Cybersecurity Expert

Geopolitical conflict rarely stays confined to physical battlefields. Increasingly, it spills into the digital domain. The latest escalation of tensions in the Middle East has prompted the UK’s National Cyber Security Centre (NCSC) to issue a warning to organisations  to review their cyber security posture and prepare for possible cyber activity linked to Iran. While the NCSC has stressed that there is currently no confirmed significant increase in direct cyber threats to the UK, it has warned that the situation is fast-moving and organisations should remain alert. Rising Tensions and Cyber Spillover The warning follows a sharp escalation in the regional conflict involving Iran, the United States and Israel. Military developments have been accompanied by cyber activity targeting digital infrastructure and online services in the region, highlighting how modern conflicts now run across both physical and digital fronts. In response, the NCSC has advised UK organisations to review the...

A roundup of UK focused Cyber and Information Security News, Blog Posts, Reports and general Threat Intelligence from the previous calendar month, December 2020. A suspected nation-state sophisticated cyber-attack of SolarWinds which led to the distribution of a tainted version the SolarWinds Orion network monitoring tool, compromising their customers, dominated the cyber headlines in mid-December 2020.  This was not only one of the most significant cyberattacks of 2020 but perhaps of all time. The United States news media reported the Pentagon, US intelligence agencies, nuclear labs, the Commerce, Justice, Treasury and Homeland Security departments, and several utilities were all compromised by the attack. For the full details of the SolarWinds cyber-attack see my article  Sunburst: SolarWinds Orion Compromise Overview Two other cyberattacks are possibly linked to the SolarWinds hack was also reported, the cyber-theft of sophisticated hacking tools from  cybersecurity fi...

Article by Beau Peters The movie industry is infamous for its loose depictions of hacking and cybersecurity. Hollywood often gets a lot wrong about hacking and digital protections, but what does it get right? The power of film in influencing the future of technology and the experts that create it is immense. Because of this, it is important to assess what the facts are versus movie fiction.  Here, we’ll explore the film industry’s portrayal of cybersecurity. Cybersecurity in Movies From WarGames to Blackhat, hacking and cybersecurity movies have glamorized the world of digital safety and the compromising of said safety. However, each Hollywood outing does so with varying levels of realism, typically embracing excitement over reality.  In the 1983 WarGames movie, a young hacker almost triggers World War 3 These portrayals have led to common tropes and views of the cybersecurity industry in their attempts to prevent and combat hacking attempts. Among these tropes are some of th...

On 13th December 2020, it came to light SolarWinds IT systems were compromised by hackers between March 2020 and June 2020. SolarWinds provides software to help organisations manage their IT networking infrastructure. The attackers exploited their SolarWinds IT access to covertly insert a vulnerability, coined 'Solorigate' or 'Sunburst', within the SolarWinds Orion platform software builds.  The following SolarWinds Orion versions are considered to be compromised.  Orion Platform 2019.4 HF5, version 2019.4.5200.9083 Orion Platform 2020.2 RC1, version 2020.2.100.12219 Orion Platform 2020.2 RC2, version 2020.2.5200.12394 Orion Platform 2020.2, 2020.2 HF1, version 2020.2.5300.12432 The vulnerability within these 'tainted' SolarWinds Orion versions permits an attacker to compromise the server on which the SolarWinds Orion product is installed and runs.  Given that SolarWinds is a popular network traffic monitoring product, thousands of organisations are said to be i...

Authored by Dr Sandra Bell, Head of Resilience Consulting EMEA, Sungard Availability Services   PDF edition of this article The 2019 National Cyber Security Centre’s (NCSC) Annual Review does not shy away from naming the four key protagonists when it comes to state-based cyber threats against our country. The review sites China, Russia, North Korea and Iran as being actively engaged in cyber operations against our Critical National Infrastructure and other sectors of society. That being said, the main cyber threat to businesses and individual citizens remains organised crime. But with the capability of organised crime matching some state-based activity and the sharing (if not direct support) of state-based techniques with cyber criminals, how are we expected to defend ourselves against such sophisticated cyberattack means? The answer offered by Ciaran Martin, CEO of the NCSC, in his Forward to the 2019 Review only scratches the surface of the cultural change we need to embr...

State-orchestrated cyber attacks have dominated the media headlines in October, with rogue state North Korea and its alleged 6,800 strong cyber force blamed for several cyber attacks. International intelligence scholars believe the North Korean leadership are using cyber warfare to up the political ante with their ongoing dispute with the United States. The North Koreans, as well as terrible security practices, were directly blamed by the UK National Audit Office for the recent  NHS WannaCry attack  ( despite North Korea denying it ). North Korea was also reported to be implicated in the  stealing US War Plans from South Korea , and for a spear phishing campaign against the US Power Grid . The possible Russian manipulation of the US election with cyber attacks and rogue social media campaigns is still a story not going away, while the Chinese are alleged to be behind the data theft of  Australian F-35 fighter jet, in what is described as an 'extensive' Cyberattack ....

The fallout from massive data breaches in recent years continued to dominate the August headlines. Dropbox enforced password changes for 68 million users after accounts as a result of the 2012 Dropbox breach, when a Dropbox employee stole a load of account details. Meanwhile over 200 million Yahoo user credentials were found up for sale on the dark web. The large user account data breaches didn’t stop there; several large online user forums operating on vBulletin were found to be vulnerable and compromised with SQL injection attacks, leading to the theft of millions of forum user account details. Ransomware continues to plague all industries, especially the UK health sector, with half of all NHS Trusts confirming ransomware infiltrations. The Locky ransomware continues to be updated by cybercriminals, making the malware much harder for anti-virus software to detect and prevent. Finally a report by ‘Cybersecurity Ventures’ predicts a Cyber-Apocalypse, estimating that cybercrime will...

In July there were several reports affirming the continued escalation of Cybecrime in the UK, with the National Crime Agency (NCA) including cybercrime in its crime statistics for the first time, confirming there were more incidents of cybercrime than physical crime in the UK. NCA concluded that UK businesses and law enforcement were losing a “cyber arms race” with online criminals. The Information Commission’s Office (ICO) highlighted the UK Health and Local Government as the worse industries for data protection, accounting for 41% of data breaches reported to the ICO in Q1 of this year.  The EU approved “EU-US Privacy Shield” as a replacement for ‘Safe Harbor’, however there is speculation this is merely a temporary fix, as the EU data protection committee, Working Party 29, raised concerns with the Privacy Shield agreement, which they intend to address in 2017. BT's broadband outages in July has led to concern about the resilience of the UK's national digital infrastructure...

Great infographic by State of the Internet which raises an interesting question, should websites block Tor users?  Certainly one for debate, my view is it depends on your website 'marketplace', function and risk, in other words perform a risk assessment, a lazy answer I know. But i f like me you find yourself often explaining what Tor is to business folk, so they can perform those risk assessments properly, you'll find this infographic comes in quite handy. As it does a simple job of explaining Tor; who uses it, how it provides anonymity  online, and how cyber criminals are embracing the tool for various illicit purposes. I recommend checking out the  State of the Internet website  for further info, statistics and reports on Web and DDoS attacks, which continue to blight the Internet.

I have written the following article for IBM which was published today on  IBM Development Works . https://www.ibm.com/developerworks/library/iot-security-best-practices-iot-apps/ The Internet of Things is changing the way that businesses operate, especially in the areas of warehousing, transportation, and logistics. These changes make the security of IoT devices even more crucial, given the time and money that is required if a hacker breaks through the defenses. This article outlines the best practices for securely developing robust IoT solutions.

I was an early adopter to Twitter, opening my  @securityexpert  account back in October 2008, I found Twitter has been an excellent tool for picking up and sharing information security news, articles, major breaches and critical vulnerability alerts. As well as making my own contributions I often retweet tweets of InfoSec interest, education and intrigue, however I have always had a strict policy of never allowing my  @securityexpert  account to send any automated tweets, every tweet is manually sent or is retweeted by yours truly. Once you go down that road the personal nature of the account goes. I recognise that many of  followers of the account are interested are in the latest news, so with that in mind I have launched a new Twitter account to provide a more comprehensive and more regular stream of InfoSec news. @securitytoday  has been launched  to just tweet cyber information security related new...

Cyberwar makes a great sound bite, so it can be of no great surprise it is a term relentlessly cited by the media at the moment, but is it really the appropriate term to use?   Recently I was invited to hear 'Security Rockstar' Bruce Schneier talk about his thoughts on Cyberwar, he made some intriguing points about the term.  Bruce explained Americans like to band around words like "war" when they aren't actually at war, and avoid using the 'war' word when they are at war. For example "the war on terror", "the war on drugs", and now "cyberwar". I recall that in the first Gulf 'War' the American media focused on titles like 'The Gulf Crisis', 'Crisis in the Gulf', and 'Desert Storm', so certainly some truth there. In the last couple of years US politicians have increasingly been using the term "Cyberwar" in their rhetoric, phrases like 'Cyber Pearl Harbour', 'Cyber 911...