Where did this story start?

A few weeks ago, I was talking to some people about my favourite topic #Ransomware and I was explaining how ransomware goes through the process of encryption of all the data files that they can see. Somebody stopped me and asked me, what do I mean by encryption?

I was kinda surprised that the word wasn’t really better known out there, maybe its because of the industry I’m in.

What is Encryption?

Encryption at it’s most basic form is the scrambling of a set of data in conjunction with some kind of a key that will scramble the data make it unusable, you won’t understand what it is, unless you have the key which, whoever receives the data, they have the key, they can decrypt the data. Get it back to something that looks normal.

How does it work?

So what we talk about in the information security business:

1. you take plaintext, which is the stuff that you can read.
2. you apply the key to it, which generates ciphertext, which is what’s transmitted.
3. Anybody that gets the ciphertext, they won’t be able to understand it.
4. When it gets to the other side, the person uses the key and it decrypts the data and they get back to plaintext.

All very modern sounding.

This has been around for since ancient times. There was apparently some encryption found in some tomb in Egypt from like 1900 BC. So Encryption has been around a long time. It’s not just something new with computers.

So that’s it for this week. Lets be careful out there and we’ll talk to you again next week.

The post #WeekendWisdom 092 Encryption appeared first on L2 Cyber Security Solutions Ltd..

This sounds familiar

Back in #WeekendWisdom number 41, I talked about supply chain risks. Since then there have been a couple of massive global supply chain hacks that have occurred.

What are these supply chain hacks you speak of?

The first one was late last year. The SolarWinds hack was revealed. SolarWinds makes network monitoring software that are used by large corporates and government agencies.

But for my audience, which will be the more smaller business owner, something happened last week. A company called Kaseya, they provide software for IT managed service providers who obviously look after the IT for their customers which are usually small businesses. This software enables those managed service providers to be able to remotely manage and control their client’s devices.

What happened with the Kaseya hack?

Well Kaseya were hacked and had their client’s devices were ransomed by the REvil ransomware gang. Now REvil claim that they have infected a million devices around the globe and they’re looking for $70 million to free up these devices. The whole story is still playing out, so we don’t know the full details of it yet.

What can you do about this type of risk?

But how would you, as a small business owner, be able to try and protect yourself from such a supply chain hack?

Well you really do need to make sure that any third party that is going to put some kind of service or device or software into your network, into your environment, to carry out a full, thorough due diligence on that supplier and their application.

If you don’t have the capability in-house, there’s plenty of people out there in the market and in the business that will be able to provide you with an independent assessment.

So that’s it for this week. Lets be careful out there and we’ll talk to you again next week.

The post #WeekendWisdom 086 Supply Chain Hacks appeared first on L2 Cyber Security Solutions Ltd..

What are distributed denial of service attacks?

A denial of service attack is where a bad actor will use some thing to deny you access to some other service. So for example, a ransomware incident, is where the criminals, they are using ransomware to deny you access to the service of your computers.

A distributed denial of service attack is slightly different in that the criminals are going to use many, many, many thousands of devices that they control that are called bots and they’re all in this kind of thing that they call a botnet.

What can a botnet do?

It is then used to target an online service or application that your business depends on. Thus they flood it with requests which therefore then drowns out any legitimate requests that you’re trying to put there to make use of that service.

So how can you prevent this type of thing?

Well usually your internet service provider or your application service provider may have some facilities that they can use that control these type of distributed denial of service attacks. So you should contact them if you are in such a situation. It costs money but it’s well worth it if you want to get access back to your online service.

You can refer back to #WeekendWisdom number 76 where I talked about connecting cheap devices to the internet which don’t have really good security on them and these are usually the devices that make up these botnets.

So that’s it for this week. Lets be careful out there and we’ll talk to you again next week.

The post #WeekendWisdom 084 Distributed Denial of Service Attacks appeared first on L2 Cyber Security Solutions Ltd..

This is a quick HSE Ransomware Update

At the time of recording, we’re just one day shy of it being 5 weeks since we learned of the devastating impact of the HSE ransomware incident. To all of those experts that were on TV, Radio, Newspapers and other online media who were saying “Just pay the ransom and we’ll get back up and running.”

Here we are 5 weeks later and they’re still not back up and running. That’s even with them getting the key to decrypt the data within 3 days of the incident. So even having the key, it’s taking them so much longer to recover.

Why is it taking so long?

This is because the HSE has huge, vast quantities of data that needs to be checked and made sure the integrity is perfect. Because you don’t want your health records to be damaged in anyway, do you? I certainly wouldn’t. So they have to be so very careful with getting the data back.

What hope does a small business owner have?

For smaller businesses, which is where more my focus would be, things can be a lot simpler. It can be a lot easier for you to be able to recover from these type of ransomware incidents, if you put in place a decent backup strategy. I am happy to talk to any small business owner that needs any kind of assistance in making sure they have good backups in place.

So that’s it for this week. Lets be careful out there and we’ll talk to you again next week.

The post #WeekendWisdom 083 HSE Ransomware Update appeared first on L2 Cyber Security Solutions Ltd..

What is Ransomware?

Ransomware is malicious software that will scramble all of the files that it can find on your device, on your network, even in the cloud and it will look for money to unscramble the data from you, probably through using some kind of virtual currency like a Bitcoin.

How does it get in?

It can get in through a phishing email. Through somebody opening an attachment that contains malicious software or by clicking a link which takes you to a website that can download malicious software. It can also happen outside of your control by the criminals probing at any kind of remote access service that you have on your network. These can be penetrated and if they are, they can get into your network and they will scramble all of your data that they can see and it will also likely steal data from you beforehand and use that as a further leverage to get more money out of you for not revealing that data.

How can I protect myself?

It is possible to defend against ransomware by taking these following steps:

1. You should only be using currently supported, up-to-date versions of software.
2. You should use some kind of anti-virus or anti-malware software.
3. Your staff should receive regular security awareness training so that they can recognise dodgy emails that will contain links or attachments that could compromise your setup.
4. You should also make sure that any remote access capabilities that you have is kept fully up-to-date and is well hardened.

How can I prevent having to pay?

Backups are by far the best way to recover from a ransomware incident. I always recommend that small businesses use the 3-2-1 backup methodology. That is:

• Having three copies of your data, one copy being your live version
• Having two copies on separate media such as an external hard drive or the cloud and
• One copy is off-site and one copy is offline

It is the offline copy that will help you recover from ransomware.

The other thing with backups is you must test your backups, because you don’t have a backup until you know it works. So

TEST.

YOUR.

BACKUPS!

How can L2 Cyber Security help you?

We offer a full range of training programmes, which can be delivered online or in-person*.

L2 Cyber Security are also a partner of CyberRiskAware for online self-directed Cyber Security Awareness training and Phishing testing.

Contact us for more information at info@L2CyberSecurity.com.

*With appropriate social distancing and other health and safety measures adhered to.

Follow us on Social media:

Liam is available on Twitter, LinkedIn and Instagram.

Follow L2 Cyber on Twitter, LinkedIn, Instagram and Facebook.

© L2 Cyber Security Solutions

The post Cyber Security Basics Ransomware appeared first on L2 Cyber Security Solutions Ltd..

My favourite subject – NOT!

I touched on this back in #WeekendWisdom number 043, but just this week I’ve seen some posts from IT people and I was also on a webinar this week where there was an IT person that claimed they have cybersecurity skills and they all implied that if you get hit with ransomware that if you just paid the ransom you will be back in business. If you hear somebody say that to you, do not believe them because it is completely false! It is totally wrong! They are lying to you!

What is the reality in dealing with Ransomware?

First of all if you do manage to pay the ransom and get your data back, it will take a long time to recover your data, to decrypt all that stuff that’s been encrypted.

But you might not get your data back at all after paying it. They might not give you the key.

Even if you do get your data back some of it may be corrupted. Particularly if you have large databases.

But even still, if you get the data back, you still have to go through an exercise of sanitizing your complete infrastructure to make sure you remove all traces of the ransomware and any other infections they may have left behind. Any kind of back doors.

A lot of time and effort will be required to recover from a ransomware incident.

What should you do?

So if some IT service person says to you “Ah yeah. Pay the ransom. You’ll be grand” They’re lying. Walk away from them. They haven’t a clue what they’re talking about.

What you really need to have in place folks, is have a good backup strategy which is tested. Also have in place incident handling procedures, which you again need to test. Having them in place will help you recover from such an incident much more quickly and easily.

So that’s it for this week. Lets be careful out there and we’ll talk to you again next week.

How can L2 Cyber Security help you?

We offer a full range of training programmes, which can be delivered online or in-person*.

L2 Cyber Security are also a partner of CyberRiskAware for online self-directed Cyber Security Awareness training and Phishing testing.

Contact us for more information at info@L2CyberSecurity.com.

*With appropriate social distancing and other health and safety measures adhered to.

Follow us on Social media:

Liam is available on Twitter, LinkedIn and Instagram.

Follow L2 Cyber on Twitter, LinkedIn, Instagram and Facebook.

© L2 Cyber Security Solutions

The post #WeekendWisdom 078 Dealing with Ransomware appeared first on L2 Cyber Security Solutions Ltd..

What happened to the QNAP devices?

Last week the software that runs on QNAP Network Attached Storage devices, or also known as NAS boxes, had a vulnerability in them that was exploited. It was in particular targeting the QNAP boxes that were connected to the internet, that their contents could be accessed anywhere on the internet. What happened was the vulnerabilities exploited by some bad guys who ransomwared all the contents on those devices and looked for money to get the data back.

Are there any other things that could be at risk?

This put me in mind that lots of these NAS boxes and other smart home devices they make it very easy for people to connect them up to their home networks or to their office networks and then connect to them, over the internet through their internet connection and through their firewalls. But the way these things are making it so easy to do that means that they may not be done in as secure a manner as is possible. This was just an example, that these boxes were being taken over and ransomed.

But you want to be connecting devices to the internet

So if you have got in place cheap CCTV cameras or other smart home devices or NAS boxes that are connected to the internet, that if you can access it from anywhere outside of your home or your office, you might want to take a review of how securely that is set up, because it’s possible that these can be compromised and the bad guys can get in to your network through these devices.

So that’s it for this week. Lets be careful out there and we’ll talk to you again next week.

How can L2 Cyber Security help you?

We offer a full range of training programmes, which can be delivered online or in-person*.

L2 Cyber Security are also a partner of CyberRiskAware for online self-directed Cyber Security Awareness training and Phishing testing.

Contact us for more information at info@L2CyberSecurity.com.

*With appropriate social distancing and other health and safety measures adhered to.

Follow us on Social media:

Liam is available on Twitter, LinkedIn and Instagram.

Follow L2 Cyber on Twitter, LinkedIn, Instagram and Facebook.

© L2 Cyber Security Solutions

The post #WeekendWisdom 076 Connecting Devices to the Internet appeared first on L2 Cyber Security Solutions Ltd..

What’s the story this week?

Earlier this week the FBI’s cyber crime bureau, called IC3, issued their annual report which covered cyber crime in 2020.

Now I was looking at the value of the cyber crimes that have been reported to the FBI and the top two remain the usual suspects of Business Email Compromise or CEO fraud and Confidence or Romance scams. They’re still the top two.

What kind of figures are we looking at?

But I was looking at the figure for Ransomware and I was comparing it back to previous years and you can see here, I have a table which shows that you can see, from the last 2 years that:

• The Business Email Compromise/CEO fraud was an increase of 44%, to 1.86 billion dollars.
• Confidence/Romance fraud was an increase of 66% to 600 million dollars.
• Ransomware, it grew in the last 2 years by over 700%.

Wow! That is a Rapid Rise of Ransomware.

So that is just a massive increase. Now the figure here reported at 29 million isn’t really large. But then again not everybody reports ransomware. Also those figures will not take into account any recovery costs involved in getting back to operation after you’ve paid a ransom or you’ve had a ransomware incident. So there’s a lot more costs that are included in Ransomware that aren’t reported here.

So that’s it for this week. Lets be careful out there and we’ll talk to you again next week.

How can L2 Cyber Security help you?

We offer a full range of training programmes, which can be delivered online or in-person*.

L2 Cyber Security are also a partner of CyberRiskAware for online self-directed Cyber Security Awareness training and Phishing testing.

Contact us for more information at info@L2CyberSecurity.com.

*With appropriate social distancing and other health and safety measures adhered to.

Follow us on Social media:

Liam is available on Twitter, LinkedIn and Instagram.

Follow L2 Cyber on Twitter, LinkedIn, Instagram and Facebook.

© L2 Cyber Security Solutions

The post #WeekendWisdom 071 The Rapid Rise of Ransomware appeared first on L2 Cyber Security Solutions Ltd..

The year in Ransomware:

2020 started out with a number of #Ransomware incidents that were occurring over the New Year period. Ransomware became a greater threat throughout the year, with increased demands by the criminals looking to extort from their victims. So I continue to hopefully offer advice and guidance to you, on how you can protect your business from these threats.

The end of Windows 7:

We also saw the end of support for Windows 7. So if you’re continuing to use a #Windows7 machine in your organisations, you really need to get off that platform and move on to the more recent Windows 10 or other operating systems.

The COVID-19 Pandemic:

And of course 2020 brought us the biggest news of all with the #COVID19 pandemic. I provided lots of advice and guidance on how you can get your staff working from home safely and securely. Protecting both themselves and your business from the threats that were out there.

The Zoom Bombing phenomenon:

And one of those threats of course was #ZoomBombing, which I dedicated an entire video to, on how you can protect yourself from that.

All the rest in the Review of 2020:

There’s lots of other little bits and nuggets of information which I thought were maybe interesting and useful. I hope you found them similarly and I hope to continue to provide these to you in 2021.

Happy Christmas:

So with that, I would just like to wish you and yours the very happiest of Christmases and I hope you have a safe and secure New Year.

So that’s it for this year. Let’s be careful out there and we’ll talk to you again next year.

How can L2 Cyber Security help you?

We offer a full range of training programmes, which can be delivered online or in-person*.

L2 Cyber Security are also a partner of CyberRiskAware for online self-directed Cyber Security Awareness training and Phishing testing.

Contact us for more information at info@L2CyberSecurity.com.

*With appropriate social distancing and other health and safety measures adhered to.

Follow us on Social media:

Liam is available on Twitter, LinkedIn and Instagram.

Follow L2 Cyber on Twitter, LinkedIn, Instagram and Facebook.

© L2 Cyber Security Solutions

The post #WeekendWisdom 059 A Review of 2020 appeared first on L2 Cyber Security Solutions Ltd..

OK. Who wasn’t securing backup servers?

Earlier this week I was reading a story about a large Canadian second-hand car business which had a data breach involving some 260,000 users. What had happened was that they had a backup server that wasn’t appropriately secured. People were able to get onto that backup server and download the data of all these users.

Basically that business did not appropriately secure the backup server. Maybe they thought “It’s a backup server it doesn’t need that much protection.” But think about it. A backup server is going to have a lot of your production data.

So what does it need to set to?

So the backup server needs to have the same level of security if not more so than your primary servers. Make sure that they are properly secured.
Also with backups, I would also highly recommend having offline copies of the backups. Just in case that backup server ever gets damaged in any way by ransomware. So it’s important to back those up offline as well.

Is that all?

No. It’s not just backup servers that you need to take consideration of. Things like development servers or test servers. If you have some of those in your environment, they should have appropriate protections on there as well, because maybe they have some test data with actual personal data on them too. So ask your IT or your development team “Have you put appropriate protections in place on these servers?”

So that’s it for this week. Let’s be careful out there and we’ll talk to you again next week.

How can L2 Cyber Security help you?

For small business, we can carry out assessments on your server infrastructure and point out discrepancies on the security configurations.

We offer a full range of training programmes, which can be delivered online or in-person*.

L2 Cyber Security are also a partner of CyberRiskAware for online self-directed Cyber Security Awareness training and Phishing testing.

Contact us for more information at info@L2CyberSecurity.com.

*With appropriate social distancing and other health and safety measures adhered to.

Follow us on Social media:

Liam is available on Twitter, LinkedIn and Instagram.

Follow L2 Cyber on Twitter, LinkedIn, Instagram and Facebook.

© L2 Cyber Security Solutions

The post #WeekendWisdom 046 Securing Backup Servers appeared first on L2 Cyber Security Solutions Ltd..