Being a CISO in 2021 – our Head of Security David Clarke

Our Head of Security, and CISO Service lead, David is recognised as one of the Top 10 influencers by Thompson Reuters, and a Top 50 global expert by Kingston Technology. He is also one of the Top 30 most influential thought-leaders and thinkers on social media in risk management, compliance, and regtech in the UK.

 

In his role as Head of Security at QuoStar, David leads the CISO Service. The CISO service provides businesses with the cyber-security skills and experience necessary to manage the multitude of threats and rapidly changing risk landscape of today, on a flexible and cost-efficient basis. David take’s a moment to share his views on it all.

 

1. How did you get started in the security field and ultimately become a CISO?

David: I was around when some of the first Viruses went mainstream. Back then I worked for one of the only companies that made Multi Factor Authentication systems in the 90’s. It was “leading edge” at the time.

I built and ran one of the largest commercial remote access platforms using Multi Factor Authentication.  Then I ran Infosec for some FTSE 100 companies, one of which was the largest private trading network in the world – trading 3.5 trillion dollars a day.  Another was managing Global Security Services Operations Centres (24/7) across 4 continents, where most of the customers were FTSE 250.

 

2. What do you enjoy most about working as a CISO Service resource/consultant?

David: Meeting challenges of audit, due diligence, and breach management.

Audit is getting more involved and complex and due diligence is often 300-400 questions and an “interview” with the compliance department of potential customers.

Breaches is about managing with around 10% knowledge of the situation and making decisions in a very short time for the best outcomes – while ensuring buy in from the board. They always seem to happen on Friday evening!

 

3. As Head of  Security, what challenges or issues do you regularly see in small and mid-market businesses? Why do you think the same issues keep occurring?

David: 1. Robust management of access and privilege management. 2. Managing risk consistently. 3. Not aligning Cyber Security with Data protection requirements – as they overlap at a core level.

If you have control of the information assets servers and cloud, information security is much easier to manage. It enables savings in resource and effort if this happens and can demonstrate to the business control and improvement.

 

4. How do you think the security landscape has changed in the last five to ten years?

David:  As a CISO Service lead, I believe it is manging the hybrid of internal servers and cloud – and managing the challenge of access control. The company boundary is very fluid, especially where ‘what’s company and what’s personal’ is concerned.

One of the best frameworks is ISO27001. It is good for demonstrating accountability and decision making. It also aligns with SOC2 and parts of HIPAA quite well.

 

5. What do you think will be the emerging risks businesses need to consider in the next 1-2 years?

David: It used to be technology first, then followed by making technology safe and compliant. Now technology needs to be safe and compliant first, and performance orientated second – along the lines of what has happened in the automotive, aerospace, building and food industries.

The risks potentially surround the technology itself not having enough security management capability, or that if it does it can be resource intensive.  There’s also the globalisation of threat actors and the capability of managing multiple global data protection regulations.

More recently the US Biden government issued a memo to US Businesses in summary June 2, Stating the 5 best practices – one being Multi Factor Authentication. Other important aspects are multi-pronged backup Updates, Incident Response, external testing and network segmentation.

 

6. Has the Covid pandemic exacerbated security concerns or introduced new ones for businesses to deal with?

David: Probably, due to homeworking and fast transformations of moving office servers to the cloud, as well as an increase in Ransomware attacks, an increase in Data Protection legislation globally and the increase in corporate security concerns due diligence.

It has been an increasing challenge for a Head of Security. We have seen an increase in demand from due diligence enquiries, especially for more detailed homeworking policies and guidelines. So, the lines have blurred as to what is home device or a work device. The “physical office” is now the home office, and mandating rules now have to be guidelines that are appropriate – as well as using more layers of defence to protect staff and corporate assets.

 

7. Do you think businesses focus too much on the technical/technology element of security (e.g. AI solutions)? What other areas do they need to consider?

David: Potentially yes, without an end-to-end strategy, it makes security technology “tactics” unlikely to see a ROI, Return on Investment.

As Head of Security, I see the human element of security is also overlooked quite often. Especially when you consider that almost half of all security breaches are caused by human error. This is even more disconcerting when you consider that only 60% of employees will report a security breach too.

We are actually hosting a free webinar on that subject on 29th July 2021 at 1pm, so if you’d like to know more register for free.

 

8. How important is cyber-security education? What are the challenges for a Head of Security conveying the risk/educating business? Who in the business needs to receive education/training and how often?

Education is very important, as is having the appropriate training for each role ideally aligned to the companies risks – so that maximum benefits can be realised e.g. developers would require different training from HR staff, as the risk they are managing are different.

Of course, there will always be a need for baseline cyber and data protection training. You can find out more about what Security Awareness Training there is available for employers and employees in our article here.

 

9. Do you feel there is a security skills/talent shortage? What advice would you give to businesses to combat this?

David: I’m not entirely sure. If there is a shortage, there is definitely a misunderstanding of what skills are required.

Personally, I would align the risks and the strategy, then decide what skills are required to make it happen. It may be that companies would benefit from outside help – to formulate the strategy, and always have access to a range of skill levels onboard to achieve skills resilience.

The other issues that many companies seem to come up against are 24/7 and global, so having just one capable Security resource will not be enough to cover these time periods.

 

10. As Head of Security, what advice would you give to businesses who want to reduce risk and increase their security posture?

David: Manage Risk regularly with key stakeholders.

Ideally do not remove a risk or lower a risk without evidence, from at least the following e.g. a Policy, Procedure, Penetration test, Internal Audit, External Audit or risk committee approval. This will demonstrate accountability and assist in managing data protection, to enable a defensible position in the security posture.

Ensure a multi-layer approach to security. Utilise things like Access control, least privilege, Approved applications, strong email defences, layered endpoint security, centralised control of endpoints and access, plus multiple point backups.

 

11. If there was one security investment you could recommend to businesses what would it be and why?

David:

One piece of tech most companies aren’t using

To keep companies ahead, Secure Access Service Edge will help with Cyber security and Data Protection. The ROI is great! It releases staff time, and the payback can be in months.

 One Framework

You can manage risk and accountability using ISO27001 framework. If you are not going to be certified, ISO27001 also helps align with NIST, SOC-2 and can help align some components of Data protection. It can clearly demonstrate accountability.

Training that is focused to the role in the business is most appropriate, using the “Incident” metrics to tailor training and technology requirements.

 One practice
Have a data/Cyber champion in every business function so you’re able to manage threats, risk and increase incident reporting capability to enable “real-time” issue management.

 

We hope you found David’s current take on Cyber-Security insightful. During his career David has worked across multiple sectors, including financial services, government, utilities and FinTech, working with a variety of clients – from start-up level and SME up to FTSE 100. He previously held the role of Global Head of IT Security at BT and Radianz (formally Reuters). He’s also been responsible for managing the security infrastructure and delivery of ISO 27001 for multi-billion/trillion-dollar environments. He is also an active CISO consultant on our CISO service offering.

Find out more about how to improve security within your business by signing up for David’s free webinar The Important Role Your People Play in Cyber-Security  on Thursday 29th July at 1pm.

 

Book an online review with QuoStar’s consultancy team today.

 

contact us button

The Top 5 Strategic IT Trends for 2021: How will professional service firms use IT this year?

The top 5 strategic IT trends for professional service firms in 2021

In 2020 we certainly saw IT move into the heart of operations. The COVID-19 pandemic saw swathes of professional service firms forced to embrace widescale remote working for the first time. The rapidly required enforcement saw IT teams working flat out to get all the necessary technologies, tools and processes in place to ensure employees could remain connected and the business remain operational.  

Nearly ten months later and plenty of us are still working from the ‘home office’. Many businesses have discovered remote working can work for them and are considering what the future looks like for their operations. It presents a great opportunity for firms to proactively review their accommodation strategies and reduce their overheads. While remote working is just one trend we can expect to continue this year, how else do we expect professional service firms to be using IT strategically in 2021? 

Strategic IT Trends: What can we expect?

Trend #1: Businesses get to grips with the strategic use of technology

We’ve seen the savvier firms already making measurable gains through the technology investments, but after the pandemic demonstrated just how critical technology is, more companies will start to follow suit. Keeping the lights on and operations running is no longer enough. Slowly but surely we’re moving towards the innovation stage as firms look to use IT as a strategic differentiator, delivering enhanced customer service and value, improving processes and seeing a measurable impact on the bottom line.  

Trend #2: Increase innovation and automation of processes

Automation has probably been on the IT trends list for several years now, but we’re definitely starting to see greater uptake at firms, across all levels. The thing to remember with innovation and automation is it’s not always about ‘sending people to the moon’, it’s about reviewing the way you are operating your business and making incremental improvements. It’s better to start by reviewing and automating a few simple processes, testing and refining, before taking wider steps. There is no need to rush out and try to automate everyone at once. This where you end up with massive, over-complicated workflows and things slipping through the cracks or not working correctly.  

Trend #3: Improved client service delivery and relationship management

With clients’ service expectations consistently increasing, we’re seeing more firms taking an interest and investing in client management. Clients now have multiple contact options available to them (e.g. email, calls, Facebook messenger, online chat, WhatsApp), so they expect to be able to make contact in a manner that suits them – and receive a prompt response. This has been worsened by the pandemic, giving even more options and availability for virtual meetings.  

In 2021, we expect to see more firms building robust service management processes, ensuring that contacts are responded to and not accidentally droppedMore firms are also likely to consider the CRM systems route and take advantage of automated workflows to manage this process. While this is positive, it’s important to remember that technology alone won’t guarantee better customer relationship management. Firms need to map out what they want to achieve and how they want processes to work, rather than jumping in headfirst. Most successful CRM projects take around 2-3 years to roll out fully, so firms need to be patient. Starting with a single department, or just senior managers is an ideal starting point.  This is as much a cultural change as it is about the technology. 

Trend #4: A greater understanding of data – plus how to extract and use it

Although many do not recognise it, professional services firms are data-driven organisations. The problem lies in the fact that a lot of firms do not know what data they hold, where is it stored, and how they can access it and monetise it. We are beginning to see a greater interest in this area and it’s increasingly becoming a topic of conversation. Firms are starting to use this data to make more effective business decisions, for example using past data to price work, to predict the outcome of litigation in legal, or to identify fraudulent claims in the insurance market. 

We also expect to see increased focus around general data and information, particularly around dashboards and reporting. It’s essential that firms analyse and measure all areas of their business, especially with the current pace of change and uncertainty. It’s essential that decisions are made on firm data. 

Trend #5: More focus on reviewing security and risk

Cyber-criminals certainly took advantage of the disruption caused by the pandemic. With more people working remotely, outside the safer confines of the company network most firms risk profiles increased significantly. The result of this combination meant rates of cyber-attack skyrocketed, with massive increases in malware, ransomware, phishing and other methods of attack 

Security is always one of the top concerns for business, but this year we expect there to be a greater focus on reviewing the arrangements in place to ensure they are fit for purpose – particularly with the continued trend of remote working. This could take the form of security audits, penetration testing, phish testing for staff and the like. We would definitely recommend that all businesses prioritise reviewing their risk and controls as a priorityThe rapid pace of change in the threat landscape means the basic measures, such as Cyber Essentials, are really not enough to protect any business. 

Conclusion

These are just a few of the ways we expect strategic IT use and behaviours to change and develop in 2021 based on conversations with our community. There are, of course, many emerging and developing technologies which will have their own effect as well as the outcomes from the pandemic, Brexit and other cultural events. We’d be interested to hear your thoughts on strategic IT trends for 2021, so do reach out to us on Twitter, LinkedIn or Facebook    

Join our Business & IT Leaders Content

For more content like this, plus exclusive invitations to our virtual events, monthly strategic briefings, and personalised offers, join our free community today.



Top 13 challenges for IT Managers right now

Challenges for IT Managers

Challenges for IT Managers

While this change in perspective is positive, it does mean the scope of an IT Manager’s role has increased considerably and, with this, come new challenges to address.  

1. Big data

Businesses are generating more data than ever. Unfortunately, most of this is unstructured so it can’t really add any value. Transforming this data into measurable and actionable insights is one of the largest challenges facing IT pros but get it right and it has the power to completely transform a business, giving greater insight into operations, customers and the wider marketplace. 

2. Asset and data management

The ever-increasing number of devices in the workplace means more monitoring and maintenance. To effectively and safely deal with this, it’s crucial that the IT strategy includes appropriate information governance programs and mobile device management policies. 

As well as managing the known hardware, IT Managers must also be aware of the threat of the unknown. Shadow IT, hardware and software used by staff without the IT department’s approval or knowledge, is an increasing problem in mid-market businesses. In fact, it’s estimated that the number of software programs in use is 14 times higher than thought. This can include things like using cloud file stores like DropBox or Google Drive to share files, personal instant messaging apps or online CRM solutions.  

 

Shadow IT FAQ: Everything you need to know about the hidden risks and how to address them

 

3. Data protection

Forward-thinking mid-market businesses will have already taken a ‘privacy by design’ approach, but meeting regulatory and compliance standards around data protection is a continuing concern. Customers demand – and expect – their data to be private and secure, and any potential threat can easily drive them to a competitor.  

4. New technologies

While keeping up with new technology is a challenge, a greater one is working out what’s the best fit for the business and communicating the reasons why to senior leadership.  

This can be a particular problem for IT Managers who don’t have a seat on the board. It’s all too easy to get swept up by the wave of new, shiny tech and become concerned that your business is missing out because others appear to be investing. Yet this is exactly the type of spend that puts the business at risk and, in turn, creates ‘bad feeling’ towards IT. It’s crucial that IT Managers advocate for ‘a seat at the table’ to address the challenge of new technology and use their experience and expertise to guide the business towards effective investment.  

5. Evolving cybersecurity threats

Cyber-security is a huge challenge, with attacks constantly growing in size, sophistication, and frequency. This rise coupled with rapidly deployed remote working solutions during COVID has led to new risks being introduced to IT environments that quickly need evaluating and controlling. 

Businesses cannot take this threat lightly, as it presents a financial, reputational and operational risk. However, it’s also the area with one of the largest skills gaps – there simply aren’t enough IT security professionals worldwide to meet demand. In Europe alone, the cyber-security skills gap doubled in 2019 and two-thirds of organisations have reported a shortage of skilled or experienced security personnel 

As cyber-security is such a vast and rapidly developing area, it can be difficult for IT Managers in mid-size companies to keep up with all the latest threats whilst also managing day-to-day activity, projects and continual improvement. To address this challenge, IT Managers should consider deploying advanced technologies and services, such as SIEM and MDR, and explore co-sourcing to obtain specialist cyber-security knowledge and experience. 

6. Mobile device management

BYOD is nothing new, but the introduction of multiple corporate and personal devices into the workplace during the pandemic continues to cause issues for IT Managers. The threat landscape and companies risk profiles have grown significantly and controls and so has the need to control it. Keeping users productive and engaged whilst working fulltime is going to need some focus and strategy in the medium and long-term. 

7. Skills gap

IT Managers not only have to contend with a cyber-security skills shortage but, overall, there is a general gap when it comes to tech and IT skills. This has been partly driven by the breadth and pace of innovation, but also because businesses are beginning to recognise the notable role technology plays in attaining their strategic objectives and require a different skillset from their IT pros  

Businesses attribute skills gaps to lower staff productivity, fewer sales, a lack of innovation and new product development and increased operating costs. Yet, despite recognising the harm it causes, few have the processes in place to address skills gaps and do not offer formal training to technical employees to upskill.  

These gaps will only continue to grow and cause further harm unless action is taken. IT Managers must convey to senior management the value of continual and strategic training for technical employees and secure budget to ensure this can happen.  

However, even with training, it’s unlikely that one or two IT professionals will be able to meet all the technical and strategic skill requirements of a mid-sized business unless you’re solely focused on ‘keeping the lights on’. It can be prohibitively expensive to build out a large internal IT team and retain individuals for the long term, which is why IT managers often turn to co-sourced IT support as a way to gain the specific skills they need, often at a fraction of the cost. 

8. Cloud computing

The fallout from the pandemic is only expected to further accelerate the move to the cloud and between cloud platforms, such as a shift to hybrid public and private environmentsThe flexibility, scalability and potential of different cloud platforms are just too greater opportunities to ignore. However, it’s important that IT Managers oversee the selection process to prevent rash decision making and budget wastage.  

For those exploring new cloud-based services, it’s essential to consider security across multiple platforms. Traditionally, multiple clouds meant also managing multiple inconsistent and incompatible security systems. Now, a better option would be a cross-cloud, cloud-agnostic security platform which ensures complete enterprise-wide security, regardless of asset location.   

9. Digital transformation

Digital transformation is complex, and it can be difficult to achieve success. Yet in order to prevent savvy competitors from overtaking them, businesses really need to focus their efforts in this area. 

Projects or initiatives often fall on IT Managers because they’re seen as ‘tech’, but in order to achieve successful digital transformation, the entire senior leadership needs to be engaged, establishing a clear reason for transformation and fostering a sense of urgency for making changes. The challenge for IT Managers lies in driving forward this behavioural change so digital transformation is seen as a much wider piece.    

10. Hiring and retaining talent 

The high demand for specific skills and a lack of suitable candidates results in fierce competition, which can make it difficult for mid-sized businesses to retain their technical talent. It’s not just a higher salary which can tempt IT pros away. Greater flexibility, upskilling opportunities, more manageable workloads and a chance to specialise – rather than the expectation to manage everything ‘IT’ – are all often cited reasons for a move.  

While businesses should review their hiring and employee retention processes to identify areas for improvement, on the technical side they should also consider what skills they really need to have in-house. For example, cyber-security skills are essential, but can your business really offer the work, environment and – to be frank – the salary required to retain an expert with a niche skillset? Rather than engaging a specialist recruitment agency to find that talent, would it be more beneficial to consider other ways your business could gain access to those skills at the level you need.  

 

Read Now: Co-sourced IT Support Guide: The Top 5 Benefits 

 

11. Instilling trust

While recent events have moved IT into the heart of the business, IT Managers will need to work strategically to retain this position.  

IT was hailed as a hero for helping mid-market businesses quickly make the full transition to remote workingkeeping everyone running and productive. However, with people coming back into the office, IT risks becoming the villain by simply seeking to address some of the bad habits staff may have picked up during lockdown – i.e. restricting personal apps, preventing home-working until stronger security measures are in place, slow responses as the helpdesk becomes overloaded.   

12. Increasing workloads

It’s positive that senior management is beginning to recognise the contribution of IT on a strategic as well as operational level, but this comes at a price for IT Managers. Not only are they typically responsible for day-to-day monitoring, maintenance and issue resolution, they also need to undertake improvement projects, create the IT strategy, investigate opportunities and generally help drive the business forward. It’s a vast set of responsibilities and often it may feel like there are not enough hours in the day to do it all.  

13. Outsourcing

The combination of hiring challenges, skills gaps, trouble retaining talent and increasing workloads will lead many businesses to consider outsourcing or co-sourcing 

While this is usually necessary to meet the growing requirements of mid-market businesses, it often raises concerns around reliability, accountability and security. IT Managers can typically be responsible for assessing the suitability of third-party partners, vendors and suppliers so it’s vital they have a strict assessment process in place so they can feel confident in the engagement.  

An IT Manager’s role is continually evolving and therefore becoming more challenging. As the scope of responsibilities and accountability becomes wider, new challenges for IT Managers will crop up alongside those which have held fast for some time.  

A number of these challenges can be addressed by IT retaining a central position in the business and having a voice at the decision-making table. IT Managers cannot address these challenges solely by themselves, they need the support of the entire senior leadership team  

Join the IT Leaders’ Community

Are you an IT pro looking to keep up to date with the latest technology news, get a first look at product releases and upgrades, and engage with like-minded peers? 

Join the IT Leaders’ Forum for exclusive content, downloadable assets and exclusive invites to free events with top-tier tech partners.  



What is warshipping?

IT security - What is warshipping?

What is warshipping?

Warshipping is a type of cyber-attack in which criminals use physical package shipping services to send malicious hardware to a victim or hide malicious hardware on the business premises. This hardware can be remotely controlled by the attackers and used as a staging post for further attacks.

How does the warshipping cyber-attack work?

Warshipping uses custom-built devices consisting of cheap, easily available components: a single board computer (£30), phone battery (£15) and IoT modem with 3G connectivity (£35). The resulting device, or ‘battle package’, can be smaller than the palm of your hand and, once configured, is easily concealed and shipped to a target.

A warshipping battle package revealed within a packaging component

A battle package laid bare. Image source: IBM

Whilst an attacker needs some technical knowledge to assemble the loose components into the battle package, it’s easy to imagine entrepreneurial criminals soon selling pre-built machines on underground forums. If this were to happen, the threat to businesses would dramatically increase as the attack becomes available to the masses.

Once a battle package is shipped, the modem regularly transmits GPS coordinates to the attacker’s command and control server. This allows the attacker to identify when the device has arrived and start full deployment. Of course, the device doesn’t have to come in the post – it could be planted into a toilet roof or hidden in a bush outside of reception.

Deployment involves one of two things:

  • The device will imitate the existing Wi-Fi router, harvesting the login credentials of users who attempt to connect to the rogue access point.
  • The device will intercept packets, looking for a handshake (the connection between a device and the Wi-Fi access point). The encoded handshake can then be sent back to the command and control server to be reverse-engineered and used to gain access to the network.
Book an online review and speak to a security consultant about how you better protect your business

What threat does warshipping pose?

Once the attacker has access to the network, they can exploit vulnerabilities to gain deeper access. This allows for further attacks to be sent directly into the network – eventually creating a persistent backdoor for the attacker. From there, it’s possible for the attacker to gain full access to systems and information.

In business terms, a security breach like this is about as bad as it can get. Hackers would have complete control and access to your IT network and could do anything from deleting days of work with a wiper to a full-scale ransomware attack or even theft of intellectual property and client data. All of these cause massive financial damage to your business alongside making a permanent stain on your reputation.

Warshipping attacks companies from a completely new angle, which allows attackers to bypass nearly all perimeter defences. And with no ‘years proven’ method of mitigation known, the potential threat to businesses is significant.

How to prevent warshipping?

Warshipping bypasses nearly all common perimeter defences by physically intruding into the network. With no proven defences yet, the threat might seem insurmountable, but with some clever planning, it can be pre-emptively mitigated. Your focus should be on securing your wireless access points and effectively handling parcels. There are a few changes you can make now to work towards this:

Upgrade to secure Wi-Fi access points

Upgrading Wi-Fi access points to use Wi-Fi protected access (WPA) at a minimum or WPA2 (an upgraded version of the original standard) can make it difficult for criminals to intercept useful data from your company Wi-Fi due to the use of encrypted traffic.

Even WPA2 will not provide immunity to warshipping though since the standard contains flaws. What WPA2 will do though is require significantly more effort from an attacker – providing additional time to identify and destroy the device.

Prevent employees from delivering packages to the office

By creating a policy that prevents personal packages from being delivered to the office, any unexpected items will be immediately apparent. If preventing personal deliveries is impractical, scanning the contents of a package to identify hidden electronics can be used instead.

Monitor for rogue Wi-Fi devices

Constantly monitoring your company network for new and suspicious devices allows you to identify rogue access points. But technical defences alone are unlikely to remove this risk completely.

Educating employees about the dangers of connecting to lookalike Wi-Fi networks can go a long way in helping them understand what part they play in defending against warshipping.

Establish a quarantine zone for packages

In a company where it’s both infeasible to prevent employees from having packages delivered and to scan for metal or electronic devices in a package (i.e. where hardware is regularly delivered), another method of prevention is isolating the mailroom from the wider network.

Utilise multi-factor authentication

You should already be using multi-factor authentication since it’s a staple of security and something you’d need if you were to operate to a decent IT security framework such as ISO 27001.

Having a second factor means that even if the attacker manages to acquire the password to gain login details, without the second factor, they will still be locked out.

Where does the name ‘warshipping’ come from?

The name warshipping is nothing to do with warships. Instead, it’s derived from shipping (as in package shipping). The name draws from another attack known as wardriving where cyber-criminals will drive around an area, using a similar technique to break into insecure Wi-Fi networks.

What does warshipping tell us about the wider cyber-security landscape?

Warshipping shows us two things about the modern threat landscape. It shows that cyber-criminals are thinking outside the box when it comes to new channels of attack. And it shows a shift away from digital cyber-crime into real-world cyber-crime (a tremendously oxymoronic phrase by the way).

The idea of sending a package containing a hacking device to a company in order to break into the network sounds straight out of the plot of a heist movie. But the fact that we’re now dealing with this as a genuine threat shows the ingenuity of hackers.

If businesses are to keep pace with the new avenues of attack, they need to be dedicating resources to thinking about what the future holds for their cyber-security. If IT teams are already stretched thin, partnering with an IT security provider who will monitor and predict changes in the threat landscape is another option.

As for the shift towards real-world cyber-crime, it’s a trend that’s already been happening. Up to 99% of all cyber-attacks nowadays require human manipulation through social engineering rather than breaking into a network via pure computer skill.

While we’re currently in the era of spear-phishing (meaning spear-phishing is seeing the most widespread success, not necessarily that it’s the most common or newest), as employees become more sceptical of digital communications and wise up on attempts to trick them, criminals will have to transition to real-world approaches. Whether this will take the form of warshipping, USB drop attacks or even face-to-face social engineering, only time will tell.

Despite the constant stories of breaches and cyber-attacks, the tools do exist to counter almost every digital threat. In an environment that follows all security best practices (2FA, zero-trust, patch management, intrusion detection and prevention, e.t.c.) the risks can be controlled to a sensible standard. Most breaches are preventable if the business adheres to the security basics (such as what’s gained through obtaining the Cyber Essentials standard).

The reason we still see successful attacks (outside of companies’ inability to do their due diligence) is because attackers are exploiting humans. With attacks poised to move into the physical realm, not only will many of the digital defences become useless, but the human element will be more vulnerable than ever.

Are you concerned about your security and want to know how to better protect your business? Click here to book an online review with one of our security consultants today

In the press: The future of cloud computing

Originally published on Mail Online.

cloud environment for business

While the ‘cloud’ is not new, it is big business. Providers such as Amazon, Microsoft and Google are spending billions on their cloud infrastructure, and some commentators believe the cloud computing market could be worth more than £312 billion by 2020.

Cloud services offer greater flexibility to businesses of all sizes. When a firm wants to upgrade its software, it can simply run it online. If its local network runs out of storage, it doesn’t need to buy new servers it can rent space from an infrastructure provider. However, the question for investors is how they can get in on this boom.

In this article from the Mail Online, Robert Rutherford, CEO of tech consultancy QuoStar, comments on the future of cloud computing and why the service is beneficial for businesses.

According to Rutherford, there are strong opportunities. “Cloud is now the main method for delivering IT. It’s not some fad such as cryptocurrency. The benefits are proven and helping drive business growth.”

Read the article in full on the Mail Online.

How AI is protecting businesses from cyber-threats

IT security - How AI could be the future of cyber-security

We are currently in the middle of another industrial revolution. This so called Fourth Industrial Revolution (4IR) has the potential for change on a massive scale.

The first industrial revolution brought us mechanisation and steam power. The second introduced production lines and electricity. The third added computerisation and robotics. And now the fourth promises interconnected intelligent systems.

Artificial Intelligence (AI) is next big thing in almost every industry. Even being called “the new electricity” in reference to its capability to revolutionise the way we work. And amidst this rapid change, the sphere of cyber-security has not gone untouched by the new power of AI.

Advantages of AI in cybersecurity

Most approaches to cyber-security such as firewalls or antiviruses rely on signatures. For instance, a firewall will drop incoming traffic from a known malicious IP. And an antivirus will prevent files with known pieces of virus code from running.

But because these systems rely on signatures, a new threat can slip past and cause untold damage. What’s worse is that large amounts of malware already bypass these peripheral defences by using emails as a carrier. Additionally, these approaches to cyber-security leave the issue of insider threats completely unguarded.

AI offers a solution to these problems.

Protecting against external threats

By using machine learning, AI can build a view of ‘normal’ on the network. Then when something something out of the ordinary happens, it can flag it.

Malware doesn’t act like a human does. So the ability to identify anomalous activity is incredibly useful. A human doesn’t access thousands of files per second because they can’t click that fast. But, a piece of malware is easily capable of doing such a thing. This makes spotting it easy.

For example, let’s say a normal employee accesses 50 files a day. One evening, after office hours, an account begins accessing and encrypting hundreds of files per second. The AI detects this as unusual behaviour and locks the account. Preventing it from accessing any more files.

In this scenario, ransomware had infected the machine was infected. It intended to encrypt and ransom back company files. By using the machine learning data about what typical activity looked like. The AI could determine that suspicious activity was occurring. Then by performing a rapid response, it contained the malware. Limiting the damage to the company’s files.

But AI-based security systems aren’t only capable of dealing with the behaviour of humans. They can also detect when hardware or software is acting in suspicious ways.

For example, placed around the office are several networked security cameras. Including one in the meeting room where major corporate decisions are made. The AI detects that the meeting room security camera has made a repeat connection to an unknown IP address outside the business and flags it.

A follow-up investigation discovers the device was infected with spyware. Allowing someone to watch private meetings and learn company secrets. Although damage had already occurred, patching the issue prevented it from happening again.

Protecting against insider threats

Besides detecting typical threats in the form of malware. AI-based security systems can also detect unusual activity from malicious employees.

For example, a disgruntled ex-employee with access to the company database containing client information decides to get revenge. They attempt to steal company files using the cloud storage system that employees can access from home.

Total downloads of 5GB of data from the company cloud every month are typical. So when the AI detects a download of several terrabytes it sees it as unusual and locks the account. Preventing the theft of company records.

Because the AI defence system can see any type of unusual activity, dealing with insider threats becomes as easy as outside attacks. Current cyber-security solutions don’t have a good way of detecting an insider threat. And it’s only been through new applications of AI and machine learning that the prospect of reliably detecting insider attacks has arisen.

Disadvantages of AI

Unfortunately, AI-based cyber-security is not a perfect system and has its shortcomings. The main issue is its inability to differentiate harmless unusual behaviour from dangerous unusual behaviour. This can create a significant management overhead.

For example, a typical employee who works in the marketing department acquires an album of stock images to use in marketing materials. They decide to download them from the company cloud system so they can work from home. The AI sees the unusually large file download and locks the account.

Although the actions of the AI are reversible and the account can be unlocked, the disruption resulted in lost productivity. Because unusual things are sometimes done on purpose and without bad intentions, an AI can be overreactive.

This, along with the technology being still in its infancy means an AI security system is generally used as a supporting tool to a typical security system. Instead of being the single line of defence.

To conclude

The evolving use of AI in IT security is already invaluable and it’s going to develop quickly – it has to as the threat-landscape is just so large. But it’s worth noting that on the other side of the fence, hackers have begun using AI to breach security defences. The battle has begun…

Why are growing businesses embracing managed IT support?

why growing businesses choose managed it support

You would be hard-pressed to find a company these days that doesn’t rely on some form of IT infrastructure.

Even a business of one would require, at a minimum, access to a smartphone, which can connect to a web browser, social media, email, contacts and relevant enough. Even then this is not enough.

Big businesses know that in order to stay relevant, competitive and successful they need to invest in their IT environment and its management. They will have entire teams dedicated to the smooth and efficient running of the overall IT infrastructure and continued maintenance and development.

As a growing business, how do you compete with this level of management and investment? As a business owner, you may understand the critical role IT plays in the running and the growth of your organisation, but you may not have the resources or the time to dedicate to hiring a complete internal IT team.

Even for growing businesses with a dedicated IT person, it can be difficult to cover all of the bases. What happens to IT when that person goes on annual leave or is off sick? How do you prioritise everyday maintenance and IT development projects? What happens to the day-to-day tasks when a crisis hits?

This is where managed IT services come in. It basically involves outsourcing your IT requirements to a third party, who take responsibility for IT maintenance and support. This approach usually offers more competitive costs, but there are several other key reasons why growing businesses are choosing managed IT services.

The benefits of managed IT support

Ease of maintenance

Many growing businesses may only have one “IT person” who is responsible for all company requests and continual maintenance. Any IT crisis monopolises the attention of the IT person, leading to them potentially ignore other IT operations. This could cause significant problems for a growing business.

Security

Data breaches, malware, and phishing attacks have all been on the rise in the last year, and the cost to growing businesses can be enormous. It is claimed that 52% of British businesses fell victim to a cyber-attack in 2016 and, as a result, lost £29.1bn.

Not only do cyber-attacks cause financial damage, but companies will also experience damage to their reputation – which can be fatal. A reputable managed services provider can take responsibility for establishing and maintaining security procedures and programs, ensuring all systems are patched and up to date, and that you have the necessary security measures in place e.g. anti-virus protection, firewalls, content filtering etc.

Innovation

Technology changes at an incredible pace and it can be difficult to keep up with when you have many other demands on your time. Ignoring technology innovations could leave your business falling behind competitors, but how you can identify the latest fad from the technology you need without dedicating major time and effort to research.

A forward-thinking managed IT services provider will take care of all this for you. By getting to know you and your business they will be able to identify technology you truly can’t be without and present a clear business case as to invest.

Reliability

With managed IT services there is a proactive approach to IT management. Hardware and systems are monitored and tested regularly to resolve any potential issues before they cause damage. Your IT support contract will include Service Level Agreements (SLAs). These set out guaranteed response times based on the priority level of the issue, and penalties for not meeting them.

Predictable IT costs

For many growing businesses the bottom line is everything. While many may assume that outsourcing is more expensive than keeping IT in-house, this is not always the case.

Many providers offer support contracts on a flat monthly fee, so you have a predictable cost that fits your budget. Of course, it’s important to check exactly what your IT support contract includes. Sometimes there can be sneaky additional costs, but on the whole, it’s likely you’ll reduce spending.

Conclusion

If you require, at least, computers, internet access and secure data storage then you should consider managed IT services. Meet with a few different managed service providers, explain your requirements and see what they can offer. No IT management is not an option. But bad IT management could make things even worse, so take your time with this decision.

Top 8 business technology trends for 2017

Technology is consistently evolving and developing at such a pace that it can be difficult to keep up with the latest trends, and most articles tend to focus on the developments in the consumer sphere. I’ve compiled a list of trends from an IT perspective and how they will apply to and affect the business world in 2017. Here are eight of the most important trends that will matter to both the IT professional and business executive.

business technology trends 2017

The top technology trends we expect to see this year

1. Automation becomes a business focus

As the competitive landscape is now national and international every slice of margin matters. This has certainly led businesses across all sectors to really look at their systems and processes. Business and systems analysis has fallen through the cracks in many businesses, between the IT and the leadership teams. Now both are becoming committed to understanding where a business can gain efficiencies through altering the working practices and how they interact with the systems that power their business.

2. One cloud doesn’t fit all

Finally, the cloud drum has quietened down, and businesses understand that the cloud isn’t a magic solution to solve all their IT woes. Cloud is simply part of an ecosystem of IT delivery platforms that come together into what everyone in the industry calls ‘hybrid cloud‘. In essence, you may run some applications and systems in one cloud, some in another and some on-site, as that’s the right thing to do from a systems perspective and, in some cases, a cost perspective (cloud isn’t always the most cost-effective option).

This should lead to a bit of a shake-out in the IT industry as systems need to be engineered correctly for a business to gain from its IT infrastructure. The new entrants into the cloud market are going to struggle with the “it’s all about cloud” line. This will change in the future as the market changes, but currently a hybrid model is the right solution for many businesses of all sizes.

3. A wider digital mesh

Through 2016 we’ve certainly seen an increase in the meshing together of different hardware platforms, operating systems and applications. From Facebook picking up your LinkedIn contacts to messaging your traditional contacts through WhatsApp, and using Microsoft Office on your iPad. As we go forward into 2017 expect the density of the mesh to increase, streamlining and merging our digital personas and lives. From business through to personal, you can expect one amalgamated portal that follows you as you move from device to device.

4. AI awareness increases

Artificial Intelligence (AI) and advanced machine learning are starting to creep into our lives, from virtual assistances like Siri and Alexa through to autonomous vehicles, but true AI is still decades away. Sure robots work in some functions, such as car plants and hoovers, but there is plenty of room in the AI arena for development and many sectors are clambering for an advantage. This is particularly true in the legal sector where, in theory, AI should be able to make decisions based on input, logic and history. For example, writing contracts or determining the likelihood of success in a case. Expect rapid growth in consumer interfaces but the road to advancement in the business world, particularly when dealing with enormous amounts of data, will be a bumpy one.

5. Conversational systems

One AI interface that everyone seems to be jumping onto is the chatbot. You only have to look at the bot section of Skype to see the growth in the technology, along with many big brand websites. You simply interact with an application through text speak and it uses a form of AI to get you to an end result. One example would be diagnosing a medical condition through a series of questions. It’s relatively straightforward logic but creating the right feel for the user isn’t easy. Voice control, such as that within cars, is also now becoming common. Systems like Amazon’s Alexa are taking this even further by undertaking simple tasks for us.

6. Adaptive security improves

The rise of the intelligent digital mesh and the IoT (Internet of Things) creates a fast-moving security threat landscapes, which will be difficult to secure with traditional security controls. Adaptive security systems have been around for about 10 years and, in short, they monitor application, user and network behaviour. It takes a baseline and then watches for behaviour outside of the norm. For example, a large amount of data being sent over a Skype session. The system can then shut down the connection and alert the user and/or IT who can take action if required. In the past these systems have been very clunky, frustrating both the user and the IT team. As with all things technology, the second wave is nowhere and they have improved dramatically wherever they are located on the network estate.

7. Desktops die off

There isn’t really much point in the desktop now is there? Of course, there are exceptions where powerful desktops are needed but, in the main, the typical worker doesn’t need one. We aren’t chained to our desks as we were a decade ago. We need information at our fingertips in meetings, we need to collaborate on the move and work remotely much more now. There’s no longer a need to work on multiple devices either. The rise of the Microsoft Surface Pro and the like deliver all the services of a desktop, laptop and tablet in one package. If there’s no room in the budget for these then standard laptops are now comparable in price to PCs.

8. 3D printer use increases

The cost and reliability of 3D printing have improved significantly throughout the year. Certain sectors, particularly manufacturing, education, healthcare and design, will all be investing further in 3D printing equipment. The main focus will continue to be dramatically cutting costs and the time involved in prototyping.

Robert Rutherford, CEO of QuoStar

Want to find out more about a specific new technology and how it could apply to your business? Contact us today to arrange a free consultation

In the press: Brexit and the tech industry

With the “Brexit” and “Bremain” campaigns both in full flow, Tech Radar Pro examines how leaving the European Union (EU) could impact the UK’s technology industry.How will Brexit affect the UK technology industry?

Migration, the economy, investment and data laws are all considerations, as the vote draws closer. One of the concerns highlighted by QuoStar CEO Robert Rutherford is the skills shortage. Something the UK is already suffering from despite free movement throughout the European Union at the moment. This skills shortage is particularly apparent in the technology arena and these businesses could face further issues.

Will it be harder to employ skilled IT professionals from inside the EU? Can London remain a digital capital of Europe despite being outside of the EU? How will the vote change the future of tech? These are all questions a potential Brexit is raising amongst tech professionals.

Click here to read the article in full on Tech Radar Pro

Data centre convergence & changing job roles

data centre convergence and changing job roles

Why are we seeing rapid growth in converged/hyper-converged data centre infrastructure?

Data centre infrastructures had to converge, predominately due to the demand for cloud/hosted services. The global economic situation, skills shortages with the market and escalating salaries simply led to a mushroom of technologies to help those running those data centres capitalise on the demand – straightforward market dynamics really. Sure, it would’ve happened anyway but the global market and amount of competition in the space certainly sped up the process.

As we are still in the race to zero on costs, led by Amazon, Microsoft and the like, the technologies available will continue to reduce the requirement for the level of skills needed right now. We are pretty much moving back in time where a single vendor provided and often managed the core platform. For example, mainframe and minicomputer systems. It just makes business sense now. A black box delivering computers, storage and networking, rather than lots of different pieces together with string.

What impact is it having on those working within data centres?

Those starting their careers in data centres must understand the value that their knowledge will have in the long term, and how this can be maximised as businesses turn to automated processes. Fewer people are needed to run a data centre than say three years ago, due to automation and orchestration technologies. The level of integration and APIs between vendors is getting sharper, reducing the number of skilled personnel needed to run operations on a daily basis. These changes along with the rise of the public cloud, into the mainstream, means career considerations need to be made.

The worst thing that data centre workers can do is push back against the move to greater automation and integration. Particularly public cloud integration. With Amazon and Microsoft opening data centres in the UK, they will start to hoover more clients in. This creates opportunity with the areas for development focusing on hanging different platforms and providers together. Engineering if you like – moulding and adapting services between data centres, vendors and suppliers. This, in turn, will lead to increased security and compliance requirements, creating a demand for in-depth cloud security and compliance skills and experience. This is really going to be one area that comes to the fore over the next two to three years.

What’s the demand for those with the right skills?

Those with the skills and experience of hooking together (converging) numerous systems, providers and vendors are going to be in demand as data centres rush to protect their margin in a highly competitive market. This fact alone has to lead to real demand for those who understand both the commercial and technical reality along with the skills required to help protect the profit margin of a business. Taking it further, those who can package everything into a hyper-converged platform are also going to be in demand. However, this model still goes against the grain for some technical leads; they want some flexibility, rightly or wrongly. Over the coming years, this could change though as we really do get into utility computing for the masses.

What should the skills focus be?

Datacentre IT professionals have to look into the orchestration, automation and the associated hybrid-cloud platforms. The skills required will revolve around these areas, focusing on making operations leaner, more reliable and giving clients more options. Obviously, the solutions from the likes of Dell and Cisco’s FlexPod are pushing out and down in the various sizes and types of infrastructure.

Can universities help?

I don’t believe that universities are up to speed on the rapid-growth of the cloud and data centre markets. It’s difficult to do as the change is so rapid; the customer and supplier side, the global giants and small startups are driving this on all fronts. By the time a student comes out of university what they learnt at the beginning could be irrelevant. If however universities and apprenticeships teach systems analysis, software engineering, networking and core IT skills this will help those going into the field. Once you understand the concepts then these don’t change. No matter how fast the market runs, IT principles are IT principles.

We find that those coming from IT-related courses which cover computing, analysis and software engineering principles benefit at all levels of their career. As you grow and the market changes you always have a base knowledge to anchor back to. Everything coming into the market is based on the same principles, just with new and innovative approaches.

Robert Rutherford – CEO of QuoStar

NEXT>> Cloud computing workers wanted