Cyber attacks are now part of our business environment and we have to accept and protect our businesses from attacks as best we can.  We can no longer ignore this threat to our businesses.  The National Cyber Security Centre have created a useful start framework to help you work through how to reduce the impact to your business from a successful cyber attack.

If you do suffer a cyber attack MJD have direct links to The Cyber and Fraud Centre Scotland, and importantly through this centre to Police Scotland and the Banks, this enables us to get rapid action to report the cyber attack and if money has been defrauded get action by the Police and the banks.

There are some cost effective and recommended methods to help reduce your exposure to cyber attacks which are outlined in Cyber Essentials such as firewalls, virus and malware protection, patch management, secure configuration, password policies and how user permissions are setup.  Further steps you can take are security monitoring, training of your users to ensure their awareness of the threats to the business and incident management.  Further reading on the steps to introduce Cyber Security to your business can be found at the following two links:

https://www.ncsc.gov.uk/collection/10-steps

https://www.ncsc.gov.uk/collection/small-business-guide

Lets go through the steps outlined in the NCSC’s infographic below.   As a business you want to mitigate the survey stage.  This is the stage where social engineering is taking place by the potential attackers, they gather as much information as they can on their potential targets through information publicly available and trying to gain information from your employees.  This is why user training, education and awareness is so important in your cyber security defences in today’s environment.  If you are unsure what social engineering is we covered this in a past blog post here (https://www.mjdsystems.co.uk/521-2/) It is also important to ensure employees think about the company information they make publicly available in published documents and on social media.

Here at MJD we have a recommended training system that will send fake phishing emails to users in the business which helps to keep the threat in your employees minds and provide training there and then if they don’t identify the potential risk and click on a link in the email.  This takes the hassle out of organising and keeping training up to date for your employees and ensures they are regularly made aware of the threat.

Antivirus software is not enough! There are various processes and products that you can use to mitigate the delivery stage.  This is when the attackers try to carry out the actual attack to gain access to your systems.  The options available to the attackers can be reduced through the employment of anti-virus and malware protection, firewalls, password policies and secure configuration of permissions to users and devices.

The next stage is the part we all don’t want to get to, but we must plan and prepare for if the eventuality happens to us, and that is the breach stage.  Do you have a disaster recovery plan if the worst happens? Ways to mitigate this stage is effective patch management, anti-virus and malware protection, consistently well-implemented and maintained user access controls and user training and awareness.

We have an industry recommended and leading anti-virus and malware protection software which we recommended and use for our clients.  This software also provides us with remote monitoring and patch management to ensure our clients devices are kept up to date to reduce the risk of known vulnerabilities being exploited.

When we get to the affect stage it can be harder to detect the activities of the attacker, as if all the previous recommendations at each stage are implemented it has been a targeted and bespoke attack to gain entry.  However, here at MJD we have a few systems we can utilize to monitor activity in our clients systems and spot unusual activity.  If you have any questions on this area, we’d encourage you to get in touch to discuss with us as this area requires a more tailored approach to your specific organisation.

https://www.ncsc.gov.uk/guidance/white-papers/common-cyber-attacks-reducing-impact

In recent weeks and months we are seeing our clients reporting to us more of the extortion style phishing emails again, so lets break down what they are, what we need to be concerned with and how to deal with them.

These extortion phishing emails which were first identified by the National Fraud Intelligence Bureau in July 2018, whereby they claim to have evidence of internet activity carried out by yourself, tend to appear as if they are coming from your own email address.  They usually claim to have images or videos of you and threaten to share them and they will demand payment in some form to stop them sharing the evidence they hold.  On the 23^rd of April 2020 the NFIB reported they had 9473 reports of this email scam, with 200 reports that week alone. (https://www.actionfraud.police.uk/alert/fraudsters-send-victims-own-passwords-in-sextortion-scam )

Now, this can cause concern as you may think they have gained access to your email account to be able to send the email using your address. However, this is just a clever tactic by the phisher to give their email more credibility and is called spoofing.  It may also include a password which you have used in the past.  This information will have generally be taken from a previous breach of your personal data.  However, if you still use this password for any account you should immediately change these passwords.

The whole aim of these emails is to play on the recipients emotions, and they will have sent this email to enough different individuals that they hope enough will respond and pay the ransom to make their scam profitable.

So what should you do?  You should report the email through your organisation’s reporting procedures or delete the email.  You can also report these emails through the National Cyber Security Centre email reporting service – report@phishing.gov.uk  You should also ensure that if there is a password mentioned that you still use, change this immediately and look to implement any further security measures, such as MFA, on these accounts to improve their security.

We’ve included a helpful infographic from NCSC below on extortion emails and ActionFraud have a good further article on the topic which they released in 2018 but is still relevant now.  https://www.actionfraud.police.uk/alert/alert-cyber-criminals-send-victims-their-own-passwords-in-new-sextortion-scam

If you have any queries or concerns surrounding your Cyber Security, please don’t hesitate to get in touch with the team here at MJD.

NHS 111 is the 24/7 number you can call to get urgent treatment and advice about an issue. It can be used to talk directly to specialists, or to book patients into their local emergency department. However, on the 4^th August 2022, this service was greatly hindered by a cyberattack on a third-party company which provides services to the NHS. In this blog post, I will go into detail on how this cyberattack happened, what the impact of the attack was, and how it may affect other companies in the future.

For a bit of an introduction, this third-party company is a software and service provider for many businesses across many sectors. For the NHS, they provide a software (a flexible patient management software) that helps NHS organisations to access GP records, automatically comply with data protection laws, issue electronic prescriptions and much more. As the third-party provider reports themselves, they work with 85% of NHS 111 services and their software impacts over 40 million patients.

This cyber attack essentially caused the shutdown of the third-party software, resulting in all of the work having to be done manually. The provider has reported that the NHS should be prepared to complete this work manually for the next few weeks as they repair their systems and increase their security. It is currently unknown how the attack originated in the third-party software as of this post.

Many will still remember the 2017 cyberattack on the NHS with the WannaCry ransomware, which caused severe issues for the NHS and their systems. Over 600 NHS organisations were affected, which caused a lockout of their digital systems and important medical devices, such as MRI scanners. Whilst the attack was prevented from spreading further after only a few hours, the disruption caused by the attack was felt for over a week as systems needed to be repaired and cleared of malicious software.

The effect of this latest security attack wasn’t quite as serious as WannaCry, as it did not completely lock users out of systems, but still resulting in multiple NHS organisations having to resort to manual processing of information and instructions due to the inability to use this important software, and it seems that the effect will last for a while longer than WannaCry. The notice given by the NHS reports that 111 callers will likely have to wait for longer than usual to receive service, but that services will still be accessible to everyone.

According to a government survey, withing the last 12 months, 39% of businesses based in the UK have identified some form of cyberattack, this is consistent with findings for the year 2021 too. Of this 39%, around 80% were phishing attempts and around 20% were more sophisticated and serious forms of attack, such as denial of service attacks, malware or ransomware. Ransomware was determined to be the most serious form of these, and the survey showed that over 50% of businesses had a policy to not pay ransoms.

Encouragingly, according to this same survey, cyber security is now being seen as a higher priority by a greater number of businesses compared to any other year the survey has been performed, which means that hopefully less businesses will be affected by cyberattacks in the future, but on the other side of the coin this can be seen as a note that cyber criminals will be required to up their tactics to counteract the increase in security.

This means that no business can afford to be complacent in today’s climate, as for every increase in security, there is an increase in the complexity of attack tactics. Make sure that employees are properly trained to identify and deal with cyber threats, ensure that passwords are secure and changed on a reasonable basis (with multi-factor authentication), make sure all your endpoints are protected with suitable cyber security software, and finally make sure that all of your critical data is regularly backed up to a secure external location so that should your company be affected by anything serious, you’ve got a backup to revert to and nullify the threat. If you have any questions on cyber security or cyber attacks or want to strengthen your cyber security measures please don’t hesitate to get in touch with the Team here at MJD.

Written by Aidan Streames

The majority of us now have smart phones as standard in our pockets and a smart speaker in our homes, we all engage with social media platforms and we love to shop online.  But how often do we consider our cyber security when using this technology in everyday life?  Lets dive in and discuss some of the areas which are important to consider and new intentions to practise in your everyday life to keep your personal details secure!

The devices we use everyday, our smart phones, smart speakers, smart TVs etc help to make our lives more convenient we need to be careful as they can be easy targets for cyber criminals to target us.  Here are our recommendations to help keep you secure:

• Keep social media accounts private and only connect with people you genuinely know and trust.
• Remember only share information online that you are happy being public knowledge, no matter how careful and how well you setup your privacy settings this information can fall into the wrong hands.
• Posts which “generate” silly nicknames for you or tell you where your next holiday should be with your friends? They are trying to gather more personal details to help guess passwords and answer security questions, so just remember to avoid posts that encourage oversharing.
• Stick to well-known and reputable websites for online shopping, and always use a credit or debit card and never send cash to a seller.
• If it’s too good to be true, it usual is, so remember to choose the safest deal not the least expensive.
• Ever had that occasion where your TV or radio station sets off your smart speaker? Ever thought about how they are always “listening”? It is recommended that you turn this setting off when working from home or talking about sensitive information.  If it stores recordings, review and delete these regularly too.
• Smart speakers track your activity like the history on your web browser, so its worth checking this periodically for any unusual activity and then clearing the history on a regular basis.
• Keep all your devices up to date! Don’t delay your updates, do them there and then to save forgetting and this ensures your device has the latest security updates.
• With your always-listening devices, when you go away if you are in any doubt, just switch it off or unplug it!

Employing these simple practises can help to add an extra layer of protection between your private information and your technology and help you to stay cyber secure.  If you have any more questions on cyber security please don’t hesitate to get in touch with the Team here at MJD.

Rudolph will be preparing his usual Christmas email to be sent to all the hardworking elves and Santa’s suppliers to wish them a Merry Christmas from his fellow reindeers and Mr & Mrs Claus.  But what does he need to consider from GDPR while sending his email?  The team at MJD wanted to give Rudolph some guidance and advice to keep everyone’s data safe.

Rudolph can still send a Christmas email to all his intended recipients; he just needs to consider the content in his email.  If he wants to include direct marketing and the emails are sent to individuals, then he would need to ensure he has the individuals’ consent to receive this type of communication.  However, if he just wants to wish everyone Merry Christmas and all the best for the New Year without any marketing included this will be fine.

Another important email feature that Rudolph should make use of is the Bcc box.  This will mean that he doesn’t give anyone’s data or contact information to anyone else in the email.  It is a very simple function, but a very important one for a Christmas Wishes email.  This advice should allow Rudolph to send a successful Christmas message for Santa and the other reindeer.  If you have any other questions around GDPR and cyber security, please don’t hesitate to get in touch with the team here at MJD.