Stuart O'Brien, Author at Cyber Secure Forum | Forum Events Ltd - Page 4 of 5
Posts By :

Stuart O'Brien

Anglo-Irish task force needed ahead of Brexit

 960 640 Stuart O'Brien
By:
0
0

A top Irish cyber security expert has claimed that ongoing Brexit negotiations are failing to address the most basic cyber security issues, and that an Anglo-Irish Cyber Task Force should be set up as soon as possible.

Paul C Dwyer, president of the International Cyber Threat Task Force (ICTTF) has voiced concern regarding the security of data protection and the worries of the digital community and digital border post Brexit. Dwyer recommends that Ireland should take the lead and work with the British Government with the aim of creating a task force to focus on these and other challenges, co-ordinating a joint cross sector approach to the issues that arise from new EU cyber legislation, the ICTTF being held up as an example of such an organisation.

The ICTTF was formed seven years ago as a not-for-profit virtual group to help connect cyber security experts. The organisation now has over 3,000 members from over 100 countries, along with over 20 million visitors to the ICTTF community portal a year.

https://www.icttf.org

What does GDPR mean for your business?

 960 640 Stuart O'Brien
By:
0
0

With the arrival of the General Data Protection Regulation (GDPR) on May 25th 2018, many companies are still unsure as to how the new legislation actually affects them and the implications on how organisations store, secure and manage personal data.

Ian Kilpatrick, executive vice president of Cyber Security for Nuvias Group, explains what GDPR means for business:

“GDPR will affect the whole of the EU Zone, which currently spans 28 member countries and half a billion citizens. Its goal is to unify data protection across the European Union, but because GDPR applies to individuals within the EU or the European Economic Area (EEA), companies outside these zones will still have to meet the standards if they want to continue using data from customers in the EU.

“The purpose of the new regulation is to shift control of personal data back to the owner of that data. Every organisation should be aware that with GDPR comes huge fines for data breaches – up to four percent of annual global turnover or €20 million, whichever is greater. Therefore, the consequences of any data loss could be financially devastating for any company.

“The data in question could be usernames, location data, online identifiers like IP address or cookies, or passwords. The loss of personal or work-related information – whether that’s access details, passwords, or any other customer data – is endemic today; almost 1.4 billion data records were lost in 2016 alone, an increase of 86 percent compared to the year before.

“After next May, organisations will have 72 hours to disclose any serious data breaches to the relevant authorities – in the UK it’s the Information Commissioner’s Office (ICO), as well as the victim of the breach. The penalty for failing to notify them of a breach will be up to €10 million, or two percent of revenues.

“Analyst firm IDC predicts that the severity of fines, coupled with the substantial changes in scope, will drive enterprises to radically shake up their data protection practices, seeking the assistance of new technologies to assist with compliance.

“Despite all this, a survey by information services group, Experian, reports nearly half of businesses (48 percent) admit they are not ready for GDPR, and are only in the early stages of preparing for the regulations.

“If they are not doing so already, organisations need to start putting plans in place now if they’re to meet the May 2018 deadline.

“So, what steps can companies take to ensure their GDPR-compliance? The ability to ensure confidentiality, integrity, availability and resilience will be crucial – as will be restoring data in a timely manner in the event of an incident. Organisations will need a process for testing and evaluating the effectiveness of their security processes, meaning they will need to demonstrate they have taken adequate steps to protect the data.

“GDPR doesn’t prescribe specific data protection technologies, but rather processes that organisations should undertake. However, companies should be talking to their IT providers about core data security solutions that cover things like encryption, access and identity management, two factor authentication, application control, intrusion prevention and detection, URL filtering, APT blocking and data loss protection. Also, they shouldn’t neglect the network, by securing wireless access points, for example.

“Having a demonstrable security policy in place and making sure employees are fully trained in the correct security practices will prove invaluable.

“Larger organisations and public bodies will require a data processing officer; this is a senior role that operates independently of the IT department and will enjoy significant protection, along with the responsibility of reporting any data breach. They will act as a fulcrum for developing, enacting and continually testing security compliance posture.

“However, GDPR compliance is everyone’s responsibility, and shouldn’t be left to one team – legal, IT, HR and other business functions must all be involved with visible support from the executive level.

“Something else that GDPR will likely affect is insurance. As the regulations require every business to report any data breach, there is going to more of an emphasis on liability and who is to blame as data losses come to light.

“In simple terms, businesses should document everything they have done at a technical and policy level to show due diligence. There are several framework documents created at a national level that can help. For example, the UK’s national cyber security centre has a number of 10-step programmes that offer a basic checklist of areas that should be covered.

“With heavy financial and reputational risk threatening, the sooner the new regulations are adopted, the more confident a company can be that it will not be found wanting when GDPR comes into effect.”

A third of UK infrastructure fails to meet basic cyber security standards

 960 640 Stuart O'Brien
By:
0
0

According to Freedom of Information requests by Corero Network Security, over a third of the UK’s critical infrastructure doesn’t meet the most basic cybersecurity standards.

The fact that so many infrastructure organisations have not completed the ’10 Steps to Cyber Security’ programme indicates a lack of cyber resilience within organisations which are critical to the functioning of UK society. It also suggests that some of these organisations could be liable for fines of up to £17m, or four per cent of global turnover, under the UK Government’s proposals to implement the EU’s Network and Information Systems (NIS) directive, from May 2018.

The Freedom of Information requests were sent by Corero, in March 2017, to 338 critical infrastructure organisations in the UK, including fire and rescue services, police forces, ambulance trusts, NHS trusts, energy suppliers and transport organisations. In total, 163 responses were received, with 63 organisations (39%) admitting to not having completed the ’10 Steps’ programme. Among responses from NHS Trusts, 42% admitted not having completed the programme.

Sean Newman, Director of Product Management at Corero, said: “Cyber attacks against national infrastructure have the potential to inflict significant, real-life disruption and prevent access to critical services that are vital to the functioning of our economy and society. These findings suggest that many such organisations are not as cyber resilient as they should be, in the face of growing and sophisticated cyber threats.”

Worryingly, the Freedom of Information data revealed that most UK critical infrastructure organisations (51%) are potentially vulnerable to these attacks, because they do not detect or mitigate short-duration surgical DDoS attacks on their networks. As a result, just 5% of these infrastructure operators admitted to experiencing DDoS attacks on their networks in the past year (to March 2017). However, if 90% of the DDoS attacks on their networks are also shorter than 30 minutes, as experienced by Corero customers, the real figure could be considerably higher.

Newman continued: “In the face of a DDoS attack, time is of the essence. Delays of minutes, tens-of-minutes, or more, before a DDoS attack is mitigated is not sufficient to ensure service availability, and could significantly impact the essential services provided by critical infrastructure organisations.

“By not detecting and investigating these short, surgical, DDoS attacks on their networks, infrastructure organisations could also be leaving their doors wide open for malware or ransomware attacks, data theft or more serious cyber attacks. To keep up with the growing sophistication and organisation of well-equipped and well-funded threat actors, it’s essential that organisations maintain comprehensive visibility across their networks, to instantly and automatically detect and block any potential DDoS incursions, as they arise.”

‘Brute force’ cyber attack on Scottish Parliament

 960 640 Stuart O'Brien
By:
0
0

Officials have confirmed that the Scottish Parliament has been targeted by a “brute force” cyber attack, similar to that which affected Westminster in June.

Chief executive Sir Paul Grice confirmed the attack in a message to MSPs and staff with parliamentary email addresses, and said the attack was from “external sources” and urged all members to be vigilant.

Grice added that systems “remain fully operational” and that “robust cyber security measures” had identified the attack early.

Grice also urged all MSPs and staff to make sure passwords were as secure as possible and that parliament’s IT team would “force a change to weak passwords as an additional security measure.”

“The parliament’s monitoring systems have identified that we are currently the subject of a brute force cyber attack from external sources,” wrote Grice.

“This attack appears to be targeting parliamentary IT accounts in a similar way to that which affected the Westminster parliament in June. Symptoms of the attack include account lockouts or failed logins.

“The parliament’s robust cyber security measures identified this attack at an early stage and the additional security measures which we have in readiness for such situations have already been invoked. Our IT systems remain fully operational.”

Hackers involved in a ‘brute force’ attack try to access systems by systematically using a range of different passwords in the hope that a correct password is delivered through trial and error.

 

NHS Digital signs cyber security contract with Microsoft

 960 640 Stuart O'Brien
By:
0
0

NHS Digital has signed a support contract with Microsoft, three months after the WannaCry ransomeware attacks that targeted Windows computers.

The attacks on the NHS highlighted the need for investment, lack of infrastructure and the need for training among NHS staff, along with the fact that the NHS relies on Windows XP, an obsolete operating system that raised questions about the resilience of the service’s IT systems.

The Government recently announced it would boost investment in NHS data and cyber security above the £50 million outlined in the Spending Review, addressing key structural weaknesses as part of its commitment to improve NHS cyber security, with an initial £21 million delivered to increase cyber security at major trauma sites as a priority, along with  improvement of NHS Digital’s national monitoring and response capabilities.

The support contract with Microsoft will cover all NHS organisations throughout the UK until June 2018 and provide a “centralised, managed and coordinated framework for the detection of malicious cyber activity through its enterprise threat detection software.”

A statement by the NHS added that the service “analyses intelligence and aims to reduce the likelihood and impact of security breaches or malware infection across the NHS.”

“One of NHS Digital’s key roles is to work closely with other national partners to explore and provide additional layers of cyber security support to NHS organisations when they need it – with the aim of minimising disruption to NHS services and patients,” the statement concluded.

NTT Report: Cyber attacks on the rise and with greater sophistication

 960 640 Stuart O'Brien
By:
0
1

A report released by NTT Security has revealed that the frequency and sophistication of cyber attacks continues to rise globally.

Based on events during the second quarter of 2017, data from the Global Threat Intelligence Center (GTIC) 2017 Q2 Threat Intelligence Report identifies trending threats and enables the company to implement IT security assessment and incident response tactics to stay ahead of hackers, and maintain the best protection for their clientele.

The report found that:

– Cyber attacks were up 24% globally during Q2 2017

– Manufacturers continue to be a key target for cybercriminals

– 67% of malware attacks were delivered by phishing emails

– The speed of attacks continues to increase exponentially once proof of concept code is released

“Our Global Threat Intelligence Centers are constantly monitoring cyber activities on a global scale and providing us with great insight as to which industries cybercriminals are targeting, why they’re targeting these areas, and how they may do so moving forward,” said Jon Heimerl, Manager, Threat Intelligence Communication Team, NTT Security. “This latest GTIC 2017 Q2 Threat Intelligence Report documents that hackers continue to target the manufacturing sector, which should be a red flag for CISOs across this market segment.”

According to the GTIC 2017 Q2 Threat Intelligence Report’s latest findings, 34% of all documented attacks targeted manufacturers. Moreover, manufacturers appear in the top three targets in five of the six geographic regions globally.

“This is no coincidence,” continued Heimerl. “The motivations for these attacks are often criminal in nature, including extortion via ransomware, industrial espionage, and theft of data such as account numbers. What poses an even greater problem is that when these breaches are successful, yet go undetected, they allow hackers to establish footholds in organisations’ networks where they have free reign to wreak havoc over extended periods. This is a problem if we consider that 37% of manufacturers recently surveyed (https://www.nttcomsecurity.com/us/risk-value-2017/), indicated they do not have an incident response plan in place. This is very concerning as manufacturers’ IT security liabilities often impacted not just the manufacturing organisations, but suppliers, as well as related industries and consumers.”

Download the Global Threat Intelligence Centre (GTIC) 2017 Q2 Threat Intelligence Report here

Andrus Ansip proposes new Euro cyber security centre

 960 629 Stuart O'Brien
By:
0
0

A senior European politician has proposed that the EU should set up a new cyber security centre, with the aim of certifying the security level of technology products.

Andrus Ansip, European Commissioner for the Digital Single Market, says the new centre would focus on technology products and technical expertise, working separately from NATO’s cyber security centre.

“European products and cybersecurity products are not able, only some of them are able, to compete in the world market. We have to pay much more attention to this,” commented Ansip.

“When the WannaCry ransomware attack affected companies across Europe in May, there were a lot of member states who asked for some help from the European Union.”

Ansip had previously tweeted earlier in the month that “more centres of excellence were needed” after a visit to NATO’s cybersecurity centre based in Estonia.

It is thought that Ansip will reveal more information on the centres in September, ahead of conversations on cybersecurity certification, along with an announcement on an updated EU cybersecurity strategy and a new legal basis for the European Network and Information Security Agency (ENISA).

However, the news of the centre could create problems and an overlap between organisations.

Speaking with EURACTIV, Steve Purser, ENISA’s director of operations said: “There is already a lot of competition between EU offices tasked with managing cyber security… it does make sense to have hundreds of people at the European level, but not hundreds of organisations.”

Employee Security Risk

SMB’s ‘lack of concern’ regarding Ransomware threat an issue

 960 640 Stuart O'Brien
By:
0
0

A new report from security vendor Webroot has revealed that less than half of small and medium sized businesses think they’re at risk of suffering a ransomware attack in 2017, despite the fact that more than 60 per cent have already been affected.

600 IT decision makers at companies with 100-499 employees from across the UK, US and Australia were contacted to compile and publish Webroot’s latest report ‘Cyber Threats to Small and Medium Sized Businesses in 2017’.

Only 42 per cent thought that ransomware was a major external security threat for the company, despite the recent major global attacks such as WannaCry and Petya.

However, almost 100 per cent of all IT decision makers polled for the report said they would be increasing their annual IT security budget in 2017.

72 per cent of UK IT decision makers said their business wouldn’t be fully prepared to combat threats, such as DDoS, phishing and other forms of malware infections.

“The lack of concern about ransomware is leaving a gaping hole in the security of global businesses, as witnessed by the recent outbreaks of WannaCry and not-Petya,” said Webroot’s EMEA regional manager, Adam Nash.

“This, combined with the UK’s false sense of security when it comes to businesses’ ability to manage external threats, is worrying. Small- to medium-sized businesses can no longer afford to put security on the back burner and need to start engaging with the issues and trends affecting the industry.”

Employees are companies’ biggest data security risk

 960 649 Stuart O'Brien
By:
0
0

A consensus study commissioned by data security specialist HANDD Business Solutions (HANDD) has revealed that nearly a quarter of IT professionals believe that the behaviour of employees and their reactions to social engineering attacks – which can trick them into sharing user credentials and sensitive data – poses a big challenge to data security.

The survey of 304 IT professionals in the UK shows that 21 per cent of respondents say regulations, legislation and compliance will be one of the two greatest business challenges to impact data security. The General Data Protection Regulation (GDPR) is causing real concern among professionals in their bid to be compliant by the deadline, which is less than 12 months away. GDPR will not only raise the privacy bar for companies across the EU, but will also impose extra data protection burdens on them.

HANDD CEO and co-founder Ian Davin commented: “Companies must change their mindset and look at data, not as a fungible commodity, but as a valuable asset. Data is more valuable than a pot of gold, which puts companies in a challenging position as the stewards of that data. C-suite executives must understand the data protection challenges they face and implement a considered plan and methodical approach to protecting sensitive data.”

41 per cent of those surveyed assign the same level of security resources and spend for all company data, regardless of its importance. Analysing and documenting the characteristics of each data item is a vital part of its journey through an organisation. A robust data classification system will see all data tagged with markers defining useful attributes, such as sensitivity level or a retention requirement and ensuring that an organisation understands completely which data requires greater levels of protection.

“Employees are probably your biggest asset, yet they are also your weakest link, and so raising user awareness and improving security consciousness are hugely important for companies that want to drive a culture of security throughout their organisation,” commented Danny Maher, CTO at HANDD.

Government invests £20m in teen cyber security education

 960 679 Stuart O'Brien
By:
0
0

The Government has launched an ambitious Cyber Schools Programme aimed at secondary school students between the ages of 14 and 18.

The initiative, launched by the Department for Digital, Culture, Media and Sport (DCMS) will provide training for up to 6,000 teenagers through extracurricular clubs and activities, along with an online game. The pilot programme is due to launch in the autumn.

The Cyber Schools Programme is part of the National Cyber Security Programme to find the online security experts of tomorrow. Students, teachers and cyber security professionals will be invited to register their interest online by the DCMS, which claims that the programme is intended “to make sure the UK is prepared for the future, and ready to tackle the growing threat posed by cyber criminals”.

“We want to help young people learn some of the skills needed to work in the cyber security profession. In the coming years, it will be your generation building, running and protecting the UK – you could be needed to help protect industries such as banking, transport and public services,” explains the DCMS website.

The training will be supported by Cyber Security Challenge UK, BT, FutureLearn and The Sans Institute.

Students between the ages of 14 and 18 will be assessed, before taking the course, with those that are accepted benefiting from connections within the cyber security sector. The DCMS is looking for at least 5,700 teenagers trained by 2021.

Commenting on the course, Matt Hancock, Minister of State for Digital, said: “Our Cyber Schools Programme aims to inspire the talent of tomorrow and give thousands of the brightest young minds the chance to learn cutting-edge cyber security skills alongside their secondary school studies. I encourage all those with the aptitude, enthusiasm and passion for a cyber security career to register for what will be a challenging and rewarding scheme.”