Businesses are fragile things. They can be affected in their success by
a whole host of factors including market forces, consumer habits, and
changes in attitudes.
But many aspects of your business success are firmly held in your own
hands. You can develop an agile approach allowing you to change your
model based on market forces, you can adapt your products or services to
take into account consumer demands and you can keep track of people's
opinions to ensure you keep with current thinking and attitudes.
But how would you cope with a major incident that occurred to or in your
business?
Business continuity and disaster recovery are essential tools designed
to protect your business should the worst happen.
If you make use of technology in your business and particularly if it
forms the backbone of your operations you need to make sure you have a
Disaster Recovery Plan.
Disaster Recovery is the process of recovering your technical systems,
data and applications to a level which allows you to continue operating
your business.
Sometimes a DR solution will only recover key systems - just enough to
keep you going in the short term until a full recovery can be performed.
A technical disaster or incident can be caused by a number of internal
factors including technical faults, accidental damage caused by errors
or malicious activity.
Disasters can also be caused by external factors such as power cuts,
floods or property damage.
The key to an effective DR plan is to evaluate which systems,
applications and data are key to your operations and ensuring these are
recovered first. There is no point spending time and effort recovering
your marketing database when your customers aren't getting the products
they've ordered or the services they've bought.
Getting your DR plan right can mean the difference between having a
business in serious trouble and your customers not even knowing there
was a problem.
A Business Continuity Plan is similar in many ways to a Disaster
Recovery Plan. The main difference is that the BCP deals with more than
just technology.
Your BCP covers all aspects of your business, from offices and desk
space, communications, operations, to incident response, staff safety
and public relations.
Whether you decide your business needs a full BCP or merely a DRP you
should be aware that having one and making sure it is up to date and
tested can be the difference between your business surviving and growing
and it's complete failure.
There are many statistics out there but the general consensus is that
businesses experiencing a major incident and who don't have an effective
BCP will go out of business within 6-24 months of the incident.
You have insurance to cover you should the worst happen. A Business
Continuity Plan or at the least a Disaster Recovery Plan should help
protect you in the same way - by ensuring your business survives
whatever is thrown at it!
Our philosophy is simple - plan for the worst, hope for the best!
For more information or a free BCP/DRP consultation contact Secure
Thinking on 0845 071 4690 or visit http://www.securethinking.co.uk/
Articles
Wednesday, 11 May 2011
Monday, 2 May 2011
Information Security Posture - What's Yours Like?
Pretty much all modern businesses deal with information of some description. Whether it's basic day-to-day accounting data on your own business, financial records of other businesses and individuals, or detailed personal and medical files on thousands of people, information exists within your business.
Unfortunately, whatever information you have in your business there's a pretty good chance that someone else wants it. These people could be simple criminals out to make a fast buck, organised crime gangs running a profitable if somewhat corrupt operation, competitors willing to try a little industrial espionage, or even nation states using your business to gain international advantage.
And your size and stature doesn't always have to be substantial - indeed the Information Commissioner's Office here in the UK considers smaller businesses a weak link precisely because they are small and often unwilling to invest in effective information security controls, and because they frequently supply to or work on behalf of major corporations.
So we've established that your business handles information, and that a threat exists to that information. The next question is what are you currently doing about it?
If you have existing security controls in-place, are they effective, both in terms of costs and protection? Do your staff understand their role in protecting information? And can and should you be doing more?
Now unless you have an effective system for testing and assessing your information security controls it's doubtful you can answer these questions with any degree of certainty.
So how do you go about measuring the level of information security within your business?
The 1st option is to trust in fate and hope that you never experience a breach. The problem with this approach is that it relies on your organisation never being targeted. Now of course it may indeed never be targeted directly. But I'm sure you would agree that's not the most sensible approach. Especially when all evidence suggests such attacks are on the increase.
Another option is to implement a process of measuring your own security controls. If you have the skills and resources this might appear the best solution and that way you're not exposing your soft underbelly to 3rd parties. The downside of this is that like any internal process, you may be the victim of politics where the judgements and test results end up being skewed by internal issues and rivalries, making the results unreliable.
In addition, if reduced risk and improved security is your goal, with a long term objective of possibly gaining some kind of certification (such as ISO27001), then you really need an objective, unbiased opinion from a trusted business partner.
Which brings us to the 3rd option - find a suitable security assessment provider and have them do an assessment of your business.
Now obviously there are a number of solutions in this area. Fixed price offerings such as Secure Thinking's Quick Information Security Assessment (QISA) are primarily designed for small and medium sized organisations. If you are a lege business or need something more thorough you might opt for an assessment performed on a consultative basis by an experienced individual or business.
If you wish to go down the route of certification you might need help in choosing an appropriate certifying body and then assistance implementing the controls, policies and systems needed to obtain certification.
All of these services can be performed by a number of reputable companies, including Secure Thinking.
Whichever option you go for in the end you are far better off ensuring you properly assess your information security controls than simply crossing your fingers and hoping for the best. Your business and your customers are deepending on you!
Unfortunately, whatever information you have in your business there's a pretty good chance that someone else wants it. These people could be simple criminals out to make a fast buck, organised crime gangs running a profitable if somewhat corrupt operation, competitors willing to try a little industrial espionage, or even nation states using your business to gain international advantage.
And your size and stature doesn't always have to be substantial - indeed the Information Commissioner's Office here in the UK considers smaller businesses a weak link precisely because they are small and often unwilling to invest in effective information security controls, and because they frequently supply to or work on behalf of major corporations.
So we've established that your business handles information, and that a threat exists to that information. The next question is what are you currently doing about it?
If you have existing security controls in-place, are they effective, both in terms of costs and protection? Do your staff understand their role in protecting information? And can and should you be doing more?
Now unless you have an effective system for testing and assessing your information security controls it's doubtful you can answer these questions with any degree of certainty.
So how do you go about measuring the level of information security within your business?
The 1st option is to trust in fate and hope that you never experience a breach. The problem with this approach is that it relies on your organisation never being targeted. Now of course it may indeed never be targeted directly. But I'm sure you would agree that's not the most sensible approach. Especially when all evidence suggests such attacks are on the increase.
Another option is to implement a process of measuring your own security controls. If you have the skills and resources this might appear the best solution and that way you're not exposing your soft underbelly to 3rd parties. The downside of this is that like any internal process, you may be the victim of politics where the judgements and test results end up being skewed by internal issues and rivalries, making the results unreliable.
In addition, if reduced risk and improved security is your goal, with a long term objective of possibly gaining some kind of certification (such as ISO27001), then you really need an objective, unbiased opinion from a trusted business partner.
Which brings us to the 3rd option - find a suitable security assessment provider and have them do an assessment of your business.
Now obviously there are a number of solutions in this area. Fixed price offerings such as Secure Thinking's Quick Information Security Assessment (QISA) are primarily designed for small and medium sized organisations. If you are a lege business or need something more thorough you might opt for an assessment performed on a consultative basis by an experienced individual or business.
If you wish to go down the route of certification you might need help in choosing an appropriate certifying body and then assistance implementing the controls, policies and systems needed to obtain certification.
All of these services can be performed by a number of reputable companies, including Secure Thinking.
Whichever option you go for in the end you are far better off ensuring you properly assess your information security controls than simply crossing your fingers and hoping for the best. Your business and your customers are deepending on you!
Friday, 22 April 2011
Simplifying the Web Site Security Issue
Web site security vulnerabilities are a common problem but few web site owners, business operators or even web designers truly understand the nature of the problem.
I wrote some time ago about why web site security is important for everyone but it is a hard concept to communicate to people who have little or no understanding of the technology involved in hosting a web site, Internet service or e-commerce business.
So this article is an attempt to make a non-technical comparison which can be understood by anyone.
Imagine you own a Conference Centre (your website). This facility has lots of rooms (pages) and attracts hundreds of attendees (visitors or customers computers) every day. Some attendees will come regularly for different courses or will cover the same course over and over again.
Other attendees may have a quick look around and decide they aren't ready to do a course just yet. But may come back later.
Unbeknown to you, one of the training rooms has a broken lock on the fire exit (vulnerability) through which every day a hypnotist enters.
This hypnotist is a nasty person (malware) and he quickly hypnotises (infects) everyone in the room. He tells them to gather as much information on the financial transactions of those around them as they can. Then, when they hear the keyword "download", they will divulge all the information they have gathered and forget what they have done.
So the attendees go off about their day-to-day activities and, without realising what they're doing, quietly gather the information.
They collect the bank statements and account details of their family and loved ones, they watch as people enter PIN numbers at the checkout and they copy down and skim credit card details.
They also collect security codes, PIN numbers and password used for non-financial purposes because they know people reuse them frequently and they may be useful.
Then, a few days later a phone call arrives and the keyword is mentioned. The attendee passes everything they have gathered to the hypnotist.
Days, weeks or months pass before anyone starts noticing. First it's a card transaction declined. Then it's bailiffs calling round and before long the reason is understood - the family and friends of the attendee have been the victims of identity theft and fraud, and have lost thousands.
Tens, hundreds or even thousands of people have been robbed of thousands or even millions of pounds.
Eventually, the auhorities trace the cause of the problem back to the Conference Centre but there's no sign of the hypnotist.
All that happens now is the attendees lose confidence in the Conference Centre and stop coming. Very quickly the centre goes out of business.
And all because the owner of the conference centre didn't make sure the facility was secure.
I wrote some time ago about why web site security is important for everyone but it is a hard concept to communicate to people who have little or no understanding of the technology involved in hosting a web site, Internet service or e-commerce business.
So this article is an attempt to make a non-technical comparison which can be understood by anyone.
Imagine you own a Conference Centre (your website). This facility has lots of rooms (pages) and attracts hundreds of attendees (visitors or customers computers) every day. Some attendees will come regularly for different courses or will cover the same course over and over again.
Other attendees may have a quick look around and decide they aren't ready to do a course just yet. But may come back later.
Unbeknown to you, one of the training rooms has a broken lock on the fire exit (vulnerability) through which every day a hypnotist enters.
This hypnotist is a nasty person (malware) and he quickly hypnotises (infects) everyone in the room. He tells them to gather as much information on the financial transactions of those around them as they can. Then, when they hear the keyword "download", they will divulge all the information they have gathered and forget what they have done.
So the attendees go off about their day-to-day activities and, without realising what they're doing, quietly gather the information.
They collect the bank statements and account details of their family and loved ones, they watch as people enter PIN numbers at the checkout and they copy down and skim credit card details.
They also collect security codes, PIN numbers and password used for non-financial purposes because they know people reuse them frequently and they may be useful.
Then, a few days later a phone call arrives and the keyword is mentioned. The attendee passes everything they have gathered to the hypnotist.
Days, weeks or months pass before anyone starts noticing. First it's a card transaction declined. Then it's bailiffs calling round and before long the reason is understood - the family and friends of the attendee have been the victims of identity theft and fraud, and have lost thousands.
Tens, hundreds or even thousands of people have been robbed of thousands or even millions of pounds.
Eventually, the auhorities trace the cause of the problem back to the Conference Centre but there's no sign of the hypnotist.
All that happens now is the attendees lose confidence in the Conference Centre and stop coming. Very quickly the centre goes out of business.
And all because the owner of the conference centre didn't make sure the facility was secure.
Friday, 18 February 2011
Protecting Your Information - Laptop Encryption
At Secure Thinking, we are being asked more and more about how busy professionals can protect the business critical and often sensitive information they carry around on laptop and netbook computers.
The simple solution to this problem is to encrypt the laptop disk drive so that only the owner of the computer can access the data.
Most computers have a password which is used to prevent access to the software, applications and data in a casual fashion. Passwords, and particularly strong passwords* are a vital component in preventing unauthorised access to information and applications. However, they only protect systems that remain in the physical possession of the owner.
Once physical possession is compromised, as in the case of a lost or stolen computer, then there are ways of bypassing the logical access controls imposed by usernames and passwords. Such bypass techniques can be as simple as using a brute-force password cracking tool or just simply removing the hard disk drive from the machine and plugging it in to another computer.
This can be a particular problem in the case of mobile computers, where the opportunity for loss or theft is far greater than machines protected by a secure physical environment.
Encryption of the hard drive can protect against the dangers highlighted above. It means that, in effect, if the computer is lost or stolen, the data cannot be accessed by the new owner without the password or pass phrase used to perform the encryption. In addition, where whole disk encryption is utilised, the system cannot even be started unless it is completely reinstalled - overwriting any data on the disk drive.
So if you want to protect your mobile computers, or even your office based ones should you feel the need, then contact Secure Thinking and we will be more than happy to go through your requirements and help you decide on the best solution for your business.
* Strong Passwords should be at least 12 characters long and consist of upper- and lower-case letters, numbers and special characters such as !'#@"£$ etc. They should not be made up of dates, names or dictionary words - even obscure ones!
The simple solution to this problem is to encrypt the laptop disk drive so that only the owner of the computer can access the data.
Most computers have a password which is used to prevent access to the software, applications and data in a casual fashion. Passwords, and particularly strong passwords* are a vital component in preventing unauthorised access to information and applications. However, they only protect systems that remain in the physical possession of the owner.
Once physical possession is compromised, as in the case of a lost or stolen computer, then there are ways of bypassing the logical access controls imposed by usernames and passwords. Such bypass techniques can be as simple as using a brute-force password cracking tool or just simply removing the hard disk drive from the machine and plugging it in to another computer.
This can be a particular problem in the case of mobile computers, where the opportunity for loss or theft is far greater than machines protected by a secure physical environment.
Encryption of the hard drive can protect against the dangers highlighted above. It means that, in effect, if the computer is lost or stolen, the data cannot be accessed by the new owner without the password or pass phrase used to perform the encryption. In addition, where whole disk encryption is utilised, the system cannot even be started unless it is completely reinstalled - overwriting any data on the disk drive.
So if you want to protect your mobile computers, or even your office based ones should you feel the need, then contact Secure Thinking and we will be more than happy to go through your requirements and help you decide on the best solution for your business.
* Strong Passwords should be at least 12 characters long and consist of upper- and lower-case letters, numbers and special characters such as !'#@"£$ etc. They should not be made up of dates, names or dictionary words - even obscure ones!
Wednesday, 2 February 2011
Secure Thinking When Online
If you run a small business or you manage the HR department of a large organisations you may well be aware of some of the issues surrounding staff use of social networking sites.
Social networking sites such as Facebook, professional networking sites like LinkedIn, and the various personal and professional blogging facilities, not to mention the micro-blogging sites like Twitter provide everyone with an opportunity to communicate with others with whom they have an affinity, voice their grievances and raise awareness of issues.
The problem for businesses and employers is when employees over-step the professional/social boundary.
If employees use social networking to make comments about the company, fellow employees, management or customers it can have a dire effect on business, perceptions and relationships both inside and external to the organisation.
Whilst many companies are aware of this and take some steps to mitigate the risk, it is often only done using a stick. The general approach appears to be to discipline anyone who oversteps the mark - even when those marks aren't clearly defined. This leads to further frustration and ultimately a breakdown in relations between employer and employee.
At Secure Thinking, we believe that this approach is wrong and have now decided to do something about it. We are therefore offering a new awareness service - Secure Thinking When Online - where we will come on site at your company, or other location, and present to your staff about the risks of online behaviour, why the rules exist and how to protect themselves in their everyday internet based activities.
Social networking sites such as Facebook, professional networking sites like LinkedIn, and the various personal and professional blogging facilities, not to mention the micro-blogging sites like Twitter provide everyone with an opportunity to communicate with others with whom they have an affinity, voice their grievances and raise awareness of issues.
The problem for businesses and employers is when employees over-step the professional/social boundary.
If employees use social networking to make comments about the company, fellow employees, management or customers it can have a dire effect on business, perceptions and relationships both inside and external to the organisation.
Whilst many companies are aware of this and take some steps to mitigate the risk, it is often only done using a stick. The general approach appears to be to discipline anyone who oversteps the mark - even when those marks aren't clearly defined. This leads to further frustration and ultimately a breakdown in relations between employer and employee.
At Secure Thinking, we believe that this approach is wrong and have now decided to do something about it. We are therefore offering a new awareness service - Secure Thinking When Online - where we will come on site at your company, or other location, and present to your staff about the risks of online behaviour, why the rules exist and how to protect themselves in their everyday internet based activities.
Thursday, 30 December 2010
New Year's Resolution
It's that time of year again when we all make new year's resolutions. It's pretty much par for the course. We will be all enthusiastic for the 1st few days or maybe even weeks (if you're really keen). Then it will all tail off into nothing.
The same story happens every year - why should this be any different?
Well how about setting a New Year's Resolution you can stick to? One that will enhance your professional and business reputation? One that will bring huge benefits to your organisation?
The New Year's Resolution I'm talking about is to call Secure Thinking and let us see if we can help you improve the Information Security within your business. We can look at your current information security policies, procedures and controls and investigate whether they are effective and are protecting your business interests.
We can also help you out with ongoing information security management which can plague businesses and is frequently ignored by busy owner managers.
So whatever information and IT security needs you may have, whether you require help with business processes such as security policies, procedures and standards, with employee education in the form of awareness, guidelines and training, or with technical solutions such as anti-virus, encryption and secure backups, contact Secure Thinking now and make this year's resolution one that truly benefits you and your business!
The same story happens every year - why should this be any different?
Well how about setting a New Year's Resolution you can stick to? One that will enhance your professional and business reputation? One that will bring huge benefits to your organisation?
The New Year's Resolution I'm talking about is to call Secure Thinking and let us see if we can help you improve the Information Security within your business. We can look at your current information security policies, procedures and controls and investigate whether they are effective and are protecting your business interests.
We can also help you out with ongoing information security management which can plague businesses and is frequently ignored by busy owner managers.
So whatever information and IT security needs you may have, whether you require help with business processes such as security policies, procedures and standards, with employee education in the form of awareness, guidelines and training, or with technical solutions such as anti-virus, encryption and secure backups, contact Secure Thinking now and make this year's resolution one that truly benefits you and your business!
Friday, 24 December 2010
Merry Christmas
Secure Thinking would like to wish all our staff, customers and contacts a very Merry Christmas.
Let's hope Santa brings you everything you need, and protects your information, identities and finances!
Have a good one!
Lee
Let's hope Santa brings you everything you need, and protects your information, identities and finances!
Have a good one!
Lee
Subscribe to:
Posts (Atom)