Consider IT

Consider IT
Consider IT

Category: IT Security

Blog title The Importance of Cyber Security Awareness training on a blue and orange gradient background
February 28, 2024

The Importance of Cyber Security Awareness Training

Did you know that the leading cause of successful cyber attacks is attributed to human error? Unfortunately, the weakest link in your security chain comes down to mistakes by the people who work in your business. That’s why it is really important to train your staff regularly about how to spot a potential cyber attack, and the different tactics cyber criminals use to exploit human error. 

Types of Human Error Exploited by Cyber Criminals:

Phishing Attacks:

Among the most common tactics, phishing attacks involve tricking individuals into revealing sensitive information, such as login credentials or financial details. Up to 91% of  successful  data breaches start with a phishing attack. Cyber criminals often use deceptive emails, messages, or even phone calls to manipulate employees into clicking on malicious links or downloading infected attachments. As part of your cyber security training, simulating phishing attacks to see if anyone takes the bait is a good way to see if there is a need for further training.

Social Engineering, Impersonation, and domain spoofing:

Social engineering relies on manipulating employees to divulge confidential information. This could involve impersonating colleagues, using psychological tactics, or exploiting personal relationships to gain access to sensitive data.

One particularly insidious tactic that cyber criminals employ to exploit human trust is CEO domain spoofing. In this method, attackers edit email headers and content to make messages appear as if they are coming from your CEO or other high-ranking executives. These deceptive emails often request sensitive information, financial transfers, or access to secure systems. Given the perceived authority of the sender, employees may be more inclined to comply with the requests, unknowingly facilitating a cyber attack. Cyber security awareness training must specifically address CEO domain spoofing, emphasising the importance of verifying the legitimacy of unexpected requests, even if they appear to come from top executives. Awareness of this tactic is crucial for employees to remain vigilant and implement verification protocols to fend off potential threats originating from seemingly trusted sources within your organisation.

Weak Passwords:

81% of hacking related breaches are caused by weak or stolen passwords. Human tendencies to use weak passwords or reuse them across multiple platforms make it easier for cyber criminals to gain access to your systems. Cyber security awareness training should stress the importance of creating strong, unique passwords and implementing multi-factor authentication across the board.

Unsecured Devices:

With the rise of remote work, employees often use personal devices for professional purposes. Failure to secure these devices can expose your business to significant risks. Training programs should educate employees on the importance of device security, including regular updates, antivirus software, and secure Wi-Fi connections.

Lack of Awareness:

Many employees may be unaware of potential threats or the importance of cyber security best practices. Regular training sessions can bridge this knowledge gap, empowering employees to recognise and respond appropriately to potential threats.

Benefits of Cyber Security Awareness Training:

Reduced Risk of Data Breaches:

By equipping employees with the knowledge and skills to identify and report potential threats, you can significantly reduce the risk of data breaches and unauthorised access to your systems.

Improved Incident Response:

Cyber security training enhances employees’ ability to respond effectively to incidents, minimising the impact and preventing further harm.

Promotion of a Cyber-Aware Culture:

Fostering a culture of cyber security awareness promotes collective responsibility, encouraging employees to be proactive in safeguarding the business’ data.

About US:

Consider IT provides the full spectrum of IT & Communications services, including 24/7 support, strategic consultation, cloud and business continuity solutions, cyber security, compliance certification, procurement and more.

At Consider IT, we recognise that the human element plays a crucial role in boosting your cyber security. And so, as a standard practice, we provide our clients with regular cyber security training. Our training programs are designed to equip employees with the knowledge and skills necessary to spot and report an attempted cyber attack. By instilling a culture of cyber awareness, we empower your workforce to identify and mitigate potential risks, reducing the likelihood of falling victim to cyber criminals.

In addition to our commitment to education, Consider IT ensures that our clients are up to standard with Cyber Essentials baseline controls. These controls serve as a foundational framework, encompassing essential security practices that are crucial for mitigating common cyber threats. By implementing these controls, we help fortify your organisation against a wide range of potential risks. We’re the security behind great businesses!

Get in touch today to find out more, and get a free consultation.

February 28, 2024
0
Blog title Consider It achieves ISO 22391 and ISO 20000-1 accreditations on a blue and orange gradient background image
December 14, 2023

Consider IT Achieves Prestigious ISO 22301 and ISO 20000-1 Certifications for Business Continuity and IT Service Management

We are thrilled to announce a significant milestone for Consider IT – the successful achievement of two prestigious certifications: ISO 22301 for Business Continuity Management and ISO 20000-1 for IT Service Management. Colin Gilbertson, Head of Operations at Consider IT commented:

“This achievement reflects Consider IT’s ongoing commitment to delivering high-quality IT Support and Cyber Security solutions, reinforcing our position as a trusted service provider.”

ISO 22301: The Gold Standard for Business Continuity

ISO 22301 is a globally recognised standard for Business Continuity Management Systems (BCMS), focusing on fortifying an organisation’s ability to respond effectively to disruptions. Unexpected events like natural disasters, cyber attacks or other unforeseen events, can cause major disruption to business operations.

This certification attests to our robust business continuity planning, risk management, and incident response capabilities. It provides both Consider IT, and our clients  with the confidence that we are equipped to navigate unforeseen challenges seamlessly, thereby minimising downtime and preserving the integrity of business processes during emergencies.

ISO 20000-1: Elevating IT Service Management

ISO 20000-1 is the international standard for IT Service Management (ITSM), emphasising the implementation of best practices to enhance the quality and efficiency of IT services. Achieving this certification highlights Consider IT’s commitment to delivering excellent IT services that align with global industry standards.

With ISO 20000-1, we assure our clients that our IT Service Management processes are meticulously designed and executed, promoting continuous improvement and ensuring the optimal performance of their IT infrastructure.

“This certification serves as a testament to our dedication to providing reliable, secure, and efficient IT services that empower both us as a business, and our clients.”

-Colin Gilbertson, Head of Operations

Why This Matters for You

For businesses in search of a dependable partner for IT Support and Cyber Security solutions, our achievement of ISO 22301 and ISO 20000-1 certifications distinguishes us in the field. These certifications reflect our commitment to a proactive approach in managing risks, safeguarding the resilience of our operations, and consistently providing top-notch IT services. These new achievements add to our collection of other coveted industry standards, including ISO 27001, CREST and Cyber Essentials Plus. Consider IT is also an IASME certifying body, meaning we can get your organisation up to scratch with Cyber Essentials controls, award the certificate, and ensure your continued compliance. To see a full list of our credentials, please visit our website here.

Our commitment to excellence extends beyond certifications; it is ingrained in our culture of continuous improvement and client satisfaction. Whether you seek reliable managed IT solutions, robust cyber security measures, or a combination of both, our experts are always here to help. Get in touch today to talk about how we can help your business.

December 14, 2023
0
Blog title The crucial role of two-factor authentication on a blue and orange gradient backgroud
November 24, 2023

Strengthening Cyber security Defences: The Crucial Role of Multi-Factor Authentication

Have you implemented multi-factor-authentication (MFA) across your organisation? While promoting the adoption of robust passwords is essential, the reality is that various vulnerabilities still exist. For example, employees using identical passwords across multiple platforms or storing sensitive information within their browser are common practices that pose potential risks. Consider the scenario where a laptop is lost or stolen—such a situation could easily lead to a compromise of your systems.

As technology advances, so do the tactics employed by cyber criminals. It is crucial for organisations to adopt robust cyber security measures to safeguard sensitive information and maintain the trust of their clients. At Consider IT, we recognise the significance of MFA as a core component of a comprehensive cyber security strategy, and we implement it as a mandatory element of our managed services. Here’s why.

The Rising Threat Landscape:

Cyber security threats have become more sophisticated, with attackers employing advanced techniques to exploit vulnerabilities and gain unauthorised access to confidential data. As a result, businesses are compelled to fortify their defences to protect against an array of threats, including phishing attacks, password breaches, and identity theft.

The Role of your IT provider:

Implementing multi-factor authentication is not just a recommended practice but a fundamental necessity in today’s cyber threat landscape. As trusted guardians of their clients’ digital infrastructure, IT providers (like Consider IT) recognise the critical importance of MFA. By integrating this additional layer of security into the systems they manage, IT providers enhance identity verification, mitigate the risks associated with password vulnerabilities, and fortify against evolving cyber threats. If your IT provider hasn’t mentioned MFA to you, you should ask them why.

Understanding Multi-Factor Authentication:

Multi-factor authentication adds an extra layer of security by requiring users to provide two forms of identification before granting access to sensitive systems or data. Typically, this involves something the user knows (e.g. a password) and something the user has (e.g. a mobile device or a security token). This additional layer of authentication significantly reduces the risk of unauthorised access, even if passwords are compromised.

Enhanced Security with MFA:

Consider IT advocates for the widespread adoption of MFA as a powerful tool to mitigate the risks associated with single-factor authentication. Passwords alone are no longer sufficient to protect against determined cyber criminals. MFA acts as a robust deterrent, adding an extra barrier that significantly reduces the likelihood of unauthorised access, even in the event of compromised credentials.

Benefits of Multi-Factor Authentication:

Improved Identity Verification:

MFA ensures that users are who they claim to be, offering a higher level of confidence in identity verification. This is crucial in preventing unauthorised access to sensitive systems and data.

Mitigation of Credential-Based Attacks:

Password breaches are a common method employed by cybercriminals. MFA reduces the impact of compromised passwords by requiring an additional form of authentication, preventing unauthorised entry.

Enhanced Remote Security:

With the rise of remote work, securing access to corporate systems from various locations is paramount. MFA provides an additional layer of protection, reducing the risk of unauthorised access from external networks.

Compliance Requirements:

Many industry regulations and compliance standards mandate the use of multi-factor authentication to protect sensitive information. Extra protections help you avoid potential legal and financial repercussions.

About Consider IT

Consider IT, as a forward-thinking IT support and cyber security provider, knows the importance of integrating two-factor authentication into the core of a business’s cyber security strategy. In an era where cyber threats are ever-evolving, embracing robust measures like MFA is crucial to safeguarding sensitive information, maintaining trust, and ensuring long-term security and success.

Additionally, Consider IT offers a comprehensive suite of cyber security services designed to fortify your digital infrastructure against evolving threats. Our expert team specialises in Cyber Essentials, ensuring your organisation adheres to essential cyber security standards. We conduct thorough penetration testing to proactively identify and address vulnerabilities in your systems, while our vulnerability assessments provide a comprehensive overview of potential risks. In the event of a security incident, our rapid and effective incident response ensures minimal impact on your operations. Committed to industry best practices, Consider IT holds multiple cyber security accreditations, including Cyber Essentials Plus and CREST. For a detailed overview of our certifications and a deeper understanding of how we can safeguard your digital assets, please visit our website here.
If you’d like to learn more about our Cyber and Managed IT services, please get in touch today for a chat with our friendly team.

November 24, 2023
0
CS awareness month (1)
October 11, 2023

Have you considered your Cyber Security defences this Cyber Security Month?

Have you thought about your cyber security lately? If you haven’t, you just need to take one glance at the news to see why you should. Cyber attacks are on the increase, and many companies are falling victim to the ever increasing problem. Just last week, we saw the tragic downfall of KNP Logistics Group, a haulage company with a 158 year legacy falling victim to a vicious ransomware attack. The June 2023 attack ultimately resulted in the company’s administration and the loss of 730 jobs. In the same week, the Royal Family were even targeted when their website was temporarily taken down by Russian hackers. No one is immune to cyber attacks, but there are ways that you can strengthen your defences against them. Now is the perfect time to explore essential strategies to safeguard against cyber threats as we observe Cyber Security Month this October. 

The Business Imperative for Cyber Security Awareness

Protecting Sensitive Data: As a business, you store vast amounts of sensitive data, including customer information, intellectual property, and financial records. A data breach not only jeopardises this critical information but also damages your reputation and finances.

Regulatory Compliance: Many industries are subject to strict data protection regulations, such as GDPR in Europe or HIPAA in the healthcare sector. Non-compliance can result in hefty fines and legal consequences.

Financial Impact: Cyber attacks can lead to direct financial losses due to theft, ransom payments, or business interruption. Additionally, the costs associated with investigating and mitigating an attack can be substantial.

Reputation Management: A cyber security incident can destroy customer trust and confidence. Your business may find it challenging to regain your reputation even after addressing the breach.

Strategies to secure your business this Cyber Security Awareness Month

Conduct Risk Assessments: Begin by assessing your organisation’s cyber security risks. Identify vulnerabilities, and the most critical assets that need protection. Specialist IT providers such as Consider IT can carry these out for you.

Develop a Cyber security Policy: Create a comprehensive cyber security policy that outlines best practices, employee responsibilities, incident response procedures, and compliance requirements. Ensure all employees are aware of and adhere to this policy.

Employee Training and Awareness: Invest in cybersecurity training for employees at all levels. Teach them how to recognise phishing attempts, practice safe password management, and report security incidents promptly.

Regular Updates and Patch Management: Keep all software, operating systems, and security tools up to date. Regularly apply patches and updates to address known vulnerabilities.

Implement Strong Access Controls: Limit access to sensitive data and systems to authorised personnel only. 

Secure Your Network: Invest in robust firewalls, intrusion detection systems, and encryption protocols to protect your network infrastructure from cyber threats.

Implement 2-factor Authentication: Add an extra layer of protection to your passwords to prevent unauthorised access to company data.

Data Backup and Recovery: Regularly backup critical data, and ensure that you have a tested and effective data recovery plan in place. This can be crucial in the event of a ransomware attack or data breach.

Incident Response Plan: Develop a well-defined incident response plan that outlines steps to take in the event of a cyber security incident.

Get Cyber Essentials Accredited: Add an extra layer of trust with your customers and stakeholders by getting Cyber Essentials Certified. Cyber Essentials is a government-backed scheme that ensures organisations adhere to fundamental cyber security principles, providing a crucial defence against common cyber threats

Consider talking to your IT Partner

At Consider IT, cyber security is our top priority. We are dedicated to assisting our clients in fortifying their digital defences to safeguard their sensitive information and operations. This Cyber Security Month, we invite you to reach out to us for a complimentary cyber security assessment. Consider IT is an IASME certifying body, and as such our expert team will work with you to achieve Cyber Essentials accreditation and compliance. Reach out today to learn more.

October 11, 2023
0
Ashley Madison data breach
August 30, 2023

Ashley Madison: How lax cybersecurity resulted in mass privacy violations

Have you watched the new documentary on the Ashley Madison scandal yet? If you haven’t, here’s the cliff notes, and the lessons that can be learned from this famous cyber attack.

This breach not only exposed the personal lives of millions but also ignited discussions on digital privacy, cybersecurity, and the ethical implications of such breaches.

Ashley Madison: who are they and what happened?

In July 2015, a group of hackers collectively known as “The Impact Team” targeted Ashley Madison, a dating website with the aim of connecting people who wish to step outside of their marriage and cheat on their partners.

The site promised users anonymity and security – promising to fuel your illicit affair with the ultimate privacy and secrecy. In fact, they went so far as to latch on to viral cheating scandals, with the message “Should have used Ashley Madison”, to highlight the safety of the site. This included Republican Mark Sandford – at the time he was the Governor of California and was running for Congress in a special election and his affair had previously been exposed. A billboard (right) was advertised with his face and the message “Next time use ashleymadison.com to find your ‘running mate’.”

To give users even more peace of mind, Ashley Madison  offered a “full delete” service. For the price of $19, all user information would be deleted from their servers – just like it never happened. However, that wasn’t quite true. Despite netting almost $1.7 million in 2014 for this feature, it didn’t quite work as advertised. While some data was indeed removed, things like credit card information with their full name and address, and other factors such as gps data, city, state, country, weight, height, date of birth, gender, ethnicity and sexual preferences were not – all of which may be enough to identify individuals.

Despite Ashley Madison’s declarations that finding your affair partner is much safer on their site, the hackers successfully infiltrated their security systems and obtained an extensive database containing user information, including names, email addresses, payment details, and even intimate fantasies. And how did they manage that? Well, it turns out that their cyber security measures left much to be desired. In fact, investigations showed that a disgruntled ex employee still had “uber-god” admin access to their systems, showing just how lax their security procedures were.

The hackers then threatened to publish the stolen data unless Ashley Madison and its affiliated site, Established Men, were shut down permanently. When the parent company, Avid Life Media, refused to comply, the hackers followed through on their threat, releasing sensitive user data in August 2015. This marked one of the most high-profile and consequential data breaches in history.

The fallout: Privacy Violations and Emotional Turmoil

The aftermath of the Ashley Madison breach was nothing short of catastrophic. The leaked data, which included personal details of over 30 million users, exposed countless individuals to public humiliation, ruined relationships, and damaged careers. The breach hit not only the users of the site but also their families, sparking heated debates about the ethics of hacking, cyberbullying, and the right to privacy in a digital age.

The breach had particularly severe consequences for public figures and individuals living in countries with conservative social norms, where extramarital affairs can lead to legal and societal repercussions. The emotional toll experienced by victims served as a stark reminder that data breaches have real-world ramifications beyond the digital realm. 

Many of the exposed users were then targeted by individuals who threatened to expose that they were part of the data leak to their family, friends and employer unless they paid a hefty ransom.

Some of these users ended their lives as a result of the breach, including a pastor of a small church.

Ashley Madison were also sued by a group of users who had been adversely affected by the breach, and they were ordered to pay $11.2 million in damages. The CEO, Noel Biderman also stepped down from his role at the end of August 2015. This breach was particularly embarrassing for him, as his full email inbox and shady business practices were released as part of the information dump.

Lessons Learned: Digital Privacy and Cybersecurity

The Ashley Madison data breach highlighted several critical lessons for individuals, companies, and policymakers alike:

Robust Security Measures: Companies handling sensitive user data must prioritise cybersecurity. Strong encryption, regular security audits, strong employee onboarding and offboarding procedures, and proactive measures to defend against potential attacks are imperative to safeguarding user information.

Incident Response Procedures: In this day and age cyber attacks are almost inevitable, but you can put measures in place to respond to threats quickly and efficiently. Having an incident response plan significantly reduces the risk to your business, and will help you bounce back quicker after experiencing a breach.

Transparent Data Handling: Transparency in data collection, storage, and usage is crucial. Users have the right to know how their information will be used and protected, fostering trust between companies and their customers.

User Education: Individuals must be educated about the risks of sharing personal information online and the potential consequences of data breaches. Practising good digital hygiene, such as using unique passwords and enabling two-factor authentication, can significantly reduce vulnerability.

Legal and Ethical Considerations: The breach highlighted the need for robust legal frameworks that address both hacking and the responsible use of leaked data. Ethical discussions around exposing sensitive information also gained prominence, raising questions about the role of hackers as vigilantes or villains.

How can you protect your company from a data breach?

While I’m sure your business isn’t quite as…questionable…. as the one highlighted in this article, the message remains the same – cyber breaches can not only harm you and your business, it can bring extreme harm to your customers. 

At Consider IT, cyber security is a top priority. We ensure all of our customers comply with the standards of Cyber Essentials so they are protected from any data breaches or cyber attacks – even if they don’t want the certification. Cyber Essentials is a UK government-backed cyber security certification scheme that sets out a baseline of technical controls for organisations of all sizes to protect themselves against common cyber threats. 

Consider IT is one of the few Information Assurance for Small and Medium Enterprises (IASME) certified bodies in Scotland, which means we can award the Cyber Essentials certification, and ensure you keep compliant. We offer end-to-end guidance and project management to make sure your cyber strategy is up to scratch. And if you need more peace of mind, we are also:

-A CREST accredited provider

-A trusted partner of the Cyber and Fraud Centre Scotland

-Members of the UK Cyber Security Council

-A National cyber Security Centre assured service provider

-ISO accredited in 27001, 14001, 9001

For a full list of our accreditations, visit our website here.

If you would like to know more about how we can help you get certified, get in touch today.

August 30, 2023
0
NCSC accreditation blog (2)
July 27, 2023

Consider IT Becomes One of the First in Scotland to Achieve NCSC Assured Service Provider Status

Consider IT, is thrilled to announce its recent achievement as an NCSC (National Cyber Security Centre) Assured Service Provider for Cyber Essentials. This remarkable milestone makes Consider IT the one of the first Managed Service Providers in Scotland to obtain this prestigious certification, and the third Scottish company overall.

The NCSC Assured Service Provider scheme provides organisations with a means to assess and demonstrate their cybersecurity posture to clients and stakeholders. By undergoing a rigorous evaluation process, Consider IT has proven its commitment to delivering top-notch cybersecurity services, offering clients the confidence and peace of mind that their sensitive data and systems are protected with the highest level of expertise.

The certification process involved a comprehensive assessment of Consider IT’s cybersecurity practices, infrastructure, and policies. The evaluation was conducted by the NCSC, the UK government’s authority on cybersecurity, which recognised the company’s exceptional dedication to maintaining robust security measures.

At the forefront of this achievement is Consider IT’s Head of Cybersecurity, Andy Maclaren. His extensive experience, deep knowledge of cybersecurity best practices, and dedication to ensuring the highest standards have been instrumental in successfully steering the company through the assessment process. Andy’s expertise has been formally acknowledged and validated by the NCSC scheme, further solidifying Consider IT’s position as a trusted and reliable cybersecurity partner.

“We are incredibly proud to be one of the first Managed Service Providers in Scotland to receive the NCSC Assured Service Provider certification. This achievement is a testament to our team’s unwavering commitment to cybersecurity excellence,” said Stuart Gilbertson, Managing Director of Consider IT. “Our clients can trust that their cybersecurity needs are in the hands of experts who prioritise the safety and protection of their digital assets.”

Consider IT’s focus on continuous improvement and staying ahead of the ever-evolving cybersecurity landscape has enabled them to achieve this coveted status. The company remains committed to delivering exceptional cybersecurity services that align with the industry’s highest standards.

About Consider IT:

Consider IT is a leading Managed Service Provider headquartered in Edinburgh. The company offers a comprehensive suite of IT and cybersecurity solutions tailored to meet the unique needs of its diverse clientele. With a team of dedicated experts and a commitment to excellence, Consider IT has earned a reputation for providing reliable, innovative, and secure IT services.

July 27, 2023
0
cyber essentials blog (1)
July 25, 2023

Enhancing Cyber Health Through 5 Main Technical Controls: A Cyber Essentials Overview

As cyber threats continue to evolve, businesses must prioritise cybersecurity to safeguard their data and operations. Cyber Essentials, a vital cybersecurity certification scheme developed by the UK government, offers a solid foundation for organisations seeking to strengthen their cyber resilience. In this article, we will explore the five main technical controls involved in Cyber Essentials and examine relevant statistics from the UK government’s Cyber Security Breaches Survey 2023. Additionally, we’ll highlight the importance of engaging with reputable cybersecurity experts, such as Consider IT, to navigate the certification process effectively.

Secure Configuration

Secure configuration serves as a crucial defence against cyberattacks. Ensuring that systems, devices, and software are configured securely helps prevent vulnerabilities. To ensure secure configurations organisations should adopt a comprehensive approach. Firstly, conducting regular security audits and vulnerability assessments is crucial to identify weaknesses and address them promptly. Enforcing strong password policies and using multi-factor authentication adds an extra layer of protection, as passwords form the first line of defence against unauthorised access to systems and sensitive information. According to the Cyber Security Breaches Survey 2023, in 2021, 79 percent of surveyed organisations reported implementing password policies. However, this figure experienced a concerning decline to 70 percent in 2023. This trend underlines the need for organisations to reinforce their password policies, and assess their cyber security strategies to safeguard against potential breaches.

Boundary Firewalls and Internet Gateways

Network firewalls act as essential gatekeepers, preventing unauthorised access to private networks and reducing the risk of cyber intrusions. In 2021, 78 percent of surveyed organisations had implemented network firewalls, but this figure declined to 66 percent in 2023. This downward trend highlights the urgency for businesses to prioritise network security, fortifying their defences against cyber threats seeking to exploit network weaknesses.

Access Control

Access control involves managing user accounts and permissions to ensure that only authorised individuals have access to systems, data, and services. It includes measures such as using strong passwords, implementing multi-factor authentication, and regularly reviewing and revoking access rights. In 2021, 75 percent of organisations acknowledged restricting admin rights effectively, but this number dropped to 67 percent in 2023. Many businesses who do not implement proper access control cite issues such as resource constraints, organisational culture, the assumption of safety or convenience for employees to make updates to their own machine. Don’t fall victim to cyber attacks for the sake of convenience or assumed safety – bad actors count on that!

Malware Protection

Protecting systems against malware is critical to prevent malicious software from infiltrating and disrupting operations. Malware can find its way onto your systems in a number of ways. Your employees might unknowingly download malicious attachments from emails, fall victim to deceptive links leading to infected websites, or download software from unreliable sources that contains hidden malware. Visiting compromised websites or clicking on malicious ads can also trigger drive-by downloads. Social engineering tactics can be employed to deceive you into downloading and running malware. Even seemingly harmless USB devices can spread infections. Additionally, outdated software with known vulnerabilities can be exploited by cybercriminals. To safeguard your system, make sure your staff receive regular security training, use reputable antivirus software, stay updated with the latest patches, exercise caution with email and downloads, and avoid untrusted sources. Regular data backups are also crucial for added protection.

The government cyber breaches survey highlighted a decline in organisations using malware protection, with only 71 percent deploying this control in 2023, compared to 78 percent in 2021. Make sure your business doesn’t become a casualty.

Patch Management

Applying software security updates promptly is crucial in addressing known vulnerabilities and protecting systems from cyber threats. Alarming statistics from the Cyber Security Breaches Survey 2023 indicate that only 31 percent of organisations managed to apply software security updates within 14 days in 2023, as compared to 43 percent in 2021. The decline in timely updates exposes businesses to potential exploits that cybercriminals frequently target.

Why do you need Cyber Essentials?

In a rapidly evolving digital landscape where cyber threats loom large, safeguarding your organisation’s data and systems is of utmost importance. Cyber Essentials provides a foundational cybersecurity framework that can bolster your cyber health significantly. With recent statistics from the UK government’s Cyber Security Breaches Survey 2023 indicating a decline in the adoption of essential technical controls, now is the time for companies to take proactive steps to protect their assets.

To ensure your organisation’s compliance and certification in Cyber Essentials, consider partnering with Consider IT – a trusted and experienced cybersecurity services provider. Consider IT is committed to empowering businesses with robust cybersecurity measures, and we specialise in helping companies achieve Cyber Essentials certification efficiently. As one of the only Scottish Managed Service Providers (MSPs) that are IASME certified, Consider IT brings a wealth of knowledge and expertise to the table, providing comprehensive solutions tailored to your unique business needs.

Get in touch today.

July 25, 2023
0
Ransomware attack
May 4, 2023

The City of Dallas ransomware attack: What can we learn?

According to media reports the City of Dallas has fallen victim to a ransomware attack that has affected several critical systems and services, including 911 emergency response, financial transactions, and public communications. The attackers, a group named “Royal Ransomware”, are believed to have gained access to the City’s systems via phishing attack.

Phishing attacks typically involve fraudulent emails, text messages or phone calls that appear to come from a reputable source (for example a subscription service) that can trick people into downloading malware to their device, or convince them to part with sensitive data such as credit card or bank account details. 

While the city’s IT team has responded quickly to isolate the affected systems, the attack has still caused significant disruption and inconvenience to residents and businesses. For part of the day, 911 call dispatchers had to manually write down call reports to pass to officers instead of using their automated dispatch system. Additionally, court systems went down, resulting in some jury trials being cancelled. In a media statement, officials confirmed the attack:

“”Wednesday morning, the City’s security monitoring tools notified our Security Operations Center (SOC) that a likely ransomware attack had been launched within our environment. Subsequently, the City has confirmed that a number of servers have been compromised with ransomware, impacting several functional areas, including the Dallas Police Department Website,”

“The City is currently working to assess the complete impact, but at this time, the impact on the delivery of City services to its residents is limited.”

There has been no indication as of yet if a ransom demand has been made.

What have we learned?

This incident highlights the importance of cybersecurity awareness, education, and resilience for all organisations, regardless of their size or sector. Here are some key takeaways from the Dallas ransomware attack:

Cyber threats are real and evolving

Ransomware attacks are a growing trend among cybercriminals, who use them to extort money from vulnerable targets. Organisations must stay informed about the latest threats and trends and implement appropriate security measures to reduce their risk exposure.

Regular vulnerability assessment is key

Organisations that don’t take stock of their cyber vulnerabilities leave themselves open to attack. Cyber criminals are a constant threat that need constant surveillance. Implementing systems to scan for vulnerabilities as they appear, regularly updating software and systems, and prioritising vulnerabilities by risk level makes it harder for criminals to access sensitive data.

Humans are the weakest link

Many cyber attacks exploit human errors and behaviour, such as clicking on suspicious links or downloading malware. Organisations must train their employees and contractors on how to detect and avoid cyber threats, and foster a culture of cyber security awareness and responsibility. Penetration testing with phishing simulation emails can help business leaders to assess where their team is in terms of cyber security awareness, so any training gaps can be plugged.

Backup and recovery are essential 

Even if an organisation falls victim to a ransomware attack, it can minimise the impact by having a reliable incident response plan. Regularly backing up critical data and testing the recovery process can help organisations restore their operations faster and avoid paying the ransom.

We can help

Find out how to protect your business from cyber security threats by contacting a member of our team today by emailing [email protected]

May 4, 2023
0
3cx hack blogl
March 30, 2023

3CX Desktop app compromised as hackers launch a supply chain attack

Consider IT will continue to monitor the situation as updates become available.

On the 29th of March malicious activity was detected as an illicit version of the 3CX VOIP desktop client has reportedly been used to target customers in a supply chain attack.

3CX’s customer list includes many high-profile companies such as American Express, Coca-Cola, McDonalds, BMW, Honda, AirFrance, NHS, Toyota, Mercedes-Benz, IKEA and HolidayInn.

Several antivirus vendors picked up the issue. The threat intel team from CrowdStrike said, “The malicious activity includes beaconing to actor-controlled infrastructure, deployment of second-stage payloads, and, in a small number of cases, hands-on-keyboard activity. “

Sophos added, “”The most common post-exploitation activity observed to date is the spawning of an interactive command shell”

The attack  is thought to have been launched by a nation-state related hacking group, but this cannot be confirmed as the situation is still unfolding.

What’s been done to combat the threat so far?

In an update, 3CX said the “issue appears to be one of the bundled libraries that we compiled into the Windows Electron app via git” and that it’s further investigating the matter. So far:

-Illicit domains have been taken down – domains contacted by the compromised library have been reported and the majority removed overnight

-New windows app in progress – 3CX are working on a new windows app that does not have the issue

-Customers have been advised to use the PWA App instead – the PWA app is completely web based and does 95% of what the electron app does

ConsiderIT have immediately taken action this morning to secure any customers using 3CX.

March 30, 2023
0
5 threats
February 13, 2023

5 Threats to your Cyber Security you need to consider 

Cyber security measures are constantly evolving, and it is vital to remain ahead of new challenges and threats that continuously arise. In order to safeguard your organisation, a comprehensive and resilient IT security system is your first line of defence. 

The Ukraine War, energy crisis and economic uncertainty have led to a surge in cyber threats. By exploiting these fears, opportunistic cyber criminals entice people to unwittingly open a backdoor to access your IT systems. In doing so, they wreak havoc across your organisation as well as potentially any third parties you deal with. Thus, damaging your organisation and your organisation’s reputation.  

The best protection is awareness, education and IT support. That’s why our team has compiled a list of the five most common cyber security threats to be aware of and how to protect against cyber-attacks.  

Here are the top 5 threats to cyber security: 

1 Malware and ransomware 

What is malware and ransomware? 

Malware is a type of software that is designed to exploit vulnerabilities, damage and destroy computers and computer systems. Examples of common malware include viruses, worms, Trojan viruses, spyware, adware, and ransomware. 

Let’s talk about Ransomware in more detail. It is a type of malware that encrypts your data, holds it hostage and then demands a ransom to decrypt your own data. In some cases, ransomware will also threaten to delete your data if you don’t pay the ransom within a certain period. 

How does malware and ransomware work? 

Malware can be spread via dangerous links, downloads, or attachments that, when clicked, download malicious software into a computer or infect a website. 

Once malware has been installed on a computer, it can have a variety of devastating effects, including corrupting files, stealing personal information, and rendering the computer unusable. 

As stated earlier cyber threats are continually evolving and ransomware attacks are on the rise and show no signs of slowing down.  

How to protect against malware and ransomware? 

There are steps you can take to protect your organisation from malware and ransomware attacks including: 

  1. Keep your computer and software updated 
  2. Think twice before clicking links or downloading anything 
  3. Be careful about opening email attachments or images 
  4. Don’t trust pop-up windows that ask you to download software 
  5. Limit your file-sharing 
  6. Use reputable antivirus software 
  7. Back up data to allow access even if the data has been maliciously encrypted 

2 Phishing 

What is a phishing attack? 

A phishing attack is a type of electronic cyber-attack that targets a broad audience and is used to steal user data such as login credentials and credit card numbers. They can also be used to install malware on a victim’s device.  

How does phishing work? 

A phishing attack preys on human error. It occurs when an attacker, disguised as trusted entity such as your bank, energy supplier or government body, tricks a victim into sharing sensitive data by enticing them to open an email, instant message, or text message. 

How to protect against phishing? 

To protect your organisation from phishing attacks, it is important all employees are aware of the warning signs that an email or other forms of electronic messages may be malicious. Advise staff never to click on links or open attachments from unknown senders. If they suspect that someone in the organisation has been the victim of a phishing attack, then immediately contact IT support. 

3 Man in the middle attacks 

What are man-in-the-middle attacks? 

A ‘man in the middle attack’ is a cyber security threat in which a hacker secretly intercepts a communication between two parties. These types of cyber-attacks are becoming increasingly common as cyber criminals are rapidly evolving and finding new and clever ways to exploit vulnerabilities in networks. 

How does a man-in-the-middle attack work? 

Interrupting the connection, the hacker assumes the identity of one of the users and relays messages between the two parties who believe they are communicating with each other – this is known as ‘eavesdropping’.  By ‘eavesdropping’ a cyber-criminal can control the conversation enabling them to steal or alter the data being exchanged.  

How to protect against man-in-the-middle attacks? 

To protect against man-in-the-middle attacks, it is important to: 

  • strongly encrypt traffic between the network and devices using browsing software  
  • verify the identity of the parties involved in a communication 
  • always make sure sites accessed are secure 

4 SQL injections 

What are SQL injections? 

SQL injections are an extremely serious form of cyber-security threat in which malicious code is inserted into a server using SQL, the Server Query Language. The malicious code can force the server to reveal confidential data or take other action. 

How does a SQL injection work? 

The malicious code, from an untrusted source, can force the server to reveal confidential data or take other action. SQL injection attacks are most commonly the result of an attacker entering malicious code into an unprotected website comment or search box. This can allow an attacker to access data, modify and damage it or even destroy the website. 

How to protect against SQL injection? 

All companies maintaining websites should prevent attacks by ensuring that all user input is properly validated and that all SQL queries are executed with appropriate permissions. A good web developer should help protect from SQL injection by writing secure code that doesn’t allow for the injection of malicious code into an application to protect the site. 

5 Spear Fishing 

What is Spear Fishing? 

Spear phishing is a highly sophisticated form of phishing. Fraudulent emails are tailored to specific individuals and organisations to gain access to confidential data over a prolonged period.  

How does Spear fishing work? 

By impersonating a trusted sender, the ‘spear fisher’ can trick an individual into opening an infected link allowing the hacker to bypass security measures – like email filters and antivirus. Consequently, the cybercriminal gains access to an organisation’s network and data. This can kick off a chain of events that enable cyber criminals to break through small businesses weak security and open a gateway to hack into larger organisations.  

How to protect against spearfishing? 

Implementing training programs that educate employees about spear phishing and how to spot red flags such as misspellings or poor grammar will help prevent these types of attacks. Organisations should also implement advanced cyber security controls to detect and block spear fishing such as email filtering and virus scanning. 

Get in touch 

Find out how to protect your business from cyber security threats by contacting a member of our team today by emailing [email protected] or call 0131 510 0110.

February 13, 2023
0
CONSIDER IT FACEBOOK CONSIDER IT Twitter CONSIDER IT Linkedin

Contact Us

0131 510 0110
[email protected]
Find Us

Customer Service

Contact Us
Our Locations
Case Studies

Information

About Consider IT
Domains
Privacy Policy
Terms & Conditions
Press Enquiries

© 2026 Consider IT Limited – All Rights Reserved
Registered office: Waterview House, 37 Shore, Edinburgh, EH6 6QU. Company Number: SC320341 | VAT number: GB 930 1862 42
Consider IT is a trading name of Consider IT Limited
701 Tillery St #12, Austin, TX 78702, United States