Simon PG Edwards

Cyber Incidents: What exactly should organisations be monitoring? 🤔 We spoke to Cyber Incident Responder, Vanessa Horton, for her advice on what organisations need to be monitoring: Security events. These are just everyday events on your systems or networks – logins, incoming emails, files received, and so on. So, for example, if you suddenly get someone logging in from Russia, and they weren’t on a business trip there or something, you need to investigate. This means you’re not just tracking the logins themselves, but also certain information about them – locations and IP addresses, login times, files or services accessed, and so on. Again, you have to know your baseline. What is expected activity? And if it’s unexpected, someone must quickly investigate. If a threat actor did gain access to a user’s account, you want to prevent them from accessing anything else. Equally, if it’s just someone who’s on holiday in Russia and decided to log in, you can dismiss the security event. But you must establish that in your initial follow-up; you can’t just assume it’s not a security incident. [The difference between a security event and a security incident is that an event is an everyday occurrence – like users logging in. But some events also signify a security incident: a breach of confidentiality, integrity and/or availability, also known as the ‘CIA triad’.] Read more from our 'A Practical Guide to Cyber Incident Response' with Cyber Incident Responder, Vanessa Horton 👉 https://lnkd.in/eJnBShva #CyberSecurity #IncidentResponse #CyberIncident #Infosec #Anomaly #SuspiciousActivity

5

Questions for NIS Compliance interest... We are helping many organisations with  NIS compliance work and have an interest in other organisations' experiences. Vibert Ltd advises NIS and NIS2 compliance as an ex- NIS Regulator and have many common findings. What do you experience? NIS and NIS2 are driving cyber/resilience improvements across many industries. Some are responding faster than others. Which industries are slowest and how can we all help them better? NIS2 will be a tidal wave starting in 2024 with addition of thousands of organisations, many new sectors, and accountabilities of Essential and Important entities. NIS V1.2.x UK may also do similar in future..... How will CAs and CSIRTs manage this mega wave? Our typical services may comprise, for example: NIS Advisory to CxOs/Boards/Senior Staff and NRO/DNROs etc. on NIS importance. NIS Advisory to OES for Inspection Readiness walk arounds and workshops. NIS Advisory to OES as Dummy Inspections. NIS Advisory regards Regulatory Enforcement. Teams calls with Seniors. Other possibilities.. Suggestions? Our NIS visits offered typically discuss topics like : - The Inspection Schedule across each phase. Interactions with Regulator during Inspections. Site visits: Where, how, and what is looked for. Each day of an Inspection. CAF discussions. Typical topics of an Inspection. What to prepare and how to present. What will be the outcome of each day and each phase. Who will attend from the Regulator and the OES. What will be asked and what won’t be said. Timelines. Outcomes. Information Notices and Fines. How to be best prepared. Etc. What topics are we missing? As an Ex-OFGEM NIS Inspector, we offer customers a unique insight into NIS Inspection preparedness that teams might find a useful differentiator. Some Consultants add us into their CAF programmes, just for a handful of days, which gives them a strong sales boost. We currently assist several OES in preparation for NIS Inspections. We trained many of the other Competent Authorities Inspectors in “our way” as we were leading UK (and probably EU) in NIS Inspections. E.g. OFGEM, ICO, DfT, CAA, HSE, DWI, etc. Suggested USPs… :- "Ex-NIS Regulator Principal Inspector Advisor"!!.. "Led the UKs 1st NIS Inspections"... "Developed the UKs NIS Inspection and Enforcement Programmes".... "Trains NIS Inspectors"... "Covers IT, OT, Cyber, Physical Security, Process, GRC, etc.".... !! We look forward to hearing from Operators and from Consultancies so we can develop the right SOW and Proposal for all our needs. How can we all help to assist more compliance as it will benefit society as a whole. Cevn Vibert CITP CEng FIET FInstMC FBCS 27kLA GICSP Global Director NIS Advisory and OT Industrial Security. [email protected] Vibert Ltd. www.vibert.ltd.uk #QuestionForGroup

6

Despite the search engines' efforts to combat scams through identity verification processes, fraudsters are still finding ways to impersonate well-known brands like British Airways and Tesco. 🛩️🛒 Here's what you need to watch out for: 📞 Speed dial a scammer Fake ads on Bing that direct you to call a phony British Airways helpline, where scammers try to steal your sensitive information. 🌐 Fake contact details on genuine websites Scammers cleverly link their ads to search results on the real British Airways website, making it seem like you're seeing legitimate phone numbers. 🎡 Fake spinning wheel competitions Bogus ads on Google that appear to link to Tesco.com but actually lead you through a series of redirects to a fake "RewardsFlow" website, where they try to collect your personal data. It's alarming to see how sophisticated these scams are becoming. The key takeaway? Always be cautious when clicking on ads, no matter how convincing they may seem. Double-check the URL and contact information before sharing any sensitive data. I like people to go out of that site and contact them through their official website to check the authenticity of the call or claim. You just have to assume these days that everything might be a scam unfortunately. Has anyone you know been a victim of something like this? https://lnkd.in/dkXphu_m  #cybersecurity #cybersafe  #securityeverywhere Francis West -------------------------------------------------------- Dedicated to Your Cyber Security  Our mission: To protect 1,000,000 businesses from cybercrime by 2026. Register Now: How does AI impact your Cyber Security? https://lnkd.in/dSH5kBEE Watch our previous session: Backing up your data is the last line of cyber defence! https://lnkd.in/gkMdAQjX Follow our page https://lnkd.in/edVpnGQa Book a call https://lnkd.in/efjUXeVv Visit our website https://lnkd.in/gnH8FxQw ----------------------------------------------------------

12

2 Comments

Another day, another lack of #MFA... This feels eerily similar to the #ICO findings concerning the #ElectoralCommission ransomware attack. It's a no-brainer. 1. Implement MFA 2. Communicate why it’s important and communicate it well and repeatedly to staff 3. Train your staff how to use MFA and how to practice good information security 4. Require your third-party suppliers to also use MFA before giving them contracts 5. And repeat! From John Edwards, the UK’s Information Commissioner: "We expect all organisations to take fundamental steps to secure their systems, such as regularly checking for vulnerabilities, implementing multi-factor authentication and keeping systems up to date with the latest security patches.” Edwards said he wants to "urge all organisations, especially those handling sensitive health data, to urgently secure external connections with multi-factor authentication.” https://lnkd.in/eTmM3xsj #nhs #thirdpartysuppliers #ransomware #cybersecurity #informationsecurity #mfa #2fa #cyberawareness #cyberawarenesscommunications #cybercomms #cybertraining

1

OK, it’s not quite the same as hiring James Bond to keep the bad guys at bay but maybe it’s the next best thing — Viva has now achieved Cyber Essentials Plus accreditation. This government-backed certification highlights our commitment to maintaining high standards in cybersecurity. It’s a big step for us and one that we see as crucial given the sectors we work in. Cybersecurity is more than a buzzword — it’s a responsibility. With clients in the public sector, technology, defence, and advanced manufacturing, we handle sensitive information. Earning this accreditation means we’ve demonstrated that our systems and processes are good but we don’t take it for granted. We know that ensuring our team is aware and well-trained is crucial too. It’s a constant challenge. Cyber Essentials Plus isn’t just about passing a checklist. It involves a thorough technical audit, testing whether what we’ve put in place really works. The bottom is that we’re serious about protecting the information people trust us with. In the sectors we work in security is non-negotiable. We’re not just PR specialists — we’re serious about security too. Special thanks to Tony Swain and the team from Hudson Hill Consulting Ltd - for making this happen. #CyberEssentialsPlus #CyberSecurity #DataProtection #InformationSecurity #PublicSector #TechSecurity #DefenceIndustry #AdvancedManufacturing #PRandSecurity #VivaPR #TrustedPartners #GovernmentAccreditation #SecurityMatters #DigitalSafety #ClientConfidence #BusinessResilience

25

1 Comment

https://lnkd.in/eZfp59HD Schools need greater support and funding for protection and mitigation against such attacks. If a school is run as an academy can they face an ICO fine? There were 347 cyber incidents reported in the education and childcare sector in 2023, a BBC report revealed. It represented a 55% increase on 2022.

11

1 Comment

IASME, the National Cyber Security Centre’s (NCSC) cyber essentials delivery partner, has created useful guidance documents for schools which also apply to colleges. Read more 👉 https://lttr.ai/AYuGB #cyberessentials #education #Cybersecurity #cybersecurity

3

I have been convinced that HM Government will pass the onus of keeping data safe to the keepers of that information, i.e. businesses. Very soon it may become compulsory to be Cyber Essentials accredited in the hope that businesses will be more careful about data protection and avoid subsequent GDPR fines. C4 Secure offer a guided route to assured success of achieving accreditation. Book a chat by clicking the link below: https://lnkd.in/e_dGg64s #strongertogether #thisisnorthants #cyberessentials #gdpr Cyber Tec Security

2

🔔BIG NEWS🔔 The infosec.live community has officially been registered as a not for profit here in the U.K. The “Infosec Community CIC” has been formed to ensure the direction of our platform remains for the benefits of its members, rather than making a profit. This will also allow us to access certain funds for the communities growth, enable us to build strong partnerships with training providers and certification providers to obtain the best discounts for our members. Thanks to all of you who have supported infosec.live over the last (nearly) 3 years (We are 3 in June) I look forward to seeing the community grow and provide even more valuable resources for our members and the wider cybersecurity industry! A special thanks to the following advisory board members who have been instrumental in our growth so far. Prof Buck Rogers Jaye Tillson Steve Hindle Greg van der Gaast Chimeria G. Steve Armstrong Jake Bernardes Colin Dobell We are looking for partners to help us with our growth plans, from vendors to individuals looking to make a difference in the industry. Exciting times ahead. #notforprofit #community #cybersecurity

133

45 Comments

the LinkedIn fairies asked me to share my thoughts... probably a mistake on their part but they asked, so here we go. The biggest inertia in an organisations cyber maturity is the board. Ok, so I just said that and here I am trying to sell my services to them! Let me add a little bit more to that statement. It’s not their fault! We expect them to know why cyber risks are business risks without detailing the organisational benefits of the investment we are asking them to make, and we don't demonstrate the impact of a cyber incident in a way that they can easily understand (most are not cyber experts and we don’t want them to be, they are business leaders). And most importantly, stop trying to scare them into action, explain the risk in a way they can relate to, they’ll get it and they will act because they get things like bottom line impact and brand trust erosion without having to tell them the sky is falling down. Food for thought...

12

1 Comment

We're gearing up for our first lot of beta testing with the latest escape room scenario from Esc - The Cyber Escape Room Co.... This one focuses on Insider Risk but there are some great other components we've added to entertain, engage and educate... 📝 Origami Puzzle - a physical representation of how data encryption works. Fold it wrong, and you'll get the wrong code for the book safe... 📕 Book Cipher - a historical way of encoding messages, dating as far back as The American Revolution... 📑 Ransom Note - written in morse code, so your team can get to grips with decoding information... Which puzzles are you most excited about trying out?!

17

2 Comments

What common misconceptions are there around cyber incident response? 🤔 We spoke to Cyber Incident Responder, Vanessa Horton, on the most common misconceptions: The big one is the [misplaced] belief that ‘it’s not going to happen to us’. Many organisations believe they won’t suffer a cyber incident, even if other organisations might. That’s a poor mindset to have because, for one, it’s wrong – everyone will suffer an incident at some point. But more importantly, this mindset leaves organisations unprepared for when they do suffer that breach, and haven’t got an incident responder on hand to keep the damage to a minimum. The fact that some big names have ‘been done’ recently shows how nobody’s safe. Not even big cyber threat actors! For example, not so long ago, LockBit [an infamous ransomware gang] got taken down. And various other ransomware groups, including Ragnar Locker and Black Basta, suffered the same fate. It just goes to show that no one’s above being successfully attacked. That’s just the unfortunate reality. Read more from our 'A Practical Guide to Cyber Incident Response' with Cyber Incident Responder, Vanessa Horton 👉 https://ow.ly/8u9e50S44nY #CyberSecurity #IncidentResponse #CyberIncident #Infosec

5

ISO 27001:2022 transition challenges and how to use ISO 27002 Matthew Peers from IT Governance Ltd once again offers his practical expert insight, this time into ISO 27001:2022 transition challenges. Also, I love how he refers to ISO 27002: the “good ideas book” :) As Matthew explained: “If you’re struggling with how to implement a given control, look at the guidance in ISO 27002. It’ll jog your memory, or spark some ideas to get you on the right track. “Or you might come at it from the other direction: ‘This is how we’ve previously done it; is there a better way of achieving that?’ Then you’d refer to ISO 27002 to see if you can borrow ideas. “It can also trigger ideas by reminding you of things you need to achieve, even without being specific about how to achieve them.” Read the full interview 👇 https://lnkd.in/gxdxBXS6

4

Cyber Essentials is a Government-backed scheme that focuses on helping organisations protect themselves against the most common online threats. If you’re a supplier planning on bidding for UK government contracts involving handling certain sensitive and personal information, it's a mandatory requirement. However, even if you are not planning on working as a government supplier, the Cyber Essentials certification aims to provide businesses with a baseline of cybersecurity controls. At Lucid, we can help you to put the controls and measures in place that will allow you to secure cyber essentials certification, and maintain it in the future. To find out more or to discuss how we can help, please feel free to drop me a message or get in touch with our team at lucidgrp.co.uk #LucidGroup #CyberEssentials #CyberSecurity #TechSupport

2

Interesting to see this peddled again “a lack of basic cyber hygiene”. Reviewing the latest #CyberBreach survey from HMG is sobering reading. 75% of UK business report #Cyber as being a key area for the board, yet this (again) results in total lack of #Governance: - 33% of businesses have a formal security policy - 31% have conducted a risk assessment - 30% have a board member with cyber responsibility (this has returned to the levels of 2016-18) - 27% have asset management activities - 13% are aware of the NCSC 10 Steps Guidance, but only 3% have actioned all 10 steps - 11% have conducted a pen test - 11% have reviewed their supply chains - 12% are aware of CyberEssentials (up from 8% in 2016) - 3% review NCSC/ICO guidance on Cyber (up from 2% since 2016) This is damning, we have excellent guidance on the NCSC website for Cyber and on the ICO website for Data Protection. 41% of the business are consulting externally, so why are those consultants not advising their clients correctly? I have a real issue when we fete the current #CyberSecurity strategy yet in every demonstrable metric it’s failing to engage and inform. I hope that the new government looks to reset the foundations before pushing on with anything else. Within our clients, we place baseline guidance for Cyber and Data Protection at the centre of the engagement. This ensures that governance is reset and a solid foundation can be provided for improvement.

2

2 Comments

Cyber Essentials is a Government-backed scheme that focuses on helping organisations protect themselves against the most common online threats. If you're a supplier planning on bidding for UK government contracts involving handling certain sensitive and personal information, it's a mandatory requirement. However, even if you are not planning on working as a government supplier, the Cyber Essentials certification aims to provide businesses with a baseline of cybersecurity controls. At Lucid, we can help you to put the controls and measures in place that will allow you to secure cyber essentials certification, and maintain it in the future. To find out more or to discuss how we can help, please feel free to drop me a message or get in touch with our team at lucidgrp.co.uk #LucidGroup #CyberEssentials #CyberSecurity #TechSupport

3

Have you heard of Quishing? Quishing is a form of phishing which uses QR codes to lure targets to criminal websites! CyberScotland has just released this new blog giving great advice - https://lnkd.in/d54kzAQE How do you currently test if the QR code you are scanning is safe? #qrcodes #scams #cybersecurity #securityeverywhere

30

18 Comments