The year in Ransomware:

2020 started out with a number of #Ransomware incidents that were occurring over the New Year period. Ransomware became a greater threat throughout the year, with increased demands by the criminals looking to extort from their victims. So I continue to hopefully offer advice and guidance to you, on how you can protect your business from these threats.

The end of Windows 7:

We also saw the end of support for Windows 7. So if you’re continuing to use a #Windows7 machine in your organisations, you really need to get off that platform and move on to the more recent Windows 10 or other operating systems.

The COVID-19 Pandemic:

And of course 2020 brought us the biggest news of all with the #COVID19 pandemic. I provided lots of advice and guidance on how you can get your staff working from home safely and securely. Protecting both themselves and your business from the threats that were out there.

The Zoom Bombing phenomenon:

And one of those threats of course was #ZoomBombing, which I dedicated an entire video to, on how you can protect yourself from that.

All the rest in the Review of 2020:

There’s lots of other little bits and nuggets of information which I thought were maybe interesting and useful. I hope you found them similarly and I hope to continue to provide these to you in 2021.

Happy Christmas:

So with that, I would just like to wish you and yours the very happiest of Christmases and I hope you have a safe and secure New Year.

So that’s it for this year. Let’s be careful out there and we’ll talk to you again next year.

How can L2 Cyber Security help you?

We offer a full range of training programmes, which can be delivered online or in-person*.

L2 Cyber Security are also a partner of CyberRiskAware for online self-directed Cyber Security Awareness training and Phishing testing.

Contact us for more information at info@L2CyberSecurity.com.

*With appropriate social distancing and other health and safety measures adhered to.

Follow us on Social media:

Liam is available on Twitter, LinkedIn and Instagram.

Follow L2 Cyber on Twitter, LinkedIn, Instagram and Facebook.

© L2 Cyber Security Solutions

The post #WeekendWisdom 059 A Review of 2020 appeared first on L2 Cyber Security Solutions Ltd..

TLDR – I’m using it, though I’m not convinced of its effectiveness. While you’re here – please #WearAMaskInPublic.

The COVID Tracker App is better than nothing at all

First things first. I applaud the approach the HSE has taken here. They have been very open and transparent about this project. This is a welcome change to previous state agency attempts to abuse their power over our private lives, such as the #PSC card. There is more information available here.

The app however is doing too many things. It should just do the proximity tracking and nothing more. But no, they have a self-diagnosing Sniffle-Meter, they want to gather “metrics” from your app usage and they want your telephone number. At least you don’t have to use these functions if you don’t want to. I certainly won’t be.

So how well will the proximity tracking work? Not as well as some would have you believe. The Bluetooth technology that’s being used was never designed to detect distance and so many things interfere with wireless signals that it will never be truly 100% accurate. However it *IS* better than nothing at all.

It is not a preventative measure

It will not protect friends and family as some claim, because it is *NOT* a preventative measure. It will aid the track and trace efforts of the HSE, but nothing more. If you want good preventative measures then (1) wash your hands (2) cover your coughs and sneezes (3) wear a mask in crowded situations.

I’m very careful in my daily interactions in public places. I wear a mask when I go into shops in the city. Not so much my local rural shops, as they are generally much quieter, plus I’m in and out in a minute or two. I avail of hand sanitizer at every opportunity and have my own in the car. I am very rarely in close proximity to ANYONE for more than a minute or two. I always keep my distance – 2m or more.

There will be false readings

The only living beings that spend more than a few minutes in close proximity to me are my dogs, so if I get a notification from this app, it will almost certainly be a false positive. I expect there to be a noticeable percentage of false positives.

What will be interesting will be whether many false negatives come to light. These would be where an infected person is in close contact with somebody for a lengthy period of time, passes on the virus, but the app never flags it when either person puts in the code to show they have the virus.

We’ll see how it goes, particularly if/when a second wave comes.

Closing thoughts

I think I’ll see little value from using the app, but that’s me. If you happen to spend more time than I in crowded environments, shops, busy streets, offices, public transport then you probably should use the app. If you don’t want to, then fair enough that’s your choice. I won’t judge you.

Just a final note to those sneery people who say “Using Facebook, Twitter, TikTok to give out about data privacy on the COVID Tracker app.” stop doing that please, as it is not helpful. People have a right to be concerned about potential state surveillance. We have very strong laws protecting our right to privacy and we should be careful not to let these be chipped away at. We could very quickly reach a Black Mirror dystopia if we do not keep questioning our government’s intentions.

So stay safe. Wear a mask, wash your hands, wear a mask, keep your distance and did I mention – WEAR A MASK – please.

The post COVID Tracker App – an opinion. appeared first on L2 Cyber Security Solutions Ltd..

Earlier this week I co-hosted an online event where we talked about the “Return to work safely protocol” and data protection aspects in regards to that. If you want to watch it back go to YouTube and search for “breaking bad data protection practices”.

Now if anything I’m about to say here gives you cause for concern or questions, please feel free to contact me on info@L2CyberSecurity.com.

What’s wrong with Thermal Imaging Cameras?

So because thermal imaging cameras are actually processing health data, you need to carry out a data protection impact assessment. This must be done on the whole set up, BEFORE you consider installing it. You can get guidance on www.DataProtection.ie for doing a data protection impact assessment or DPIA.

Who can I screen?

You have the right to screen your employees. What you don’t have is the right to screen any member of the public or people who are not your employees. You just simply do not have that right.

What about visual and audible alerts?

Are you thinking about using any visual or audible alerts from the equipment? If so these must be placed in a very private location where there is only the subject being screened can be aware of these alerts.

Saving the data to the cloud is OK – yeah?

Do the cameras come with cloud storage capability? If so I’d be very reluctant to use it until you’re absolutely certain that the data is not taken outside of the EU.

I can get the clips emailed to my phone. That’s secure isn’t it?

And finally, you’re processing health data, it needs to be protected, so if the cameras have the capability of emailing video clips, don’t use them because email is not the most secure method for transmission of data.

So that’s it for this week. Let’s be careful out there and we’ll talk to you again next week.

Follow us on Social media:

Liam is available on Twitter, LinkedIn and Instagram.

Follow L2 Cyber on Twitter, LinkedIn, Instagram and Facebook.

© L2 Cyber Security Solutions

The post #WeekendWisdom 030 Thermal Imaging Cameras appeared first on L2 Cyber Security Solutions Ltd..

As I advised back in #WeekendWisdom number 23, the UK and US cyber security authorities have issued a warning about a huge increase in the number of domain names using COVID19 in their title. These will be used by malicious websites to try and get people to register their details or try to fool them in some other way.

What kind of fake domain names

Here you can see an example from a text message which would seem to indicate that you were in contact or close contact with somebody who has now been diagnosed with COVID19 or has the symptoms of COVID19. And they are trying to leverage the uncertainty about the contact tracing that is going on at present. So they want you to click on that link which would not be very good.

What about those COVID19 Tracking Apps

Similarly various countries are beginning to roll out COVID19 tracking apps. And there is going to be again, uncertainty around how these are going to work.

For example just this week, Australia rolled out the COVIDSafe app. And within hours of this app going live, there were text messages going around to Australian mobile numbers seeming to indicate it was coming from the app and that people had been detected outside of the range from their homes and they need to call the number.

So it’s all fake and that’s what these guys are going to try and leverage.

When an app goes live in your country, expect to start seeing some scam text messages about that or other the messages about that.

So don’t fall for the fake domain names and scams about COVID19 tracking apps.

So that’s it for this week. Let’s be careful out there and we’ll talk to you again next week.

www.L2CyberSecurity.com

www.twitter.com/L2Cyber

#SecuritySimplified

The post #WeekendWisdom 026 Fake domain names and COVID19 tracking apps appeared first on L2 Cyber Security Solutions Ltd..

Where did this come from?

I ran a webinar entitled “Cyber scams and security tips for businesses in the COVID19 crisis” recently. During that I was asked a question about the use of monitoring for staff in the work from home environment.

If you want to do this, you will require to have a legal basis for carrying this out.

You probably won’t be able to rely upon a contractual basis. I don’t think legitimate interests would be successful either. This is because the employee would be more entitled to right of privacy in their own home.

So I can’t be using technology to monitor work from home staff?

So therefore you would be left with getting the employee’s consent. They would need to be fully informed about what monitoring is taking place, how it is taking place, etc.

If the monitoring involves video recording, because that data will probably contain their facial image, this would be considered biometric data. that is a special category of data.  It is also considered sensitive personal data. You must get explicit consent from the staff member before you process that data. They have the right to refuse to give that consent. If they do so, you must use some alternative means to satisfy the staff number.

This also applies to any conference calls over video platforms like Zoom or Microsoft Teams or Hangouts Meet, by the way.

Anything else?

You also need to be considerate about others that might be in the staff member’s household. Family members and in particular children, if they get caught up in any of these video recordings, you need to be able to handle that appropriately.

So that’s it for this week. Let’s be careful out there and we’ll talk to you again next week.

www.L2CyberSecurity.com

www.twitter.com/L2Cyber

The post #WeekendWisdom 024 Using technology to monitor work from home staff appeared first on L2 Cyber Security Solutions Ltd..

We did talk about some of these before

Back in #WeekendWisdom number 19, I talked about the rise in Coronavirus related scam emails and malicious emails that would have documents that would download malicious software onto the machines or links that would attempt to compromise the machine. These are also known as phishing emails or malicious spam (MalSpam) types of emails.

These emails are playing on people’s desire for information about Coronavirus. They also play on our fear in the uncertain situation that we find ourselves in at this time.

The cyber security authorities in the UK and US have in recent days come out with a warning that they have seen a definite increase in these type of activity. So be on the lookout for more malicious emails.

What other Coronavirus Cyber Threats are there

They also warned about a significant increase in the number of COVID19 related domain names being registered. So the bad actors are registering domains with COVID19 in their title so that they can use them to more likely fool people by clicking on links to go to sites so might be “relevant” to COVID19.

So as I advised then, use only WHO or your national health authority’s websites for your information about COVID19.

They also advised that they are seeing additional targeting attempts at remote working infrastructure. Particularly those that might have been rushed to get set up in time. So if you were under pressure setting up your remote working solution, circle back and have it reviewed. Make sure it is setup as securely as possible. So you don’t want these guys breaking in.

So that’s it for this week. Lets be careful out there and we’ll talk to you again next week.

www.L2CyberSecurity.com

www.twitter.com/L2Cyber

The post #WeekendWisdom 023 Coronavirus Cyber Threats appeared first on L2 Cyber Security Solutions Ltd..

1. Crisis scams: what to look for and how to protect against them
2. Remote working: what cyber risks do new home workers face
3. The Work From Home environment: securing your far flung assets

The slides for the webinar are available here.

Here is the presentation section of the webinar.

www.twitter.com/L2Cyber

The post Cyber Security Scams in the COVID19 era – webinar appeared first on L2 Cyber Security Solutions Ltd..

Yep! I’m Working from Home for the first time.

Now that the #COVID19 pandemic has truly gripped the planet, lots of employers are asking their employees to work from home. If you’re in the situation for the first time your employer probably has provided you with a laptop or a tablet, or some device to be able to do this work from home.

If they have done this they probably also have given you some kind of secure way of connecting into the company emails and into the company file data storage. Your IT support might also have given you guidance on things you need to do to keep that machine safe and secure while you’re working from home. So please do follow those guidelines.

So Working from Home and Data Protection, what do I gotta do?

But if you’re working with personal data you really, really want to be very careful about that device and how you use this device in your working from home environment. For example you might have younger people in the house and it can be very tempting to let them play with this device or use this device to access the internet, when you’re not working with it. You must resist that temptation because that device contains potentially sensitive data. You cannot let the young people get access to that data. It must be kept secure.

What about paper personal data?

Similarly if you were printing things at home and particularly if you’re printing sensitive personal data, so things like health information or religious, political persuasions, that type of information.

Sensitive Personal Data:

• Race/Ethnic origin
• Political Opinions
• Religious/Philosophical beliefs
• Trade Union Membership
• Physical/Mental Health
• Sexual Orientation/Sex Life
• Genetic data
• Biometric data

If you’re going to print that out at home you really need to be able to secure those printouts, those hard copies appropriately and as securely as it would be in the office. So you really shouldn’t want to be printing that stuff out.

So that’s it for this week. Let’s be careful out there and we’ll talk to you again next week.

www.L2CyberSecurity.com

www.twitter.com/L2Cyber

The post #WeekendWisdom 020 Working from Home and Data Protection appeared first on L2 Cyber Security Solutions Ltd..

Now that Coronavirus has been declared a pandemic, people are going to be having a sense of fear, uncertainty and doubt all across the world about this and how it might affect them and their families, which is understandable.

So what type of Coronavirus Scams are there?

This is what the criminals are going to try now and exploit. The desire for people to get more and more information about Coronavirus. So they will send out lots and lots of emails to everybody with links or buttons that you need to click or there will be documents or PDFs attached to those emails.

And they will be encouraging you to open these by saying “important information here from the WHO” or your national health organisation. And they’re expecting you to click on those and these will then compromise your computer.

So don’t fall for these type of information scams. Your national health organisation will probably communicate with you through the normal national media. So get your news from reputable sources.

Anything else?

Also there might be attempts to scam people who are in a work from home situation and that they’re out of their usual zone and they’re communicating in slightly different ways with their colleagues.

So you might end up receiving an email from a colleague with some instruction maybe to make a payment or again open an attachment that might be compromised. This email will come maybe from a personal email account and not the normal corporate email account.

So if you get instructions like that in a work from home environment, call that colleague and verify the instruction is valid.

So that’s it for this week. Let’s be careful out there and we’ll talk to you again next week.

www.L2CyberSecurity.com

www.twitter.com/L2Cyber

The post #WeekendWisdom 019 Coronavirus Scams appeared first on L2 Cyber Security Solutions Ltd..

Pandemic Preparation – extras for Business Continuity Planning:

So in a pandemic situation, there are three items that you might want to additionally consider over and above your normal business continuity planning.

1 – Availability of key personnel

The first one is the availability of key personnel. How would you be able to continue to provide goods and services to your clients if certain key personnel were unavailable due to illness?

2 – Reduced supplier capacity

Similarly your suppliers. If your suppliers are only producing at a reduced capacity, are you going to be able to continue to do what you need to do for your clients?

3 – Set client expectations

Thirdly, on that basis, you should probably talk to your clients about what your plans are for the production of your goods and services that they get from you.

What about the technology side:

From a technology perspective then, if you have to capability for staff to work from home and that will keep you going that’s great.

Test work-from-home technology

But you should really test that situation now, before things become a crisis. So perhaps have all your staff, some evening at home, they all access the systems at the same time. As if it was during the working day and then see if your systems can handle it.

Get staff comfortable with tools

if you’re using Microsoft Office 365 or Google Gsuite or other collaboration tools, they’re great for people working from home, but make sure your staff are comfortable using them. So get them to test them now, in the office and get comfortable with them.

Don’t use personal email

Don’t encourage staff to use personal email accounts for communicating in a work from home situation because there might be security and GDPR considerations there.

Watch out for “crisis” scams

And finally you want to make sure to watch out for additional scams that people might try to perpetrate in this time of crisis.

So that’s it for this week. Let’s be careful out there and we’ll talk to you again next week.

www.L2CyberSecurity.com

www.twitter.com/L2Cyber

The post #WeekendWisdom 018 Pandemic Preparation appeared first on L2 Cyber Security Solutions Ltd..