I wrote a short post recently with some guidance for start-ups – if you read it you’ll notice I assume that any start-up will be making use of cloud services, rather than trying to build and host infrastructure internally. It’s not just start-ups using...
So, what is it you do? I’m often asked by people outside the cyber security industry what is it, in fact, that I do. A reasonable question, and my usual answer is ‘stuff, for people’. Partly that is a hangover from the government days, and partly because consultancy is...
If you follow me on twitter, or read the blog here, you’ll know that I am very keen on security monitoring. Effective security monitoring means that you can spot bad stuff when it happens and take action promptly to remediate the problem, and importantly, limit...
Over the years I’ve worked with a number of organisations who are struggling with an outsourced security monitoring service provider. These relationships can fail for a number of reasons, and it’s not always (or even most often) just the fault of the provider. Yes, there...
The NCSC, along with the Information Commissioners Office (ICO) have produced some useful guidance on security and GDPR. The approach they use distill nicely into four aims; Manage security risk Protect personal data against cyber attack Detect security events Minimise the impact I will write blogs...
We see examples of failures in cyber security every day, frequently from organisations that should know better, such as this failure at the US Department of Defense: https://www.theregister.co.uk/2018/07/11/us_military_manual_dark_net_sale/ They should be doing a lot better. So what can a small or micro business do? TL;DR Secure the...
Security awareness training is a big topic, but something lots of organisations struggle with. While more or less everyone recognises that cyber security is not just a technical problem, and that good user behaviour is vital, actually deciding how to go about achieving this can...
A couple of weeks ago I wrote a post giving some advice on what you should do first if you find yourself in charge of cyber security at your organisation. You can read it here. I thought I'd follow up on that post, with some...
I do a fair bit of training, and often I find people have come along on a intro to cyber security course because they have suddenly found themselves responsible for security in their organisation. So regardless of whether you are new to security, or an...
A recent report by the Federation of Small Businesses demonstrates the cost of cyber crime to small businesses. One revenue stream used by criminals is a very traditional nefarious activity, exported to the cyber world. They threaten to disrupt a website unless the victim pays...