Shane Chambers No Comments

NIST Experts Do U-Turn & Issue New Password Security Guidelines

NIST is the US National Institute of Standards and Technology, and back in 2003, a password primer was written by one of its managers that put forward recommendations, many of which became the rules we have now. Special characters, mixture of upper and lower case letters, regular password changes – these have all been adopted into ‘best practice’ for password security since NIST made these recommendations. Now, however, these complexity guidelines and regular password changes have been repeatedly proven by experts to actually be less secure for companies, due to the work-arounds humans put in place to make remembering password easier. NIST thankfully have released their mistake and have provided updated best practice standards for password security. Why the sudden change of heart, you may ask? Well, over a billion passwords a year are breached by cyber criminals, and the data obtained shows that when presented with a long list of password criteria, people tend to try something basic first and then just tweak it until it fits. For example, ‘password’ becomes ‘Password1’, which may be more mathematically secure, but can be easily guessed instead.


Previously established guidelines are mostly being discarded, in favour of rules that simplify passwords for the user

No one looks forward to those mandatory password changes every few months, as it can be incredibly frustrating to constantly think of new passwords with the right mixture of capital letters, special characters and numbers. In fact, many people try to simplify the process by using a variation of their previous password – ‘Password1’ becomes ‘Password2’, and so on. In fact, the entire basis for issuing new guidelines stems from one simple fact; people can’t remember all the passwords that they have been forced to create, ultimately causing them to create less secure passwords than if they didn’t have to adhere to the guidelines in the first place. So with all that in mind, here’s a breakdown of the new best practices and why they’re easier and more secure:

Read more

Shane Chambers No Comments

Companies Continue to Cover up Data Breaches Despite Imminent Fine Increase Under GDPR

Recently, car insurance and breakdown cover provider AA faced accusations of covering up the severity of a data breach that occurred in April of this year. The AA, through their customer support Twitter, chose to downplay reports of the breach and assured users that no credit card or other sensitive data had been exposed. Data was leaked from their online shop due to a server misconfiguration. However, this server contained data on over 100,000 AA customers, and included partial credit card data. Despite knowing about this breach for over two months, it wasn’t until the cyber security community cried out in outrage that AA eventually admitted to the severity of the breach. No customers were notified by the AA directly.


No customers that were impacted were directly notified by the AA, despite the breach being discovered in April.

Read more

Shane Chambers No Comments

Cyber Essentials Accreditor Suffer Data Breach, Exposes Companies to Phishing Attacks

For those of you who may not have heard of the Cyber Essentials scheme, it is an accreditation-based program created by the UK government and backed by the industry in both the UK and Ireland, to show that basic cyber security measures have been put in place that will block most cyber attacks. It was designed as an affordable alternative to ISO27001, which may be financially out-of-reach for many small/medium enterprises, and is a requirement for any businesses that deal with the UK government. So, it may have come as a surprise to many to find out that the IASME Consortium, one of six accrediting bodies in the UK, has suffered a data breach which exposed the company names and email addresses of their applicants. While no other information such as these companies’ security configurations were leaked, the breach could well open the exposed companies to phishing attacks from cyber criminals.


A list of Cyber Essentials applicants, including their company names and corporate email addresses, may have been leaked to hackers.

Read more

Shane Chambers 1 Comment

ICO Less Likely to Issue Fines to Companies Who Train Staff

The Information Commissioner’s Office in the UK has issued a statement that organisations who train their staff in data security will be less likely to receive a fine or monetary penalty. The ICO recommends that at least 80% of an organisation’s staff are trained on how to handle sensitive data and keep it secure from data breaches, with a spokeswoman stating that “reasonable steps” must be taken to secure data, with “full account of the facts” taken into consideration in the event of a data breach being discovered.


At least 80% of an organisation’s staff should be trained on keeping data secure. Human error remains the top cause of data breaches.

Read more

Shane Chambers No Comments

Ransomware attacks may breach new EU GDPR data protection regulations.

With the introduction of the new EU general data protection regulation (GDPR) this time next year (25 May 2018 to be exact) – businesses all over the globe could find themselves in breach of the regulation and facing hefty fines should they fail to prevent a ransomware attack, phishing attack or similar. The message is finally getting out there – something needs to be done about ransomware and fast.

GDPR Data Breach From Ransomware

How Ransomware could cause a breach of GDPR?

As noted in this RTE article by @AengusCox – data protection and governance expert @DaraghOBrien, Managing Director of Castlebridge Associates, confirms GDPR is all about accountability. Not only do organisations have to comply with the regulation, they also have to demonstrate compliance through evidential proof (documentation, etc) of the controls, processes, technology, etc. that they have in place to protect the sensitive and personal data they hold on EU citizens (to include their staff, customers, vendors and third parties).

Daragh confirms that ransomware could indeed be seen as a breach of GDPR by the data protection commissioner, as ransomware typically can affect both the availability and access of personal data and can also affect the recovery of the personal data. Indeed, some viruses are known to upload personal data to hackers – a clear data breach and major breach of the GDPR.

As the GDPR comes more and more into focus through the year and into next year – security experts predict that hackers/scammers will begin to steal data with advanced ransomware and then blackmail the victims by threatening to report them to data protection commissioner.

What can be done?

In the RTE video interview, Daragh notes that security awareness training for staff is crucial now. Businesses urgently need to train their staff how to recognise and avoid clicking on links in phishing emails.

Many may not realise yet, but Article 39 1(b) of the GDPR regulation places a mandatory onus on organisations to undertake security awareness training for staff that deal with sensitive personal data. Read more