Cybersecurity Expert

Yesterday I spoke at the R3 Summit (Resilience, Response and Recovery) in London, on the topic of Cyber Security Incident Management and response. Given the Q & A and the ensuing discussion after my talk, the attendees were particularly interested in my views on incident containment ahead of recovery. Below is a summary of what I said. Step 1: Incident Management Planning and Preparation The most crucial part of incident management is the preparation, it is important to always consider cyber security incidents as a ‘When’ not an ‘If’ as you plan ahead. So here’s my ‘brain dump’ of an incident management planning strategy: A company Cyber Security Incident Management Policy It must define what the company (aka the board) consider as a cyber security incident Cyber Security Incident notification communications channel or even better a reporting application/system Upon identifying an incident who do staff notify (the incident management team) Staff awareness of how to...

Today I received several interesting cyber security expert views on the Yahoo breach following my blog post yesterday -  Yahoo, The Largest Data Breach in History...so far ,   Broken Security Model? Paul German, VP EMEA at Certes, a specialist in cyber security and encryption, believes the Yahoo hackers were able to steal such vast amounts of account data due to a problem with the cyber security model of 'Protect, Detect and React'. Specifically the time in detecting the protection had been overcome. In Yahoo's case this time lag appears to be months and possibly even years, which allowed the hackers plenty of time to scout around the inside network undetected and extract such huge amounts of data out. To counter this lag, Paul suggests any potential hacker access to the data should be contained, I'm guessing by cranking down on data access control. Here's his full comments below. “The problem lies in the face that once hackers cross a company’s ...

Yahoo have just disclosed  over 500 million of its user accounts have been compromised, that's a huge number, think about it for second, that's half a billion people across the globe affected and at risk. This is largest known data breach in history to date. We know the Yahoo account data were stolen in late 2014, said the hack is said to have been orchestrated by state-sponsored actors, although there's no evidence to back this claim up. Yahoo has not disclosed how the data was hacked, or why it has taken almost two years to either discover the breach or disclosure the breach publically. A cynic might say Yahoo delayed informing its massive user base until after it's recent £3.7 billion sale to Verizon was done and dusted. However in late July 2016 hackers were found offering 200 million Yahoo accounts for sale on the dark web ( www.telegraph.co.uk/200-million-yahoo-account-details-for-sale-online ), so it is likely the 2014 data theft was discovered on the back o...

The fallout from massive data breaches in recent years continued to dominate the August headlines. Dropbox enforced password changes for 68 million users after accounts as a result of the 2012 Dropbox breach, when a Dropbox employee stole a load of account details. Meanwhile over 200 million Yahoo user credentials were found up for sale on the dark web. The large user account data breaches didn’t stop there; several large online user forums operating on vBulletin were found to be vulnerable and compromised with SQL injection attacks, leading to the theft of millions of forum user account details. Ransomware continues to plague all industries, especially the UK health sector, with half of all NHS Trusts confirming ransomware infiltrations. The Locky ransomware continues to be updated by cybercriminals, making the malware much harder for anti-virus software to detect and prevent. Finally a report by ‘Cybersecurity Ventures’ predicts a Cyber-Apocalypse, estimating that cybercrime will...

In July there were several reports affirming the continued escalation of Cybecrime in the UK, with the National Crime Agency (NCA) including cybercrime in its crime statistics for the first time, confirming there were more incidents of cybercrime than physical crime in the UK. NCA concluded that UK businesses and law enforcement were losing a “cyber arms race” with online criminals. The Information Commission’s Office (ICO) highlighted the UK Health and Local Government as the worse industries for data protection, accounting for 41% of data breaches reported to the ICO in Q1 of this year.  The EU approved “EU-US Privacy Shield” as a replacement for ‘Safe Harbor’, however there is speculation this is merely a temporary fix, as the EU data protection committee, Working Party 29, raised concerns with the Privacy Shield agreement, which they intend to address in 2017. BT's broadband outages in July has led to concern about the resilience of the UK's national digital infrastructure...

Before Brexit ( Why Brexit will be Business as Usual for Cyber Security & Data Protection in the UK ) dominated the UK parliament agenda, a Commons Committee lambasted the Information Commissioner’s Office for not acting tough enough with TalkTalk in regards to their data breach earlier this year.  The UK parliament also passed the controversial ‘Snoopers Charter’ bill this month. For the fourth month in a row Adobe and Microsoft released critical patches to fix zero day exploited flash vulnerabilities.  A spate of tech company chiefs had their twitter accounts hacked, including Facebook’s Mark Zuckerberg, who was also spotted on an Instagram picture with tape covering his MacBook's webcam. The Ransomware epidemic continues to make headlines and cause issues across all industries, this month saw concern over a new strain of ransomware called RAA, which executes only using JavaScript.  News Microsoft Office 365 hit with Massive Cerber Ransomware Attack...

So it actually happened, they have gone and done it, its shocked the world, the UK populous have voted to leave the European Union today. Now what? Well we'll have to just get on with it and starting thinking how Brexit will impact C yber Security and Data Protection in the UK from here on in.  I didn't post a word on Brexit despite being asked numerous times during the "debating" season, or as we in the security industry call it, FUD!.  But now its done and dusted, here are my thoughts, which as always on this blog, are completely  my own. Cyber Security Defence The UK is a significant player in the international cyber threat intelligence community, although a highly secretive business, the “snooping” documents leaked by Edward Snowden demonstrated how closely GCHQ works with their American counterpart agencies. When it comes to the business of protecting the UK’s critical national infrastructure, economy and businesses from cyb...