  • Frequency of data backup –It’s usual to backup data daily, if not continually, in most modern IT environments. If your data is critical, then an insurer would want to know why you have not backed-up regularly. 
  • Backup checks – It’s critical that you regularly evaluate your backups to make sure everything that needs to be is backed up. It’s even more critical to ensure that your backups are working as expected. Many systems will send automatic alerts, but it’s still worth doing a manual check and restore every now and again.
  • Virus Protection –Cyber insurance terms typically state that anti-virus software should be in full and effective operation at the time of a loss. It should also be noted that many insurers are now asking that businesses have at least EDR (Endpoint Detection and Response), which is a typically more advanced antivirus solution, supported by a specialist organisation. In fact, it’s generally considered a security basic now, as antivirus was 20+ years ago.

Pre-existing problems

Cyber insurance will not pay out if you are aware of, or ought to have reasonably known about, a pre-existing issue, prior to the cyber insurance being taken out. This is particularly important if you’ve had security audits undertaken in the past but not dealt with any issues highlighted. Too often organisations know they have issues but still take out insurance as a way of mitigating spend on security controls. This is a bad idea. 

Previous breaches

If you’ve been breached before it will impact your insurance, as there could always be something waiting to deploy at a particular time, or a hole left in the environment. You must declare if you have had a breach, usually over the last three years. 

What can reduce premiums?

There are key areas that can make a real difference to your cyber insurance premiums and your security posture, such as: 

  • Multifactor authentication, particularly for remote access and administration accounts 
  • Privileged Access Management (PAM) 
  • Endpoint Detection and Response (EDR)
  • Secured, tested and encrypted backups 
  • Email filtering and web security 
  • Patch and vulnerability management 
  • Cyber incident response planning and testing 
  • Cyber security awareness testing and phishing testing 
  • Security Information and event management solutions 
  • Vendor and supply-chain risk management 

All the above are sensible security controls that should already be in place in organisations of all sizes. 

How do I know if I have the right controls in place?

If you would like a no-obligation audit, please contact us to sign up for a Cyber Maturity Assessment or Cyber Risk Assessment.