Category: IT Security

Consider IT, is thrilled to announce its recent achievement as an NCSC (National Cyber Security Centre) Assured Service Provider for Cyber Essentials. This remarkable milestone makes Consider IT the one of the first Managed Service Providers in Scotland to obtain this prestigious certification, and the third Scottish company overall.

The NCSC Assured Service Provider scheme provides organisations with a means to assess and demonstrate their cybersecurity posture to clients and stakeholders. By undergoing a rigorous evaluation process, Consider IT has proven its commitment to delivering top-notch cybersecurity services, offering clients the confidence and peace of mind that their sensitive data and systems are protected with the highest level of expertise.

The certification process involved a comprehensive assessment of Consider IT’s cybersecurity practices, infrastructure, and policies. The evaluation was conducted by the NCSC, the UK government’s authority on cybersecurity, which recognised the company’s exceptional dedication to maintaining robust security measures.

At the forefront of this achievement is Consider IT’s Head of Cybersecurity, Andy Maclaren. His extensive experience, deep knowledge of cybersecurity best practices, and dedication to ensuring the highest standards have been instrumental in successfully steering the company through the assessment process. Andy’s expertise has been formally acknowledged and validated by the NCSC scheme, further solidifying Consider IT’s position as a trusted and reliable cybersecurity partner.

“We are incredibly proud to be one of the first Managed Service Providers in Scotland to receive the NCSC Assured Service Provider certification. This achievement is a testament to our team’s unwavering commitment to cybersecurity excellence,” said Stuart Gilbertson, Managing Director of Consider IT. “Our clients can trust that their cybersecurity needs are in the hands of experts who prioritise the safety and protection of their digital assets.”

Consider IT’s focus on continuous improvement and staying ahead of the ever-evolving cybersecurity landscape has enabled them to achieve this coveted status. The company remains committed to delivering exceptional cybersecurity services that align with the industry’s highest standards.

About Consider IT:

Consider IT is a leading Managed Service Provider headquartered in Edinburgh. The company offers a comprehensive suite of IT and cybersecurity solutions tailored to meet the unique needs of its diverse clientele. With a team of dedicated experts and a commitment to excellence, Consider IT has earned a reputation for providing reliable, innovative, and secure IT services.

As cyber threats continue to evolve, businesses must prioritise cybersecurity to safeguard their data and operations. Cyber Essentials, a vital cybersecurity certification scheme developed by the UK government, offers a solid foundation for organisations seeking to strengthen their cyber resilience. In this article, we will explore the five main technical controls involved in Cyber Essentials and examine relevant statistics from the UK government’s Cyber Security Breaches Survey 2023. Additionally, we’ll highlight the importance of engaging with reputable cybersecurity experts, such as Consider IT, to navigate the certification process effectively.

Secure Configuration

Secure configuration serves as a crucial defence against cyberattacks. Ensuring that systems, devices, and software are configured securely helps prevent vulnerabilities. To ensure secure configurations organisations should adopt a comprehensive approach. Firstly, conducting regular security audits and vulnerability assessments is crucial to identify weaknesses and address them promptly. Enforcing strong password policies and using multi-factor authentication adds an extra layer of protection, as passwords form the first line of defence against unauthorised access to systems and sensitive information. According to the Cyber Security Breaches Survey 2023, in 2021, 79 percent of surveyed organisations reported implementing password policies. However, this figure experienced a concerning decline to 70 percent in 2023. This trend underlines the need for organisations to reinforce their password policies, and assess their cyber security strategies to safeguard against potential breaches.

Boundary Firewalls and Internet Gateways

Network firewalls act as essential gatekeepers, preventing unauthorised access to private networks and reducing the risk of cyber intrusions. In 2021, 78 percent of surveyed organisations had implemented network firewalls, but this figure declined to 66 percent in 2023. This downward trend highlights the urgency for businesses to prioritise network security, fortifying their defences against cyber threats seeking to exploit network weaknesses.

Access Control

Access control involves managing user accounts and permissions to ensure that only authorised individuals have access to systems, data, and services. It includes measures such as using strong passwords, implementing multi-factor authentication, and regularly reviewing and revoking access rights. In 2021, 75 percent of organisations acknowledged restricting admin rights effectively, but this number dropped to 67 percent in 2023. Many businesses who do not implement proper access control cite issues such as resource constraints, organisational culture, the assumption of safety or convenience for employees to make updates to their own machine. Don’t fall victim to cyber attacks for the sake of convenience or assumed safety – bad actors count on that!

Malware Protection

Protecting systems against malware is critical to prevent malicious software from infiltrating and disrupting operations. Malware can find its way onto your systems in a number of ways. Your employees might unknowingly download malicious attachments from emails, fall victim to deceptive links leading to infected websites, or download software from unreliable sources that contains hidden malware. Visiting compromised websites or clicking on malicious ads can also trigger drive-by downloads. Social engineering tactics can be employed to deceive you into downloading and running malware. Even seemingly harmless USB devices can spread infections. Additionally, outdated software with known vulnerabilities can be exploited by cybercriminals. To safeguard your system, make sure your staff receive regular security training, use reputable antivirus software, stay updated with the latest patches, exercise caution with email and downloads, and avoid untrusted sources. Regular data backups are also crucial for added protection.

The government cyber breaches survey highlighted a decline in organisations using malware protection, with only 71 percent deploying this control in 2023, compared to 78 percent in 2021. Make sure your business doesn’t become a casualty.

Patch Management

Applying software security updates promptly is crucial in addressing known vulnerabilities and protecting systems from cyber threats. Alarming statistics from the Cyber Security Breaches Survey 2023 indicate that only 31 percent of organisations managed to apply software security updates within 14 days in 2023, as compared to 43 percent in 2021. The decline in timely updates exposes businesses to potential exploits that cybercriminals frequently target.

Why do you need Cyber Essentials?

In a rapidly evolving digital landscape where cyber threats loom large, safeguarding your organisation’s data and systems is of utmost importance. Cyber Essentials provides a foundational cybersecurity framework that can bolster your cyber health significantly. With recent statistics from the UK government’s Cyber Security Breaches Survey 2023 indicating a decline in the adoption of essential technical controls, now is the time for companies to take proactive steps to protect their assets.

To ensure your organisation’s compliance and certification in Cyber Essentials, consider partnering with Consider IT – a trusted and experienced cybersecurity services provider. Consider IT is committed to empowering businesses with robust cybersecurity measures, and we specialise in helping companies achieve Cyber Essentials certification efficiently. As one of the only Scottish Managed Service Providers (MSPs) that are IASME certified, Consider IT brings a wealth of knowledge and expertise to the table, providing comprehensive solutions tailored to your unique business needs.

Get in touch today.

Cyber security measures are constantly evolving, and it is vital to remain ahead of new challenges and threats that continuously arise. In order to safeguard your organisation, a comprehensive and resilient IT security system is your first line of defence. 

The Ukraine War, energy crisis and economic uncertainty have led to a surge in cyber threats. By exploiting these fears, opportunistic cyber criminals entice people to unwittingly open a backdoor to access your IT systems. In doing so, they wreak havoc across your organisation as well as potentially any third parties you deal with. Thus, damaging your organisation and your organisation’s reputation.  

The best protection is awareness, education and IT support. That’s why our team has compiled a list of the five most common cyber security threats to be aware of and how to protect against cyber-attacks.  

Here are the top 5 threats to cyber security: 

1 Malware and ransomware 

What is malware and ransomware? 

Malware is a type of software that is designed to exploit vulnerabilities, damage and destroy computers and computer systems. Examples of common malware include viruses, worms, Trojan viruses, spyware, adware, and ransomware. 

Let’s talk about Ransomware in more detail. It is a type of malware that encrypts your data, holds it hostage and then demands a ransom to decrypt your own data. In some cases, ransomware will also threaten to delete your data if you don’t pay the ransom within a certain period. 

How does malware and ransomware work? 

Malware can be spread via dangerous links, downloads, or attachments that, when clicked, download malicious software into a computer or infect a website. 

Once malware has been installed on a computer, it can have a variety of devastating effects, including corrupting files, stealing personal information, and rendering the computer unusable. 

As stated earlier cyber threats are continually evolving and ransomware attacks are on the rise and show no signs of slowing down.  

How to protect against malware and ransomware? 

There are steps you can take to protect your organisation from malware and ransomware attacks including: 

1. Keep your computer and software updated 
2. Think twice before clicking links or downloading anything 
3. Be careful about opening email attachments or images 
4. Don’t trust pop-up windows that ask you to download software 
5. Limit your file-sharing 
6. Use reputable antivirus software 
7. Back up data to allow access even if the data has been maliciously encrypted 

2 Phishing 

What is a phishing attack? 

A phishing attack is a type of electronic cyber-attack that targets a broad audience and is used to steal user data such as login credentials and credit card numbers. They can also be used to install malware on a victim’s device.  

How does phishing work? 

A phishing attack preys on human error. It occurs when an attacker, disguised as trusted entity such as your bank, energy supplier or government body, tricks a victim into sharing sensitive data by enticing them to open an email, instant message, or text message. 

How to protect against phishing? 

To protect your organisation from phishing attacks, it is important all employees are aware of the warning signs that an email or other forms of electronic messages may be malicious. Advise staff never to click on links or open attachments from unknown senders. If they suspect that someone in the organisation has been the victim of a phishing attack, then immediately contact IT support. 

3 Man in the middle attacks 

What are man-in-the-middle attacks? 

A ‘man in the middle attack’ is a cyber security threat in which a hacker secretly intercepts a communication between two parties. These types of cyber-attacks are becoming increasingly common as cyber criminals are rapidly evolving and finding new and clever ways to exploit vulnerabilities in networks. 

How does a man-in-the-middle attack work? 

Interrupting the connection, the hacker assumes the identity of one of the users and relays messages between the two parties who believe they are communicating with each other – this is known as ‘eavesdropping’.  By ‘eavesdropping’ a cyber-criminal can control the conversation enabling them to steal or alter the data being exchanged.  

How to protect against man-in-the-middle attacks? 

To protect against man-in-the-middle attacks, it is important to: 

• strongly encrypt traffic between the network and devices using browsing software  
• verify the identity of the parties involved in a communication 
• always make sure sites accessed are secure 

4 SQL injections 

What are SQL injections? 

SQL injections are an extremely serious form of cyber-security threat in which malicious code is inserted into a server using SQL, the Server Query Language. The malicious code can force the server to reveal confidential data or take other action. 

How does a SQL injection work? 

The malicious code, from an untrusted source, can force the server to reveal confidential data or take other action. SQL injection attacks are most commonly the result of an attacker entering malicious code into an unprotected website comment or search box. This can allow an attacker to access data, modify and damage it or even destroy the website. 

How to protect against SQL injection? 

All companies maintaining websites should prevent attacks by ensuring that all user input is properly validated and that all SQL queries are executed with appropriate permissions. A good web developer should help protect from SQL injection by writing secure code that doesn’t allow for the injection of malicious code into an application to protect the site. 

5 Spear Fishing 

What is Spear Fishing? 

Spear phishing is a highly sophisticated form of phishing. Fraudulent emails are tailored to specific individuals and organisations to gain access to confidential data over a prolonged period.  

How does Spear fishing work? 

By impersonating a trusted sender, the ‘spear fisher’ can trick an individual into opening an infected link allowing the hacker to bypass security measures – like email filters and antivirus. Consequently, the cybercriminal gains access to an organisation’s network and data. This can kick off a chain of events that enable cyber criminals to break through small businesses weak security and open a gateway to hack into larger organisations.  

How to protect against spearfishing? 

Implementing training programs that educate employees about spear phishing and how to spot red flags such as misspellings or poor grammar will help prevent these types of attacks. Organisations should also implement advanced cyber security controls to detect and block spear fishing such as email filtering and virus scanning. 

Get in touch 

Find out how to protect your business from cyber security threats by contacting a member of our team today by emailing [email protected] or call 0131 510 0110.