Manoj Bhatt

Cyber Incidents: What exactly should organisations be monitoring? 🤔 We spoke to Cyber Incident Responder, Vanessa Horton, for her advice on what organisations need to be monitoring: Security events. These are just everyday events on your systems or networks – logins, incoming emails, files received, and so on. So, for example, if you suddenly get someone logging in from Russia, and they weren’t on a business trip there or something, you need to investigate. This means you’re not just tracking the logins themselves, but also certain information about them – locations and IP addresses, login times, files or services accessed, and so on. Again, you have to know your baseline. What is expected activity? And if it’s unexpected, someone must quickly investigate. If a threat actor did gain access to a user’s account, you want to prevent them from accessing anything else. Equally, if it’s just someone who’s on holiday in Russia and decided to log in, you can dismiss the security event. But you must establish that in your initial follow-up; you can’t just assume it’s not a security incident. [The difference between a security event and a security incident is that an event is an everyday occurrence – like users logging in. But some events also signify a security incident: a breach of confidentiality, integrity and/or availability, also known as the ‘CIA triad’.] Read more from our 'A Practical Guide to Cyber Incident Response' with Cyber Incident Responder, Vanessa Horton 👉 https://lnkd.in/eJnBShva #CyberSecurity #IncidentResponse #CyberIncident #Infosec #Anomaly #SuspiciousActivity

5

🔍💼 Business Owners, Will Your IT Let You Down? 💻🔧 Birmingham City Council’s recent IT struggles highlight a crucial lesson for all of us: the importance of having robust, reliable IT systems. Earlier this year, the council’s IT issues were so severe that they contributed to its financial troubles, even leading to bankruptcy. The latest disruption, which was not caused by a cyber attack but by internal changes, shows how vital it is to ensure that any updates or changes to your IT infrastructure are thoroughly tested and meticulously planned. These interruptions can affect #internet access and #email services, cause significant inconvenience and expense. #ITSupport https://lnkd.in/eUiui9jY

1

It is said that a problem shared is a problem halved. If your struggling or you know someone that is, this webinar from techUK might be for you. See you there. #cybersecurity #stress #burnout

4

Cyber Incidents: To what extent does seasonality play a role in security monitoring? 🤔 We spoke to Cyber Incident Responder, Vanessa Horton, for her views on what role seasonality (like weekdays vs weekends, for example, or Black Friday) play in her role: Oh, seasonality plays a role, for sure. Black Friday is the perfect example. If you’re a retailer, you’re going to see way more web traffic than usual. You must be able to handle that. By having more people on call, for example. By double-checking things. You need to plan ahead and assess the risks. Again, a smart threat actor will target your weakest link, and when you’re at your most vulnerable. So, if they wanted to take your website down, for example, with a DoS attack [denial of service], a day like Black Friday is a prime time to target, when traffic is up anyway, and it’ll take fewer additional requests to flood your servers. Black Friday is also a great time [from the attacker’s perspective] to cause most harm. If your website isn’t operating that day, you’ll take a massive financial hit in terms of lost sales. Read more from our 'A Practical Guide to Cyber Incident Response' with Cyber Incident Responder, Vanessa Horton 👉 https://ow.ly/2C7950S45RZ #CyberSecurity #IncidentResponse #CyberIncident #Infosec #Anomaly #SuspiciousActivity #Seasons #BlckFriday

4

What common misconceptions are there around cyber incident response? 🤔 We spoke to Cyber Incident Responder, Vanessa Horton, on the most common misconceptions: The big one is the [misplaced] belief that ‘it’s not going to happen to us’. Many organisations believe they won’t suffer a cyber incident, even if other organisations might. That’s a poor mindset to have because, for one, it’s wrong – everyone will suffer an incident at some point. But more importantly, this mindset leaves organisations unprepared for when they do suffer that breach, and haven’t got an incident responder on hand to keep the damage to a minimum. The fact that some big names have ‘been done’ recently shows how nobody’s safe. Not even big cyber threat actors! For example, not so long ago, LockBit [an infamous ransomware gang] got taken down. And various other ransomware groups, including Ragnar Locker and Black Basta, suffered the same fate. It just goes to show that no one’s above being successfully attacked. That’s just the unfortunate reality. Read more from our 'A Practical Guide to Cyber Incident Response' with Cyber Incident Responder, Vanessa Horton 👉 https://ow.ly/8u9e50S44nY #CyberSecurity #IncidentResponse #CyberIncident #Infosec

5

I urge my #LinkedIn connections interested in #cybersecurity or have concerns to listen to impartial advice from the National Cyber Security Centre. https://lnkd.in/eW-4ppFS Topic included so far: -#ransomware ecosystem -#cyber proliferation -Life beyond #passwords -#incident and information sharing -#AI

19