Consider IT

Consider IT
Consider IT

Category: IT Security

Volkwagen breach blog
April 24, 2024

Volkswagen Group has over 19,000 sensitive documents stolen in Cyber Attack

The recent security breach at Volkswagen Group serves as a stark reminder of the ever-looming threat of cyber attacks. With over 19,000 sensitive documents stolen, the automotive giant finds itself at the centre of a cyber security nightmare, raising concerns not only for its own operations but for the broader landscape of global business security.

The Attack

Last week, Volkswagen Group reported a significant security breach in its IT systems. The attack was believed to have been perpetrated by Chinese hackers who employed sophisticated methods to breach the company’s systems. The stolen documents included crucial operational details and potentially sensitive information on new electric mobility technologies.

Immediate Impact

The repercussions of such a breach are vast. Beyond the immediate loss of sensitive data, Volkswagen has suffered a dent in their competitive edge and risks financial losses due to operational disruptions and investor confidence erosion. However, the company is not standing idly by. Volkswagen has assured stakeholders of prompt action, working closely with law enforcement agencies to contain further damage.

Steps Towards Recovery

Volkswagen’s response to the breach is comprehensive. The company is overhauling its cyber security protocols, implementing advanced monitoring systems, strengthening its cyber security team, and intensifying employee cyber security training. They are also working with specialist cyber security firms to analyse the breach, identify how it happened, and strengthen their defences against future attacks.

The Larger Picture

The breach at Volkswagen is not an isolated incident but rather a symptom of broader cyber security challenges facing the automotive industry and global corporations as a whole. Although the perpetrator(s) are yet to be identified, the clues leading to Chinese hacker groups highlight the escalating tensions surrounding cyber security and intellectual property theft between China and the West. This breach serves as a wake-up call, emphasising the critical need for robust and proactive cyber security measures in an increasingly interconnected world.

Moving Forward

The breach at Volkswagen Group serves as a sobering reminder that cyber attacks can happen to any business. As organisations assess their own cyber security posture, there are key steps they can take to prevent similar breaches. Implementing advanced monitoring systems, fortifying cyber security protocols, and investing in employee training are crucial components of a comprehensive cyber security strategy. Additionally, collaborating with trusted cyber security partners can provide invaluable support in analysing vulnerabilities and strengthening defences.

At Consider IT we help our clients fortify their cyber security defences. As a full-service IT support, cyber security, and communications provider, Consider IT offers expertise in navigating the complex landscape of cyber security threats. From achieving Cyber Essentials certification to ensuring ongoing compliance, Consider IT provides tailored solutions to mitigate risks and protect valuable data assets. Don’t wait until it’s too late—be proactive about your cyber security resilience today. Get in touch for a chat with one of our experts.

April 24, 2024
0
malwareransomware blog
April 19, 2024

Staying Ahead of the Game: 7 Strategies to Combat Malware and Ransomware

When it comes to protecting your business from cyber threats, malware and ransomware remain two of the more pervasive and damaging. These malicious attack types can infiltrate systems, compromise data, and wreak havoc on businesses of all sizes. As we become more reliant on technology, the tactics of cyber criminals evolve, making it crucial for you to stay vigilant and proactive in your defence strategy.

What is Malware and Ransomware?

Malware, short for malicious software, encompasses a wide range of harmful programs designed to infiltrate and damage computer systems. From viruses and worms to trojans and spyware, malware can exploit vulnerabilities in networks, devices, and software, leading to data breaches, financial loss, and reputational damage.

Ransomware, on the other hand, is a specific type of malware that encrypts files or locks users out of their systems, demanding payment (often in cryptocurrency) for their release. This threat has become increasingly prevalent, targeting businesses across industries and causing significant disruptions to operations. 

The Importance of Proactive Defence

In the face of such threats, reactive measures are no longer sufficient. Organisations must adopt a proactive approach to cyber security, implementing robust defence strategies that prioritise prevention, detection, and response. Here are some key strategies to consider:

  1. User Education and Awareness: Employees are often the first line of defence against malware and ransomware. Providing comprehensive training on cyber security best practices, including how to recognise phishing attempts and suspicious links, can empower individuals to identify and mitigate potential threats.
  2. Up-to-Date Security Software: Keeping security software, antivirus programs, and firewalls updated is essential for protecting against known vulnerabilities and emerging threats. Regularly patching systems and applications can close security gaps and strengthen overall resilience.
  3. Access Control: To reduce the risks associated with potential misuse or theft of accounts, it’s essential to ensure that staff accounts are granted only the necessary access to software, settings, online services, and device connectivity features required for their respective roles. Additional permissions should be selectively granted only to individuals who have a legitimate need for them.
  4. Strong Password Management: Enforcing strong password policies, including the use of complex passwords and multi-factor authentication, can help prevent unauthorised access to accounts and systems. Regularly updating passwords and avoiding password reuse can further enhance security posture.
  5. Multi-factor authentication (MFA): By requiring users to provide multiple forms of verification, like passwords and biometrics, before accessing an account or system you can make it harder for attackers to breach accounts with stolen passwords alone.
  6. Data Backup and Recovery: Implementing a robust backup and recovery strategy is essential for mitigating the impact of ransomware attacks. Regularly backing up critical data to offline or cloud-based storage ensures that you can restore operations quickly in the event of a breach.
  7. Incident Response Plan: Having a well-defined incident response plan in place is crucial for effectively managing cyber security incidents. Establishing clear roles and responsibilities, as well as predefined steps for identifying, containing, and remedying threats, can minimise downtime and mitigate damages.

The Alarming Statistics

The UK Government’s Cyber Security Breaches Survey 2024 highlights the prevalent nature of cyber threats, with businesses and charities alike vulnerable to breaches and attacks. Alarmingly, half of businesses and around a third of charities report falling victim to cyber incidents within the past year. Particularly striking is the heightened susceptibility among medium and large businesses, with a staggering 70% and 74% respectively experiencing breaches, alongside high-income charities with annual incomes exceeding £500,000, where breaches are reported at 66%.

Phishing emerges as the predominant form of entry, constituting a significant proportion of breaches across both businesses and charities, with an overwhelming 84% and 83% respectively. Other notable threats include impersonation of organisations or employees via emails or online channels, affecting 35% of businesses and 37% of charities, followed by viruses or malware, impacting 17% of businesses and 14% of charities. 

How can we help protect your business?

At Consider IT, we understand the critical importance of safeguarding your business against cyber attacks. That’s why we offer comprehensive cyber security solutions designed to fortify your defence posture and reduce the ever-present risks of malware and ransomware. As an accredited IASME certifying body, we specialise in helping businesses achieve and maintain Cyber Essentials certification, providing assurance that your systems meet rigorous industry standards.

By partnering with Consider IT, you can take proactive steps to protect your business from cyber threats. Our team of experts will guide you through the certification process, ensuring compliance with baseline standards and implementing robust security measures tailored to your organisation’s unique needs. Even if certification isn’t a requirement for your business, rest assured that as our client, we’ll work to ensure you meet crucial cyber security standards, bolstering your resilience against potential attacks.

Don’t wait until it’s too late. Take proactive steps to secure your business today. Defend against the growing threat of malware and ransomware, safeguarding your data, reputation, and bottom line. Get in touch with us today to learn more.

April 19, 2024
0
cost of a cyber attack
March 19, 2024

Counting the Costs: Understanding the Financial Impact of Cyber Attacks on Businesses

Cyber attacks, once considered a distant concern, have become a pressing reality for organisations of all sizes and industries. Beyond the immediate disruptions to operations and potential loss of sensitive data, cyber attacks carry a significant financial burden that can cripple businesses if not adequately addressed. Understanding the cost implications of cyber attacks is crucial for organisations to fortify their defences and reduce potential damages.

Direct Financial Losses: The most tangible cost of a cyber attack is the direct financial loss incurred by the organisation. This includes expenses related to mitigating the attack, such as engaging cyber security experts to investigate and contain the breach, restoring systems and data, and implementing security measures to prevent future incidents. Additionally, businesses may face regulatory fines and legal fees if the attack involves the leakage of sensitive customer information, violating data protection laws. Just recently, Capita suffered a £25 Million loss due to a ransomware attack. 

Operational Disruption: Cyber attacks often result in significant operational disruption, causing downtime that can play havoc with normal business operations. This downtime can lead to lost productivity, missed deadlines, and delayed product or service delivery. In industries where uptime is critical, such as public services, e-commerce or financial services, even a few hours of downtime can translate into substantial revenue losses and damage to customer trust and brand reputation. Just last month, many UK universities including Wolverhampton, Cambridge and Manchester were targeted by a hacker group who organised a Distributed Denial of Service attack, where many IT services were offline causing significant disruption to teachers and students. 

Reputational Damage and exposure of sensitive information: The fallout from a cyber attack extends beyond immediate financial losses. A tarnished reputation can have long-lasting consequences, eroding customer trust and loyalty. News of a data breach or security incident can spread rapidly through social media and news outlets, leading to negative publicity and a loss of credibility in the eyes of customers, partners, and investors. Rebuilding trust and repairing reputation damage can be a costly and time-consuming task for businesses. NHS Dumfries and Galloway is currently grappling with the ramifications of an ongoing cyber attack, where a significant amount of sensitive staff and patient data is thought to have been compromised. Affected staff and members of the public have been advised to be on guard for any unauthorised access to their systems, and to be wary of anyone approaching them claiming to have details about their sensitive information.

Customer Churn and Loss of Business Opportunities: Following a cyber attack, businesses may experience increased customer churn as a result of concerns about data security and privacy. Customers may take their business elsewhere if they perceive that their personal information is at risk. What’s more, potential business partners and clients may hesitate to engage with an organisation that has suffered a breach, leading to missed opportunities for growth and expansion.

Cyber Insurance Premiums: In response to the growing threat of cyber attacks, many businesses have turned to cyber insurance as a means of reducing financial risk. However, the cost of cyber insurance premiums has risen steadily in recent years as insurers seek to cover their own increasing exposure to cyber risk. Businesses may find themselves paying higher premiums or facing more stringent coverage requirements following a cyber attack, further adding to the overall financial impact. In fact, the cyber insurance market is projected to be worth over $90.6bn by 2033, highlighting its growing necessity.

Investments in Cyber Security: In the aftermath of a cyber attack, businesses often ramp up their investments in cyber security infrastructure and personnel to prevent future incidents. This may include upgrading existing security systems, implementing advanced threat detection and prevention technologies, and providing employee training and awareness programs. These defences are essential for defending against further attacks.

Long-Term Financial Consequences: The financial repercussions of a cyber attack can extend far into the future, affecting the overall financial health and viability of the business. Shareholders may see a decline in stock value following a high-profile breach, and lenders may tighten credit terms or impose higher interest rates due to increased perceived risk. In extreme cases, the financial fallout from a cyber attack can push a business into bankruptcy or force it to undergo a costly restructuring process to regain stability.

How can you prevent yourself from falling prey to a cyber attack?

While the financial implications of a cyber attack on a business can be staggering, prevention remains the most effective form of protection. Investing in cyber security measures and adopting proactive strategies can significantly reduce the risks posed by cyber threats. One such proactive step is obtaining a Cyber Essentials certification, which not only strengthens your defences but also demonstrates a commitment to cyber security best practices. Achieving certification can provide assurance to customers, partners, and stakeholders that the business takes its security responsibilities seriously, building trust and credibility. 

Consider IT, offers comprehensive services to help businesses get up to scratch and certified with Cyber Essentials. As an IASME Certifying Body, we work closely with clients across the UK to get certified and remain compliant. Check out some of our cyber security awards and accreditations, including CREST, ISO and Cyber Essentials Plus for more information on our commitment to cyber health. 
Speak to us today about your cyber security defences, minimising the risk of cyber attacks, and protecting your financial stability and reputation.

March 19, 2024
0
awareness training blog
February 28, 2024

The Importance of Cyber Security Awareness Training

Did you know that the leading cause of successful cyber attacks is attributed to human error? Unfortunately, the weakest link in your security chain comes down to mistakes by the people who work in your business. That’s why it is really important to train your staff regularly about how to spot a potential cyber attack, and the different tactics cyber criminals use to exploit human error. 

Types of Human Error Exploited by Cyber Criminals:

Phishing Attacks:

Among the most common tactics, phishing attacks involve tricking individuals into revealing sensitive information, such as login credentials or financial details. Up to 91% of  successful  data breaches start with a phishing attack. Cyber criminals often use deceptive emails, messages, or even phone calls to manipulate employees into clicking on malicious links or downloading infected attachments. As part of your cyber security training, simulating phishing attacks to see if anyone takes the bait is a good way to see if there is a need for further training.

Social Engineering, Impersonation, and domain spoofing:

Social engineering relies on manipulating employees to divulge confidential information. This could involve impersonating colleagues, using psychological tactics, or exploiting personal relationships to gain access to sensitive data.

One particularly insidious tactic that cyber criminals employ to exploit human trust is CEO domain spoofing. In this method, attackers edit email headers and content to make messages appear as if they are coming from your CEO or other high-ranking executives. These deceptive emails often request sensitive information, financial transfers, or access to secure systems. Given the perceived authority of the sender, employees may be more inclined to comply with the requests, unknowingly facilitating a cyber attack. Cyber security awareness training must specifically address CEO domain spoofing, emphasising the importance of verifying the legitimacy of unexpected requests, even if they appear to come from top executives. Awareness of this tactic is crucial for employees to remain vigilant and implement verification protocols to fend off potential threats originating from seemingly trusted sources within your organisation.

Weak Passwords:

81% of hacking related breaches are caused by weak or stolen passwords. Human tendencies to use weak passwords or reuse them across multiple platforms make it easier for cyber criminals to gain access to your systems. Cyber security awareness training should stress the importance of creating strong, unique passwords and implementing multi-factor authentication across the board.

Unsecured Devices:

With the rise of remote work, employees often use personal devices for professional purposes. Failure to secure these devices can expose your business to significant risks. Training programs should educate employees on the importance of device security, including regular updates, antivirus software, and secure Wi-Fi connections.

Lack of Awareness:

Many employees may be unaware of potential threats or the importance of cyber security best practices. Regular training sessions can bridge this knowledge gap, empowering employees to recognise and respond appropriately to potential threats.

Benefits of Cyber Security Awareness Training:

Reduced Risk of Data Breaches:

By equipping employees with the knowledge and skills to identify and report potential threats, you can significantly reduce the risk of data breaches and unauthorised access to your systems.

Improved Incident Response:

Cyber security training enhances employees’ ability to respond effectively to incidents, minimising the impact and preventing further harm.

Promotion of a Cyber-Aware Culture:

Fostering a culture of cyber security awareness promotes collective responsibility, encouraging employees to be proactive in safeguarding the business’ data.

About US:

Consider IT provides the full spectrum of IT & Communications services, including 24/7 support, strategic consultation, cloud and business continuity solutions, cyber security, compliance certification, procurement and more.

At Consider IT, we recognise that the human element plays a crucial role in boosting your cyber security. And so, as a standard practice, we provide our clients with regular cyber security training. Our training programs are designed to equip employees with the knowledge and skills necessary to spot and report an attempted cyber attack. By instilling a culture of cyber awareness, we empower your workforce to identify and mitigate potential risks, reducing the likelihood of falling victim to cyber criminals.

In addition to our commitment to education, Consider IT ensures that our clients are up to standard with Cyber Essentials baseline controls. These controls serve as a foundational framework, encompassing essential security practices that are crucial for mitigating common cyber threats. By implementing these controls, we help fortify your organisation against a wide range of potential risks. We’re the security behind great businesses!

Get in touch today to find out more, and get a free consultation.

February 28, 2024
0
ISO accreditations (1)
December 14, 2023

Consider IT Achieves Prestigious ISO 22301 and ISO 20000-1 Certifications for Business Continuity and IT Service Management

We are thrilled to announce a significant milestone for Consider IT – the successful achievement of two prestigious certifications: ISO 22301 for Business Continuity Management and ISO 20000-1 for IT Service Management. Colin Gilbertson, Head of Operations at Consider IT commented:

“This achievement reflects Consider IT’s ongoing commitment to delivering high-quality IT Support and Cyber Security solutions, reinforcing our position as a trusted service provider.”

ISO 22301: The Gold Standard for Business Continuity

ISO 22301 is a globally recognised standard for Business Continuity Management Systems (BCMS), focusing on fortifying an organisation’s ability to respond effectively to disruptions. Unexpected events like natural disasters, cyber attacks or other unforeseen events, can cause major disruption to business operations.

This certification attests to our robust business continuity planning, risk management, and incident response capabilities. It provides both Consider IT, and our clients  with the confidence that we are equipped to navigate unforeseen challenges seamlessly, thereby minimising downtime and preserving the integrity of business processes during emergencies.

ISO 20000-1: Elevating IT Service Management

ISO 20000-1 is the international standard for IT Service Management (ITSM), emphasising the implementation of best practices to enhance the quality and efficiency of IT services. Achieving this certification highlights Consider IT’s commitment to delivering excellent IT services that align with global industry standards.

With ISO 20000-1, we assure our clients that our IT Service Management processes are meticulously designed and executed, promoting continuous improvement and ensuring the optimal performance of their IT infrastructure.

“This certification serves as a testament to our dedication to providing reliable, secure, and efficient IT services that empower both us as a business, and our clients.”

-Colin Gilbertson, Head of Operations

Why This Matters for You

For businesses in search of a dependable partner for IT Support and Cyber Security solutions, our achievement of ISO 22301 and ISO 20000-1 certifications distinguishes us in the field. These certifications reflect our commitment to a proactive approach in managing risks, safeguarding the resilience of our operations, and consistently providing top-notch IT services. These new achievements add to our collection of other coveted industry standards, including ISO 27001, CREST and Cyber Essentials Plus. Consider IT is also an IASME certifying body, meaning we can get your organisation up to scratch with Cyber Essentials controls, award the certificate, and ensure your continued compliance. To see a full list of our credentials, please visit our website here.

Our commitment to excellence extends beyond certifications; it is ingrained in our culture of continuous improvement and client satisfaction. Whether you seek reliable managed IT solutions, robust cyber security measures, or a combination of both, our experts are always here to help. Get in touch today to talk about how we can help your business.

December 14, 2023
0
2FS blog
November 24, 2023

Strengthening Cyber security Defences: The Crucial Role of Multi-Factor Authentication

Have you implemented multi-factor-authentication (MFA) across your organisation? While promoting the adoption of robust passwords is essential, the reality is that various vulnerabilities still exist. For example, employees using identical passwords across multiple platforms or storing sensitive information within their browser are common practices that pose potential risks. Consider the scenario where a laptop is lost or stolen—such a situation could easily lead to a compromise of your systems.

As technology advances, so do the tactics employed by cyber criminals. It is crucial for organisations to adopt robust cyber security measures to safeguard sensitive information and maintain the trust of their clients. At Consider IT, we recognise the significance of MFA as a core component of a comprehensive cyber security strategy, and we implement it as a mandatory element of our managed services. Here’s why.

The Rising Threat Landscape:

Cyber security threats have become more sophisticated, with attackers employing advanced techniques to exploit vulnerabilities and gain unauthorised access to confidential data. As a result, businesses are compelled to fortify their defences to protect against an array of threats, including phishing attacks, password breaches, and identity theft.

The Role of your IT provider:

Implementing multi-factor authentication is not just a recommended practice but a fundamental necessity in today’s cyber threat landscape. As trusted guardians of their clients’ digital infrastructure, IT providers (like Consider IT) recognise the critical importance of MFA. By integrating this additional layer of security into the systems they manage, IT providers enhance identity verification, mitigate the risks associated with password vulnerabilities, and fortify against evolving cyber threats. If your IT provider hasn’t mentioned MFA to you, you should ask them why.

Understanding Multi-Factor Authentication:

Multi-factor authentication adds an extra layer of security by requiring users to provide two forms of identification before granting access to sensitive systems or data. Typically, this involves something the user knows (e.g. a password) and something the user has (e.g. a mobile device or a security token). This additional layer of authentication significantly reduces the risk of unauthorised access, even if passwords are compromised.

Enhanced Security with MFA:

Consider IT advocates for the widespread adoption of MFA as a powerful tool to mitigate the risks associated with single-factor authentication. Passwords alone are no longer sufficient to protect against determined cyber criminals. MFA acts as a robust deterrent, adding an extra barrier that significantly reduces the likelihood of unauthorised access, even in the event of compromised credentials.

Benefits of Multi-Factor Authentication:

Improved Identity Verification:

MFA ensures that users are who they claim to be, offering a higher level of confidence in identity verification. This is crucial in preventing unauthorised access to sensitive systems and data.

Mitigation of Credential-Based Attacks:

Password breaches are a common method employed by cybercriminals. MFA reduces the impact of compromised passwords by requiring an additional form of authentication, preventing unauthorised entry.

Enhanced Remote Security:

With the rise of remote work, securing access to corporate systems from various locations is paramount. MFA provides an additional layer of protection, reducing the risk of unauthorised access from external networks.

Compliance Requirements:

Many industry regulations and compliance standards mandate the use of multi-factor authentication to protect sensitive information. Extra protections help you avoid potential legal and financial repercussions.

About Consider IT

Consider IT, as a forward-thinking IT support and cyber security provider, knows the importance of integrating two-factor authentication into the core of a business’s cyber security strategy. In an era where cyber threats are ever-evolving, embracing robust measures like MFA is crucial to safeguarding sensitive information, maintaining trust, and ensuring long-term security and success.

Additionally, Consider IT offers a comprehensive suite of cyber security services designed to fortify your digital infrastructure against evolving threats. Our expert team specialises in Cyber Essentials, ensuring your organisation adheres to essential cyber security standards. We conduct thorough penetration testing to proactively identify and address vulnerabilities in your systems, while our vulnerability assessments provide a comprehensive overview of potential risks. In the event of a security incident, our rapid and effective incident response ensures minimal impact on your operations. Committed to industry best practices, Consider IT holds multiple cyber security accreditations, including Cyber Essentials Plus and CREST. For a detailed overview of our certifications and a deeper understanding of how we can safeguard your digital assets, please visit our website here.
If you’d like to learn more about our Cyber and Managed IT services, please get in touch today for a chat with our friendly team.

November 24, 2023
0
CS awareness month (1)
October 11, 2023

Have you considered your Cyber Security defences this Cyber Security Month?

Have you thought about your cyber security lately? If you haven’t, you just need to take one glance at the news to see why you should. Cyber attacks are on the increase, and many companies are falling victim to the ever increasing problem. Just last week, we saw the tragic downfall of KNP Logistics Group, a haulage company with a 158 year legacy falling victim to a vicious ransomware attack. The June 2023 attack ultimately resulted in the company’s administration and the loss of 730 jobs. In the same week, the Royal Family were even targeted when their website was temporarily taken down by Russian hackers. No one is immune to cyber attacks, but there are ways that you can strengthen your defences against them. Now is the perfect time to explore essential strategies to safeguard against cyber threats as we observe Cyber Security Month this October. 

The Business Imperative for Cyber Security Awareness

Protecting Sensitive Data: As a business, you store vast amounts of sensitive data, including customer information, intellectual property, and financial records. A data breach not only jeopardises this critical information but also damages your reputation and finances.

Regulatory Compliance: Many industries are subject to strict data protection regulations, such as GDPR in Europe or HIPAA in the healthcare sector. Non-compliance can result in hefty fines and legal consequences.

Financial Impact: Cyber attacks can lead to direct financial losses due to theft, ransom payments, or business interruption. Additionally, the costs associated with investigating and mitigating an attack can be substantial.

Reputation Management: A cyber security incident can destroy customer trust and confidence. Your business may find it challenging to regain your reputation even after addressing the breach.

Strategies to secure your business this Cyber Security Awareness Month

Conduct Risk Assessments: Begin by assessing your organisation’s cyber security risks. Identify vulnerabilities, and the most critical assets that need protection. Specialist IT providers such as Consider IT can carry these out for you.

Develop a Cyber security Policy: Create a comprehensive cyber security policy that outlines best practices, employee responsibilities, incident response procedures, and compliance requirements. Ensure all employees are aware of and adhere to this policy.

Employee Training and Awareness: Invest in cybersecurity training for employees at all levels. Teach them how to recognise phishing attempts, practice safe password management, and report security incidents promptly.

Regular Updates and Patch Management: Keep all software, operating systems, and security tools up to date. Regularly apply patches and updates to address known vulnerabilities.

Implement Strong Access Controls: Limit access to sensitive data and systems to authorised personnel only. 

Secure Your Network: Invest in robust firewalls, intrusion detection systems, and encryption protocols to protect your network infrastructure from cyber threats.

Implement 2-factor Authentication: Add an extra layer of protection to your passwords to prevent unauthorised access to company data.

Data Backup and Recovery: Regularly backup critical data, and ensure that you have a tested and effective data recovery plan in place. This can be crucial in the event of a ransomware attack or data breach.

Incident Response Plan: Develop a well-defined incident response plan that outlines steps to take in the event of a cyber security incident.

Get Cyber Essentials Accredited: Add an extra layer of trust with your customers and stakeholders by getting Cyber Essentials Certified. Cyber Essentials is a government-backed scheme that ensures organisations adhere to fundamental cyber security principles, providing a crucial defence against common cyber threats

Consider talking to your IT Partner

At Consider IT, cyber security is our top priority. We are dedicated to assisting our clients in fortifying their digital defences to safeguard their sensitive information and operations. This Cyber Security Month, we invite you to reach out to us for a complimentary cyber security assessment. Consider IT is an IASME certifying body, and as such our expert team will work with you to achieve Cyber Essentials accreditation and compliance. Reach out today to learn more.

October 11, 2023
0
Ashley Madison data breach
August 30, 2023

Ashley Madison: How lax cybersecurity resulted in mass privacy violations

Have you watched the new documentary on the Ashley Madison scandal yet? If you haven’t, here’s the cliff notes, and the lessons that can be learned from this famous cyber attack.

This breach not only exposed the personal lives of millions but also ignited discussions on digital privacy, cybersecurity, and the ethical implications of such breaches.

Ashley Madison: who are they and what happened?

In July 2015, a group of hackers collectively known as “The Impact Team” targeted Ashley Madison, a dating website with the aim of connecting people who wish to step outside of their marriage and cheat on their partners.

The site promised users anonymity and security – promising to fuel your illicit affair with the ultimate privacy and secrecy. In fact, they went so far as to latch on to viral cheating scandals, with the message “Should have used Ashley Madison”, to highlight the safety of the site. This included Republican Mark Sandford – at the time he was the Governor of California and was running for Congress in a special election and his affair had previously been exposed. A billboard (right) was advertised with his face and the message “Next time use ashleymadison.com to find your ‘running mate’.”

To give users even more peace of mind, Ashley Madison  offered a “full delete” service. For the price of $19, all user information would be deleted from their servers – just like it never happened. However, that wasn’t quite true. Despite netting almost $1.7 million in 2014 for this feature, it didn’t quite work as advertised. While some data was indeed removed, things like credit card information with their full name and address, and other factors such as gps data, city, state, country, weight, height, date of birth, gender, ethnicity and sexual preferences were not – all of which may be enough to identify individuals.

Despite Ashley Madison’s declarations that finding your affair partner is much safer on their site, the hackers successfully infiltrated their security systems and obtained an extensive database containing user information, including names, email addresses, payment details, and even intimate fantasies. And how did they manage that? Well, it turns out that their cyber security measures left much to be desired. In fact, investigations showed that a disgruntled ex employee still had “uber-god” admin access to their systems, showing just how lax their security procedures were.

The hackers then threatened to publish the stolen data unless Ashley Madison and its affiliated site, Established Men, were shut down permanently. When the parent company, Avid Life Media, refused to comply, the hackers followed through on their threat, releasing sensitive user data in August 2015. This marked one of the most high-profile and consequential data breaches in history.

The fallout: Privacy Violations and Emotional Turmoil

The aftermath of the Ashley Madison breach was nothing short of catastrophic. The leaked data, which included personal details of over 30 million users, exposed countless individuals to public humiliation, ruined relationships, and damaged careers. The breach hit not only the users of the site but also their families, sparking heated debates about the ethics of hacking, cyberbullying, and the right to privacy in a digital age.

The breach had particularly severe consequences for public figures and individuals living in countries with conservative social norms, where extramarital affairs can lead to legal and societal repercussions. The emotional toll experienced by victims served as a stark reminder that data breaches have real-world ramifications beyond the digital realm. 

Many of the exposed users were then targeted by individuals who threatened to expose that they were part of the data leak to their family, friends and employer unless they paid a hefty ransom.

Some of these users ended their lives as a result of the breach, including a pastor of a small church.

Ashley Madison were also sued by a group of users who had been adversely affected by the breach, and they were ordered to pay $11.2 million in damages. The CEO, Noel Biderman also stepped down from his role at the end of August 2015. This breach was particularly embarrassing for him, as his full email inbox and shady business practices were released as part of the information dump.

Lessons Learned: Digital Privacy and Cybersecurity

The Ashley Madison data breach highlighted several critical lessons for individuals, companies, and policymakers alike:

Robust Security Measures: Companies handling sensitive user data must prioritise cybersecurity. Strong encryption, regular security audits, strong employee onboarding and offboarding procedures, and proactive measures to defend against potential attacks are imperative to safeguarding user information.

Incident Response Procedures: In this day and age cyber attacks are almost inevitable, but you can put measures in place to respond to threats quickly and efficiently. Having an incident response plan significantly reduces the risk to your business, and will help you bounce back quicker after experiencing a breach.

Transparent Data Handling: Transparency in data collection, storage, and usage is crucial. Users have the right to know how their information will be used and protected, fostering trust between companies and their customers.

User Education: Individuals must be educated about the risks of sharing personal information online and the potential consequences of data breaches. Practising good digital hygiene, such as using unique passwords and enabling two-factor authentication, can significantly reduce vulnerability.

Legal and Ethical Considerations: The breach highlighted the need for robust legal frameworks that address both hacking and the responsible use of leaked data. Ethical discussions around exposing sensitive information also gained prominence, raising questions about the role of hackers as vigilantes or villains.

How can you protect your company from a data breach?

While I’m sure your business isn’t quite as…questionable…. as the one highlighted in this article, the message remains the same – cyber breaches can not only harm you and your business, it can bring extreme harm to your customers. 

At Consider IT, cyber security is a top priority. We ensure all of our customers comply with the standards of Cyber Essentials so they are protected from any data breaches or cyber attacks – even if they don’t want the certification. Cyber Essentials is a UK government-backed cyber security certification scheme that sets out a baseline of technical controls for organisations of all sizes to protect themselves against common cyber threats. 

Consider IT is one of the few Information Assurance for Small and Medium Enterprises (IASME) certified bodies in Scotland, which means we can award the Cyber Essentials certification, and ensure you keep compliant. We offer end-to-end guidance and project management to make sure your cyber strategy is up to scratch. And if you need more peace of mind, we are also:

-A CREST accredited provider

-A trusted partner of the Cyber and Fraud Centre Scotland

-Members of the UK Cyber Security Council

-A National cyber Security Centre assured service provider

-ISO accredited in 27001, 14001, 9001

For a full list of our accreditations, visit our website here.

If you would like to know more about how we can help you get certified, get in touch today.

August 30, 2023
0
NCSC accreditation blog (2)
July 27, 2023

Consider IT Becomes One of the First in Scotland to Achieve NCSC Assured Service Provider Status

Consider IT, is thrilled to announce its recent achievement as an NCSC (National Cyber Security Centre) Assured Service Provider for Cyber Essentials. This remarkable milestone makes Consider IT the one of the first Managed Service Providers in Scotland to obtain this prestigious certification, and the third Scottish company overall.

The NCSC Assured Service Provider scheme provides organisations with a means to assess and demonstrate their cybersecurity posture to clients and stakeholders. By undergoing a rigorous evaluation process, Consider IT has proven its commitment to delivering top-notch cybersecurity services, offering clients the confidence and peace of mind that their sensitive data and systems are protected with the highest level of expertise.

The certification process involved a comprehensive assessment of Consider IT’s cybersecurity practices, infrastructure, and policies. The evaluation was conducted by the NCSC, the UK government’s authority on cybersecurity, which recognised the company’s exceptional dedication to maintaining robust security measures.

At the forefront of this achievement is Consider IT’s Head of Cybersecurity, Andy Maclaren. His extensive experience, deep knowledge of cybersecurity best practices, and dedication to ensuring the highest standards have been instrumental in successfully steering the company through the assessment process. Andy’s expertise has been formally acknowledged and validated by the NCSC scheme, further solidifying Consider IT’s position as a trusted and reliable cybersecurity partner.

“We are incredibly proud to be one of the first Managed Service Providers in Scotland to receive the NCSC Assured Service Provider certification. This achievement is a testament to our team’s unwavering commitment to cybersecurity excellence,” said Stuart Gilbertson, Managing Director of Consider IT. “Our clients can trust that their cybersecurity needs are in the hands of experts who prioritise the safety and protection of their digital assets.”

Consider IT’s focus on continuous improvement and staying ahead of the ever-evolving cybersecurity landscape has enabled them to achieve this coveted status. The company remains committed to delivering exceptional cybersecurity services that align with the industry’s highest standards.

About Consider IT:

Consider IT is a leading Managed Service Provider headquartered in Edinburgh. The company offers a comprehensive suite of IT and cybersecurity solutions tailored to meet the unique needs of its diverse clientele. With a team of dedicated experts and a commitment to excellence, Consider IT has earned a reputation for providing reliable, innovative, and secure IT services.

July 27, 2023
0
cyber essentials blog (1)
July 25, 2023

Enhancing Cyber Health Through 5 Main Technical Controls: A Cyber Essentials Overview

As cyber threats continue to evolve, businesses must prioritise cybersecurity to safeguard their data and operations. Cyber Essentials, a vital cybersecurity certification scheme developed by the UK government, offers a solid foundation for organisations seeking to strengthen their cyber resilience. In this article, we will explore the five main technical controls involved in Cyber Essentials and examine relevant statistics from the UK government’s Cyber Security Breaches Survey 2023. Additionally, we’ll highlight the importance of engaging with reputable cybersecurity experts, such as Consider IT, to navigate the certification process effectively.

Secure Configuration

Secure configuration serves as a crucial defence against cyberattacks. Ensuring that systems, devices, and software are configured securely helps prevent vulnerabilities. To ensure secure configurations organisations should adopt a comprehensive approach. Firstly, conducting regular security audits and vulnerability assessments is crucial to identify weaknesses and address them promptly. Enforcing strong password policies and using multi-factor authentication adds an extra layer of protection, as passwords form the first line of defence against unauthorised access to systems and sensitive information. According to the Cyber Security Breaches Survey 2023, in 2021, 79 percent of surveyed organisations reported implementing password policies. However, this figure experienced a concerning decline to 70 percent in 2023. This trend underlines the need for organisations to reinforce their password policies, and assess their cyber security strategies to safeguard against potential breaches.

Boundary Firewalls and Internet Gateways

Network firewalls act as essential gatekeepers, preventing unauthorised access to private networks and reducing the risk of cyber intrusions. In 2021, 78 percent of surveyed organisations had implemented network firewalls, but this figure declined to 66 percent in 2023. This downward trend highlights the urgency for businesses to prioritise network security, fortifying their defences against cyber threats seeking to exploit network weaknesses.

Access Control

Access control involves managing user accounts and permissions to ensure that only authorised individuals have access to systems, data, and services. It includes measures such as using strong passwords, implementing multi-factor authentication, and regularly reviewing and revoking access rights. In 2021, 75 percent of organisations acknowledged restricting admin rights effectively, but this number dropped to 67 percent in 2023. Many businesses who do not implement proper access control cite issues such as resource constraints, organisational culture, the assumption of safety or convenience for employees to make updates to their own machine. Don’t fall victim to cyber attacks for the sake of convenience or assumed safety – bad actors count on that!

Malware Protection

Protecting systems against malware is critical to prevent malicious software from infiltrating and disrupting operations. Malware can find its way onto your systems in a number of ways. Your employees might unknowingly download malicious attachments from emails, fall victim to deceptive links leading to infected websites, or download software from unreliable sources that contains hidden malware. Visiting compromised websites or clicking on malicious ads can also trigger drive-by downloads. Social engineering tactics can be employed to deceive you into downloading and running malware. Even seemingly harmless USB devices can spread infections. Additionally, outdated software with known vulnerabilities can be exploited by cybercriminals. To safeguard your system, make sure your staff receive regular security training, use reputable antivirus software, stay updated with the latest patches, exercise caution with email and downloads, and avoid untrusted sources. Regular data backups are also crucial for added protection.

The government cyber breaches survey highlighted a decline in organisations using malware protection, with only 71 percent deploying this control in 2023, compared to 78 percent in 2021. Make sure your business doesn’t become a casualty.

Patch Management

Applying software security updates promptly is crucial in addressing known vulnerabilities and protecting systems from cyber threats. Alarming statistics from the Cyber Security Breaches Survey 2023 indicate that only 31 percent of organisations managed to apply software security updates within 14 days in 2023, as compared to 43 percent in 2021. The decline in timely updates exposes businesses to potential exploits that cybercriminals frequently target.

Why do you need Cyber Essentials?

In a rapidly evolving digital landscape where cyber threats loom large, safeguarding your organisation’s data and systems is of utmost importance. Cyber Essentials provides a foundational cybersecurity framework that can bolster your cyber health significantly. With recent statistics from the UK government’s Cyber Security Breaches Survey 2023 indicating a decline in the adoption of essential technical controls, now is the time for companies to take proactive steps to protect their assets.

To ensure your organisation’s compliance and certification in Cyber Essentials, consider partnering with Consider IT – a trusted and experienced cybersecurity services provider. Consider IT is committed to empowering businesses with robust cybersecurity measures, and we specialise in helping companies achieve Cyber Essentials certification efficiently. As one of the only Scottish Managed Service Providers (MSPs) that are IASME certified, Consider IT brings a wealth of knowledge and expertise to the table, providing comprehensive solutions tailored to your unique business needs.

Get in touch today.

July 25, 2023
0
CONSIDER IT FACEBOOK CONSIDER IT Twitter CONSIDER IT Linkedin

Contact Us

0131 510 0110
[email protected]
Find Us

Customer Service

Contact Us
Our Locations
Case Studies

Information

About Consider IT
Domains
Privacy Policy
Terms & Conditions
Press Enquiries

© 2024 Consider IT Limited – All Rights Reserved
Registered office: Waterview House, 37 Shore, Edinburgh, EH6 6QU. Company Number: SC320341 | VAT number: GB 930 1862 42
Consider IT is a trading name of Consider IT Limited