Blogs Archives

You are more likely to be attacked from the inside by ‘one of your own’ than you are by a distant faceless cyber criminal.

In a far-off land, huddled behind a back of glowing computer monitors, there is a criminal gang planning its next great cyber attack. We can only imagine what their ultimate aim is but it’s safe to conclude that money will be a motivating factor.

If the headlines are to be believed then at any moment and without any warning they will strike – ninja like – and your years of hard work building your small business, or progression up the corporate ladder will be undone. But is that reality?

While it’s true that wide-ranging phishing attacks and ransomware are affecting many, there is a far greater chance that a business will suffer an attack from the inside. It’s more likely to be ‘Bob’ from down the corridor then some sophisticated code warrior who can break encryption technologies with nothing no more than a notepad and their overly developed intellect.

The ‘Cyber Insider’, or the ‘Insider Threat’ as it also gets referred to is someone who (knowingly or unknowingly) misuses legitimate access to commit a malicious act or damage their employer. The most notorious of this breed is Edward Snowden who famously copied and leaked classified information from the National Security Agency (NSA) in 2013 without prior authorisation. His motivation was that of a political stance, as he wished to expose wide scale surveillance programs that were being undertaken at the time.

So, what would motivate an ‘insider’ within your business or organisation to commit a cyber crime?

Read the rest over at Cyber Insights, brought to you by the National Cyber Skills Centre.

Certes specialise in IT staffing for all sectors and industries. We are now working with the National Cyber Skills Centre in order to provide staffing to companies in need of cyber security. For cyber security jobs, Click here.

“Why don’t you ever learn!”, would be a familiar phrase to me as a child as I could never resist the temptation to touch wet paint just to see if it was wet or not. Of course it was wet, but why didn’t I believe it? Every time I’d touch it I’d get a small dot of white gloss on my index finger and then feel bad that I continued to ignore warnings about it being wet.

I’d have to get a bit of paint thinners, turpentine or some other chemical that I really don’t think was doing my skin much good in order to remove this visible symbol of my continuing lack of judgment. Now many decades on have I learned my lesson? Yes, but only just. Even now the temptation to ignore wet paint warnings is very strong.

In another generations time we may collectively have learned our lesson, not in the touching of wet paint, but with cyber security. If you are working at the sharp end of IT it’s unlikely that you get a chance to look back at what has come before and learn from it. IT is mainly about the next upgrade, the next technology, improving speed and efficiency, it is not an industry that is known for much reflective consideration.

Have we learned our lessons from cyber security? Maybe not as well as we should have done.

Read the rest over at Cyber Insights, brought to you by the National Cyber Skills Centre.

I didn’t mean to do it, I really wasn’t that interested, but the two professional looking types at the adjacent table to me in the coffee shop just couldn’t keep their business conversation to themselves. Even though I had my white Apple earbuds plugged in and to those around me would appear to have little interest in what was going on beyond the realms of my table, I heard every detailed word of a conversation that essentially should have been labelled ‘private and highly confidential’.

To distill their 30-minute conversation down to a handful of lines, they were discussing a sensitive HR issue. The core of their conversation revolved around a chap called Guy, he had done something that was leading to a disciplinary. Yet as the ‘powers that be’ had wanted to get rid of this chap for years, this was their chance. He had been an expensive hire and according to their in house measurements had failed to live up to expectations. These two individuals were negotiating a package of measures that they would present to Guy later that day, they would see him provided with a ‘pay off’, but they couldn’t use that term, a glowing reference that made no mention of this current investigation into his conduct and no doubt a warm handshake from his corporate assailants. I felt sorry for Guy, he doesn’t know what was about to come his way…

Potential cyber breaches occur every day in coffee shops all over the country.

Read more over at Cyber Insights, brought to you by the National Cyber Skills Centre.

Are you suffering from ‘imposter syndrome’ when it comes to cyber security?

Would you like to know a secret? Would you like to know all about senior people in business who are hiding ‘in plain sight’? These are not criminals, these are not liars, these are not corporate spies. These are regular people, just like you and me, who have got to the top of their game, to board level, to positions of power and influence but many are suffering from ‘imposter syndrome’, which to put it in more readily understandable terminology is the nagging fear of being ‘found out’.

Read more over at Cyber Insights, brought to you by the National Cyber Skills Centre

"Cyber statistics are flooding out thick and fast, crossing my desk every day. Millions lost, hundreds of millions effected, billions being invested, hundreds of thousands of skilled workers needed, the value of the cyber industry, the number of people working within the cyber industry, the size of an attack, the frequency of attacks, it goes on and on and on. They become a white noise of statistics that although impressive, fail to impress".

When it comes to cyber security statistics a company only has to remember two simple numbers

Read more over at Cyber Insights, brought to you by the National Cyber Skills Centre

Irrespective of how hard you may personally resist it, evolution keeps on – well, evolving! Call it innovation, research and development or just the desire to make things better, evolution in all aspects of technology is happening right now.

Security continues to evolve. Take the security of your car for example. My first little car had a key, that you popped in the door, turned it and a little peg like structure popped up so you could get in. Once in the drivers seat I’d have to lean over to the passengers side, pull up the corresponding peg and let in the passenger! – remember? It was not the most secure of locks, as a well placed screwdriver, coat hanger, or other applied mechanical device could circumvent it quite easily. Then along came central locking, pop the key in turn it and all the doors opened. Then before I knew it I had remote central locking, press a button on the key fob and the doors unlocked. Now we have keyless entry and I’m sure the evolution of car security will continue to evolve.

For a few years now there has been an evolution on IT security, that even though it’s free and readily available to most of us, very few are using it. Most people are still on ‘the keys in the locks and watch the peg pop up approach’, by using a single password – that in so many cases is still ‘password’ or ‘abc123’.

As cyber crime in both professional and personal life continues to grow, now would be a very good time to implement two factor authentication.

Read more over at Cyber Insights, brought to you by the National Cyber Skills Centre.

Will we one day look back and be pleased that cyber security appeared when it did?

Have you ever been told that “Everything happens for a reason”? I know I have, many times. Usually involving some challenging aspect of my life that has cropped up without warning and now requires a huge amount of effort to resolve.

The theory is that for whatever reason these things were ’meant’ to happen in order to allow future events to unfurl with ease.

Don’t’ worry, I’m not going to get all new age on you here, but having pondered on all aspects of the cyber security world for a considerable time now I have concluded that it’s timing is perfect and in years to come businesses and consumers alike will look back on this period of time when, as the RSA Conference called it last week, ‘Peak Cyber’ occurred.

Just to backtrack slightly, have you ever pondered why the bubble of cyber security has occurred? What caused it? Why has it gone from a slightly niche subject in computer science to front page news in a handful of years? Well despite talking to many, many cyber security experts, specialists, consultants and trainers they’ve not been able to say exactly ‘why’. So, I’ll take my own stab at it…

Read the rest over at Cyber Insights, brought to you by the National Cyber Skills Centre.

How would you react to seeing a major incident occur in real time right in front of your eyes?

During the summer of 1993 without any prior warning, I was an eyewitness to a plane crash. Two Mig 29 fighters from Russia were performing an aerobatic display at the Royal International Air Tattoo, held at Fairford in Gloucestershire when they collided in mid-air and came tumbling to the ground in massive fireballs.

Miraculously there were no injuries with both pilots ejecting safely. The official investigation determined that pilot error was the cause after one pilot did a reverse loop and disappeared into the clouds, the other one lost sight of his wingman and aborted the routine.

What sticks in my mind most about this event was how seemingly robust technology, technology that less than 5 years previously had been on the Russian side of the Cold War, was reduced to nothing in a matter of seconds by one single flaw. In this case, the flaw was human. Millions of pounds of hardware investment lay in a pile that was no longer of any significant use. I watched as the wreckage was packed up and shipped off to, I assume, a secret location where military grade aircraft accident investigators would forensically analyse this former adversary’s technology.

Fast forward almost quarter of a century and you can actually watch, in real time, the relentless attempts to compromise the flaws in today’s leading edge technology by cyber criminals. For a couple of years now the team at Kaspersky have been running an interactive cyberthreat map that is almost hypnotic in its illustrations of attempted attacks.

Read the rest over at Cyber Insights, brought to you by the National Cyber Skills Centre.

Many of the scientists, hardware engineers and software specialists that I have met are all hoping that their contributions to the wider progress of technology will make the world a much better, nicer and safer place for us all. Sadly, that hasn’t always been the case as the scientific and engineering endeavours of some individuals, that may have been well meaning at the onset, have had to witness their work being implemented in such a way to cause destruction and death.

The weaponisation of the internet continues as countries around the world develop both defensive and offensive capabilities online. Will this lead to the computing pioneers and fathers of modern computing coming to regret their innovations too? Some sadly have already departed and will never bear witness to how cyber security, cyber defence, cyber war and other activities will develop, but will Bill Gates (Microsoft), John Chambers (Cisco), Larry Page and Sergey Brin (Google) and others look back on their technical legacy with any regret?

In the future how will the computing pioneers of today look back on the role they played in the creation of cyber crime?

Read the rest over at Cyber Insights, brought to you by the National Cyber Skills Centre.

Accidents can happen, but we need to learn from them.

Despite all the technological advancements of the last few centuries the scientists and engineers of this world have yet to crack the ‘if only I could turn back time by 30 seconds’ that is often needed once you have incorrectly addressed an email.

If that technology had been available, then the National Health Service (NHS) staff member who this week inadvertently sent an email to all 840,000 staff members would have been its biggest fan. As members of NHS staff then “replied to all” they further exacerbated the issue and the email system quickly ground to a halt after no doubt frustrating tens of thousands of hard working individuals in the process.

Any organisation that has a global staff email list that can be accessed by anybody, even accidentally, needs to swiftly review its email usage policies. As a former IT Manager, I often witnessed how such lists were wildly used for the most menial of messages; lost umbrellas, missing office furniture, requests for lifts to and from work, clogged up the Inboxes of everyone. When such messages are sent out to thousands of people, who in turn open and read them, the sheer loss of productivity is a compelling argument enough to apply some restrictive managerial guidelines. Used accidentally, it just cries out that there is a most basic lack of IT awareness within an organisation…

Read the rest over at Cyber Insights, brought to you by the National Cyber Skills Centre.