RESOURCE HUB

Welcome to #6 in a series of helpful tips, should you ever find yourself victim of a cyber incident. Based on over 20 years of cyber incident response work, for clients of all sizes and sectors, ECSC is available 24/7/365 when you need it most.

Will Your Insurance Pay Out?

It is a good question, and you can only be sure by examining the terms of your policy.

As a warning, here are some exclusions we have come across that should raise alarm bells:

• 1. 'a hacker who specifically targets you alone' - does this mean you aren't covered when the latest outbreak affects thousands of systems?
• 2. 'any failure by a cloud/infrastructure provider' - your 'cloud first' strategy is now outside of your insurance.
• 3. 'any individual hacker within the definition of you' - legal speak for you not being covered for the inside threat.
• 4. 'the use by you of any software or systems that are unsupported by the developer' - oh dear, that single Windows XP device has just invalidated your insurance.
• 5. 'acts of foreign enemies, terrorism, hostilities or warlike operations (whether war is declared or not)' - if their loss adjusters (sorry, incident responders) find a source IP from Russia they might not pay!

If you think you'd benefit from the ECSC experts by your side when you need them most, then the easiest solution is a low-cost Incident Response Retainer, giving you access to 24/7/365 remote and on-site guidance, advice and support. Additionally, all Incident Response Retainer Clients receive a 20% discount on our Incident Response rates.

To learn more please download our brochure here or call the team on 01274 736 223.

For your free copy, simply enter your email below. Once submitted, a link to your download will be sent to your email address. Please take the time to make sure your email address is correct.

Top Tips - Will Your Insurance Pay Out?

Welcome to #5 in a series of helpful tips, should you ever find yourself victim of a cyber incident. Based on over 20 years of cyber incident response work, for clients of all sizes and sectors, ECSC is available 24/7/365 when you need it most.

Watch your Anti-Virus

You may think that a virus (or other malware) being detected and wiped from a device is a pretty routine event. You might be right.

However, you may have just made the biggest mistake in your cyber security career, and you have in fact, just failed to spot a breach in progress that will become ransomware in the next 24 hours.

If you think about how a virus is introduced onto an IT system, it is usually linked to user behaviour, such as:

• visiting a dodgy website
• opening an even dodgier email attachment
• plugging in an untrusted (personal) device

So, when you see a virus being detected (and removed) by your AV, you might view this as normal and give it minimal attention. You'd be wrong.

Important check - context. Is it a 'user' device?

A virus removed from your Domain Controller in the middle of the night will likely not fit in the pattern or 'user' behaviour above. So, what has actually happened is that a hacker, already on your systems, is just being lazy and trying to compromise your domain with well-known malware to gain full administration access. Certainly not routine.

The lesson - check all AV malware removal from IT devices more carefully in future.

If you think you'd benefit from the ECSC experts by your side when you need them most, then the easiest solution is a low-cost Incident Response Retainer, giving you access to 24/7/365 remote and on-site guidance, advice and support. Additionally, all Incident Response Retainer Clients receive a 20% discount on our Incident Response rates.

To learn more please download our brochure here or call the team on 01274 736 223.

For your free copy, simply enter your email below. Once submitted, a link to your download will be sent to your email address. Please take the time to make sure your email address is correct.

Top Tips - Watch your Anti-Virus

Welcome to #4 in a series of helpful tips, should you ever find yourself victim of a cyber incident response. Based on over 20 years of cyber incident response work, for clients of all sizes and sectors, ECSC is your ideal partner when you need it most.

Disconnecting Yourself!

You are in the middle of a suspected breach. Your retained experts (you should have this in place) advise you to shut off your Internet connection(s) immediately.

Do you have the guts to ask for forgiveness rather than permission? You could be the hero, or perhaps the one out of a job? So, you play it safe by escalating up to the appropriate levels of management. Depending upon the day, time and availability of key management, this may take hours or even days...

Hackers are quicker than this, and ransomware is everywhere...

Additionally, having received the relevant permission, are the administrators required available? During one of our incident responses, the clients' firewalls were outsourced to a global provider, who 'helpfully' said they could respond 'within the 3-day firewall change SLA'. This needed a 3-minute response. Luckily, already being on-site, we could step in.

So, the key here is to have pre-authorised permission for the people in your organisation with the right knowledge and understanding to instigate an Internet disconnect. Along with having people available who have the access and skills to make it happen.

If you think you'd benefit from having ECSC experts by your side when you need them most, then the easiest solution is a low-cost Incident Response Retainer, giving you access to 24/7/365 remote and on-site guidance, advice and support.

To learn more, please read our brochure here or call the team on 01274 736 223.

For your free copy, simply enter your email below. Once submitted, a link to your download will be sent to your email address. Please take the time to make sure your email address is correct.

Top Tips - Disconnecting Yourself

Welcome to #3 in a new series of helpful tips, should you ever find yourself the victim of a cyber incident. Based on over 20 years of cyber Incident Response work, for clients of all sizes and sectors, ECSC is your ideal partner when you need it most.

The Dangers of Automated Response!

For the well informed, combined with bitter experience, you will know that systems that promise an 'automated' response to a breach are perhaps more effective in the vendor demo video than in real life. The first time a critical system (or Director's laptop) is disabled, then the system is turned off for good.

However, there is a much more dangerous consequence of automated response.

Let's say your latest end-point security solution (no names here), promises to remediate all breaches to make your life easier. So, you have a breach, all works wonderfully and the software stops the breach. You sleep easy.

However, where is the attack vector leading to this compromise? Was the attacker already on your network and have you just blocked one part of the attack? Having seen this automated response the attacker just varied their route and tactics and your domain controllers are now being compromised prior to a major #Ransomware deployment. Has your 'successful' automated response made you complacent?

In reality, response needs an expert human component to really understand the context of the breach and whether a wider response is needed.

If you think you'd benefit from having ECSC experts by your side when you need them most, then the easiest solution is a low-cost Incident Response Retainer, giving you access to 24/7/365 remote and on-site guidance, advice and support.

To learn more, please read our brochure here or call the team on 01274 736 223.

For your free copy, simply enter your email below. Once submitted, a link to your download will be sent to your email address. Please take the time to make sure your email address is correct.

Top Tips - The Dangers of Automated Response!

Welcome to #2 in a series of helpful tips, should you ever find yourself victim of a cyber incident. Based on over 20 years of cyber incident response work, for clients of all sizes and sectors, ECSC is available 24/7/365 when you need it most.

So, are backups actually your vulnerability?

The better your backups, the more vulnerable they are.

Today we are discussing ransomware, and the typical attack methodology. To make it more likely that you are forced to pay, the hackers will target your backups before they deploy ransomware. They are looking to delete/encrypt/disrupt your backup systems to make recovery impossible.

So, if you have a shiny new backup system, permanently connected, integrated into your Windows domain and doing fancy replication and backup, then the likelihood is you're in trouble. You've made the hackers life easier, as the backups are a simple hop away from the domain controllers that they have just gained full administrative access to.

However, that old and quite embarrassing backup system, with tapes in the cupboard, is immune to attack. That ancient grandfather, father, son, system of tape rotation is likely to ensure you always have a recovery solution.

The key point here is to ensure you always have off-line copies; system and data backups that the hacker cannot access prior to ransomware deployment.

If you think you'd benefit from the ECSC experts by your side when you need them most, then the easiest solution is a low-cost Incident Response Retainer, giving you access to 24/7/365 remote and on-site guidance, advice and support. Additionally, all Incident Response Retainer Clients receive a 20% discount on our Incident Response rates.

To learn more, please read our brochure here or call the team on 01274 736 223.

For your free copy, simply enter your email below. Once submitted, a link to your download will be sent to your email address. Please take the time to make sure your email address is correct.

Top Tips - Backups Are Your Vulnerability?!

Welcome to the first in a new series of helpful tips, should you ever find yourself victim of a cyber incident. Based on over 20 years of cyber incident response work, for clients of all sizes and sectors, ECSC is available 24/7/365 when you need it most.

Ransomware's Biggest Secret

We all (think we) know what ransomware does - the hacker has gained administrative access to your critical IT systems, encrypts them, and demands a conversation regarding the cost of decrypting them. Your operation is crippled, your organisation faces financial disaster, and you find yourself updating your CV.

You hope you can recover your systems, and/or data, from backup and therefore don't have to pay the ransom; additionally most organisations have a policy of not paying ransoms at all (although in many cases these policies are later reversed when faced with failed recovery efforts).

So, what is the secret?

Well, in trying to recover your systems, you often just wipe the existing 'encrypted' systems. Big Mistake! Why? Well, contrary to what you might be led to believe, your systems may well NOT be encrypted. Yes, in many cases the hacker makes it look like they are, but specialists like ECSC can often successfully recover data from your systems.

Why is this the case? Well, encrypting systems takes a long time, and isn't really necessary for the attacker to convince you that you have lost everything. So, lots of ransomware malware only partially encrypts the data (just the file headers for example).

The lesson here is don't wipe your systems before specialist forensic experts have examined them to test the encryption level and extent - this doesn't take long as encrypted data looks very different to non-encrypted.

If you think you'd benefit from the ECSC experts by your side when you need them most, then the easiest solution is a low-cost Incident Response Retainer, giving you access to 24/7/365 remote and on-site guidance, advice and support. Additionally, all Incident Response Retainer Clients receive a 20% discount on our Incident Response rates.

To learn more, please read our brochure here or call the team on 01274 736 223.

For your free copy, simply enter your email below. Once submitted, a link to your download will be sent to your email address. Please take the time to make sure your email address is correct.

Top Tips - Ransomware's Biggest Secret

The field of Information Security, technological threats and vulnerabilities changes constantly and as a result the ISO 27001 standard is periodically reviewed and revised to ensure it remains up-to-date whilst remaining appropriate and flexible enough for the vast range of organisations that currently conform to its requirements.

Within the next few months, a revised version of the standard will be published and a number of key changes have been already been identified.

Key changes include the variation in the structure of the Annex A controls. Rather than the 14 sections of the previous standard. The controls are now split across only four sections. None of the current controls have been removed altogether, rather they have been merged with others or renamed, and 11 brand new controls have been added giving a new total of 93 controls.

In summary:

• 114 controls have been consolidated into 93 controls
• 57 controls have been merged into 24 controls
• 23 controls have been renamed but practically remain unchanged
• There have been 11 new controls introduced
• 0 controls have been deleted or excluded

What does this mean?

For organisations with an existing certification to the 2013 standard, auditors will verify your transition through surveillance audits, adding days to cover the new controls and processes. However, you will have until 31 March 2023 to prepare for this transition.

For clients who are seeking ISO 27001 certification for the first time, you will be able to choose which version to certify to, until 31 March 2023 when all new certifications must be against the new version.

Read More

Hacker groups are continuing to attack organisations and compromise data resulting in mayhem for the organisations involved. For any organisation that takes card details, there is an added layer of impetus to ensure data security, in order to avoid any potential financial ramifications for their clients.

Any incident involving card data can lead to direct fines under the Payment Card Industry Data Security Standard (PCI DSS) enforcement and GDPR fines from the Information Commissioner's Office (ICO) or equivalents across the EU.

What to do if my card data is compromised?

Following any breach, it is important that you prevent any further data loss and invoke your [Incident Response Plan] and/or seek external expertise to help guide you through your incident.

VISA has recently created the VISA ADC programme which is designed for card breaches and replaces the PFI-Lite programme. If you happen to find yourself in a situation where you may have had a breach, ECSC meets VISA's requirements to perform an independent investigation.

For more information on how ECSC could help in these instances, read our briefing document on 'Account Data Compromise Service'.

Ransomware, the threat is real!

Unsurprisingly, Ransomware will continue to be an ongoing risk for businesses this year, having grown exponentially in recent years, with many organisations seeing a record number of attacks and paying out bigger ransoms than ever before.

A large part of the reason for the continued threat, is the apparent immunity status that these types of hackers are currently receiving from certain countries on the basis that no activity is taken against organisations within their jurisdiction.

Whilst the ICO reports that 219 incidents were recorded during Oct - Dec 2021, it is important to keep in mind that this will not reflect the true number of Ransomware attempts - only those actually detected and reported.

In some cases, systems and networks can be compromised and go unnoticed for days, weeks, months and even years, until the hacker decides to sell access to Ransomware groups; which is commonly found by the ECSC Incident Response Team.

While it's difficult to determine the motivation of Ransomware groups, financial gain is usually most common, with threat actors asking for between 10-20% of an organisation's current cash flow. In our experience, the attacked organisations that have had to make a payment do so because they see no choice, the alternative being to close their business.

The most common form of Ransomware that ECSC support our clients with is Ransomware as a Service (RaaS).

Ransomware IS a business

RaaS is a by-product of threat actors who utilise Ransomware frameworks in order to behave like a traditional organisation by extorting other companies.

Via this approach, RaaS lowers the barrier for entry for budding cyber criminals because they no longer need to be hackers themselves. This proliferation brings increased risk to all.

Using white-labelled Ransomware, threat actors will use their infrastructure to co-ordinate attacks. These attacks use human intelligence to bypass security measures which are in place and exploit existing security weakness, in order to achieve their goal; extortion. From ECSC's experience, key and targeted security controls which will help to detect Ransomware attacks at an earlier stage, will make a significant difference.

Can I prevent Ransomware?

Protection against Ransomware should not be a costly exercise, at ECSC we recommend that at least 10% of IT spend should be invested in cyber security.

One approach is to maintain a resilient and regularly reviewed cyber security policy, tailored to your industry and personal needs. Which should include:

• Multi-Factor Authentication (MFA) must be in use on all external authentications.
• Regular backups off-site and offline. Backups are always the main target by Ransomware threat actors. In most cases, this is the primary distinction between whether or not a ransom has to be paid. It is crucial, not only that you have sufficient backups but also adequate expertise to put these backups in place after an attack.
• Data Leak Protection (DLP) is easily bypassed by threat actors. Strong Firewall and Proxy policies on all network devices are key to reduce exfiltration and Command & Control back-doors(C2C).
• Anti virus software is not sufficient protection against Ransomware, however, it is key. Anti virus should detect abnormal activity and notify your SIEM solution.
• SIEM monitoring on all devices.
• Don't allow employees to use their own devices for work purposes. Bring Your Own Device (BYOD) has been the root cause of many Ransomware breaches.
• Regular security training for employees must include phishing.
• Policies in place for reporting any suspicious activity.
• Rigorous patching of external devices including network appliances.
• Frequent external vulnerability scanning
• Have an Incident Response Retainer & Plan in place. The earlier you contact your service provider for external support, the better. ECSC have 20 years experience in kicking out threat actors.

To review your Ransomware controls, take the ECSC Health Check - it only takes 5 minutes!.

HOME WORKING DEVICES ARE IN SCOPE, BUT MOST HOME ROUTERS ARE NOT.

Anyone working from home for any amount of time is classified as a 'home worker'. The devices that home workers use to access organisational information, whether they are owned by the organisation or the user, are in scope for Cyber Essentials.

Home routers that are provided by Internet Service Providers or by the home worker are now out of scope and the Cyber Essentials firewall controls are now transferred to the home worker's device (computer, laptop, tablet and/or phone). However, a router supplied by the applicant organisation is in scope and must have the Cyber Essentials controls applied to it.

The use of a corporate (single tunnel) Virtual Private Network (VPN) transfers the boundary to the corporate firewall or virtual cloud firewall.

ALL CLOUD SERVICES ARE IN SCOPE

Cloud services are to be fully integrated into the scheme. If an organisation's data or services are hosted on cloud services, then the organisation is responsible for ensuring that all the Cyber Essentials controls are implemented. Definitions of cloud services have been added for Infrastructure as a Service, Platform as a Service and Software as a Service. Whether the cloud service provider or the user implements the control, depends on the type of cloud service.

WHY THE INCREASED FOCUS ON CLOUD SERVICES?

People commonly assume that cloud services are secure out of the box, but this is not the case. It is necessary for users to take responsibility for the services they use and spend time reading up and checking their cloud services and apply the Cyber Essentials controls where possible. Previously, Platform as a Service (PaaS) and Software as a Service (SaaS) were not in scope for Cyber Essentials, but the new requirements now insist that organisations take responsibility for user access control and the secure configuration of their services, which would include securely managing access to the different administration accounts and blocking accounts that they do not need. Where the cloud service is in charge of implementing one or more of the controls (e.g. security update management or anti-malware), the applicant organisation has the responsibility to seek evidence that this is done to the required standard.

MULTI FACTOR AUTHENTICATION MUST BE USED FOR ACCESS TO CLOUD SERVICES

As well as providing extra protection for passwords that are not protected by other technical controls, multi-factor authentication should always be used to provide additional protection to administrator accounts and accounts when connecting to cloud services.

The password element of the multi-factor authentication approach must have a password length of at least 8 characters with no maximum length restrictions.

WHY?

There has been an increasing number of attacks on cloud services, using techniques to steal users passwords to access their accounts.

Multi-factor Authentication requires the user to have two or more types of credentials before being able to access an account. There are four types of additional factor that may be considered:

• A managed enterprise device
• An app on a trusted device
• A physically separate token
• A known or trusted account

THIN CLIENTS ARE IN SCOPE WHEN THEY CONNECT TO ORGANISATIONAL INFORMATION OR SERVICES

A thin client is a 'dumb terminal' that gives you access to a remote desktop. It doesn't hold much data, but it can connect to the internet.

ALL SERVERS INCLUDING VIRTUAL SERVERS ON A SUB-SET OR A WHOLE ORGANISATION ASSESSMENT ARE IN SCOPE

Servers are specific devices that provide organisational data or services to other devices as part of the business of the applicant.

DEFINITION OF A 'SUB-SET' AND ITS IMPACT ON SCOPE

A sub-set is defined as a part of the organisation whose network is segregated from the rest of the organisation by a firewall or VLAN. A sub-set can be used to define what is in scope or what is out of scope of Cyber Essentials. Use of individual firewall rules per device are no longer acceptable.

DEFINITION OF 'LICENSED AND SUPPORTED'

Licensed and supported software is software that you have a legal right to use and that a vendor has committed to support by providing regular patches or updates. The vendor must provide the future date when they will stop providing updates. The vendor does not have to be the original creator of the software, but they must have the ability to modify the original software to create updates.

ALL SMART PHONES AND TABLETS CONNECTING TO ORGANISATIONAL DATA AND SERVICES ARE CONFIRMED IN SCOPE WHEN CONNECTING TO A CORPORATE NETWORK OR MOBILE INTERNET SUCH AS 4G AND 5G.

However, mobile or remote devices used only for voice calls, text messages or multi-factor authentication applications are out of scope.

DEVICE LOCKING

Biometrics or a minimum password or pin length of 6 characters must be used to unlock a device.

PASSWORD-BASED AND MULTI-FACTOR AUTHENTICATION REQUIREMENTS

When using passwords,one of the following protections should be used to protect against brute-force password guessing:

• Using multi-factor authentication
• Throttling the rate of unsuccessful or guessed attempts
• Locking accounts after no more than 10 unsuccessful attempts

Technical controls are used to manage the quality of passwords. This will include one of the following:

• Using multi-factor authentication in conjunction with a password of at least 8 characters, with no maximum length restrictions
• A minimum password length of at least 12 characters, with no maximum length restrictions
• A minimum password length of at least 8 characters, with no maximum length restrictions and use automatic blocking of common passwords using a deny list

People are supported to choose unique passwords for their work accounts. New guidance has been created on how to form passwords. It is now recommended that three random words are used to create a password that is long, difficult to guess and unique.

There is an established process to change passwords promptly if the applicant knows or suspects the password or account has been compromised.

ACCOUNT SEPARATION

Use separate accounts to perform administrative activities only (no emailing, web browsing or other standard user activities that may expose administrative privileges to avoidable risks),

THE SCOPE OF AN ORGANISATION MUST INCLUDE END-USER DEVICES

If an organisation certifies their server systems only, they ignore the threats that come from their administrators who administered those server systems. The change to this requirement closes the loop-hole where organisations were able to certify their company without including any end user devices. Cyber Essentials must now include end point devices.

ALL HIGH AND CRITICAL UPDATES MUST BE APPLIED WITHIN 14 DAYS AND REMOVE UNSUPPORTED SOFTWARE

All software on in scope devices must be:

• Licensed and supported
• Removed from devices when it becomes unsupported or removed from scope by using a defined 'sub-set' that prevents all traffic to/from the internet.
• Have automatic updates enabled where possible
• Updated, including applying any manual configuration changes required to make the update effective, within 14 days of an update being released, where:

- The update fixes vulnerabilities described by the vendor as 'critical' or 'high risk'.
- The update addresses vulnerabilities with a CVSS v3 score of 7 or above.
- There are no details of the level of vulnerabilities the update fixes provide by the vendor.

Previously, there was a set criteria that the vulnerabilities which had to be applied had to meet which were laid out in the requirements. These criteria have now been dropped and organisations need to apply all high and critical updates on all their systems. This is raising the bar because organisations can no longer be selective about which patches they apply and leave themselves weak and vulnerable.

The reason for these changes can be illustrated by a high profile example this year. A vulnerability in the Microsoft Exchange System came out very publicly and was reported by numerous news outlets. That attack went from being a complex state actor attack to a commodity attack within seven days. It was commoditised into a ransomware attack only 12 hours later. This proves that a high complexity attack can be commoditised in hours and for this reason, all high and critical updates, need to be applied within 14 days, both for Cyber Essentials and Cyber Essentials Plus.

GUIDANCE ON BACKING UP

Backing up your data is not a technical requirement of Cyber Essentials, however there is now guidance on backing up important data and implementing an appropriate backup solution is highly recommended.

TWO ADDITIONAL TESTS HAVE BEEN ADDED TO THE CYBER ESSENTIALS PLUS AUDIT

Test to confirm account separation between user and administration accounts.
Test to confirm MFA is required for access to cloud services.

HOW THE CHANGES WILL WORK
There will be a grace period of one year to allow organisations to make the changes for the following requirements:
MFA FOR CLOUD SERVICES
The requirement will apply for administrator accounts from January 2022. The MFA for users requirement will be marked for compliance from January 2023.
THIN CLIENTS
Thin Clients need to be supported and receiving security updates, the requirement will be marked for compliance from January 2023. The new question will be for information only for first 12 months.
SECURITY UPDATE MANAGEMENT
Unsupported software removed from scope will be marked for compliance from January 2023.

The new question will be for information only for first 12 months.

If your organisation registers and pays for Cyber Essentials certification before 24th January 2022, you will be assessed on the old Cyber Essentials question set and have up to six months to complete your self-assessment.

Please be aware that the Cyber Essentials Readiness Tool will be updated with the new requirements for the 5 technical controls on 24th January 2022. If you would like to use the tool for guidance on the old question set, please access the guidance before 24th January 2022.

The pandemic has forced most organisations to modernise and adapt to incorporate new technologies, processes and ways of working. In most cases, organisations have had to do this at speed in order to meet demand and to be able to continue to operate.

Combined with more bad news in the media regarding cyber threats and increased activity, including phishing attacks, ransomware and data breaches to name a few, protecting your information should be at the forefront of your information security.

Protecting your information

The security industry is continuously developing new technologies that help organisations defend against all threats. Understanding and doing the basics well, in a controlled and managed way, will help protect against attacks. All too often we see organisations with "all the latest tech" but with the basics missing or poorly managed, meaning their cyber resilience is lacking.

So what is cyber resilience?

Cyber resilience is the ability to prepare for, respond to and recover from cyber attacks.

Cyber resilience helps an organisation protect against cyber risks, defend against and limit the severity of attacks, and ensure its continued survival despite an attack. It is now commonly accepted that it's no longer a matter of 'if' but 'when' an organisation will suffer a cyber attack, however, this does not have to be the case. To help plan for cyber resilience there are four basic stages that need to be met.

Stage 1 - Manage and Protect

The first stage of any cyber resilience programme involves being able to identify, assess and manage the risks associated with network and information systems, including those across the supply chain. It also requires the protection of information and systems from cyber attacks, system failures and unauthorised access.

Stage 2 - Identify and Protect

The second stage of any cyber resilience programme depends on continual monitoring of network and information systems to detect anomalies and potential cyber security incidents before they can cause any significant damage.

Stage 3 - Respond and Recover

Implementing an incident response management plan will help you continue to operate even if you have been hit by a cyber attack and get back to business as usual, as quickly and efficiently as possible.

Stage 4 - Governance and Assure

The final stage is to ensure that your programme is overseen from the top of the organisation and built into business processes and procedures. Over time, it should align closely with your wider business objectives.

Having robust measures in place will not only protect your information but allows you to evidence to your clients that you take data security seriously and that their information is secure.

If you need any help with your journey to become cyber resilient, call 01274 736223.