Shane Chambers 1 Comment

Spear-Phishing

“Spear phishing is an email or electronic communications scam targeted towards a specific individual, organisation or business. Although often intended to steal data for malicious purposes, cybercriminals may also intend to install malware on a targeted user’s computer.”

Gone are the days when the only phishing threats were from poorly spelled emails asking you to claim Clubcard points. With the cybercrime-as-a-service (CaaS) industry estimated to be worth in the billions each year, cyber criminals are becoming increasingly organised in the way they implement their attacks. Instead of sending out random emails and hoping for the best, spear-phishing involves researching a particular organisation, probing for weaknesses, then sending highly targeted, personal phishing emails. These emails may appear as if they come from your CEO, or IT manager, or even the colleague that sits next to you. It is estimated that over 90% of successful data breaches by cyber criminals started with a spear-phishing attack. The best means of prevention is to implement an ongoing cyber security awareness program, as trained staff can detect and block spear phishing attacks before it’s too late.

Shane Chambers No Comments

Cyber Essentials Accreditor Suffer Data Breach, Exposes Companies to Phishing Attacks

For those of you who may not have heard of the Cyber Essentials scheme, it is an accreditation-based program created by the UK government and backed by the industry in both the UK and Ireland, to show that basic cyber security measures have been put in place that will block most cyber attacks. It was designed as an affordable alternative to ISO27001, which may be financially out-of-reach for many small/medium enterprises, and is a requirement for any businesses that deal with the UK government. So, it may have come as a surprise to many to find out that the IASME Consortium, one of six accrediting bodies in the UK, has suffered a data breach which exposed the company names and email addresses of their applicants. While no other information such as these companies’ security configurations were leaked, the breach could well open the exposed companies to phishing attacks from cyber criminals.


A list of Cyber Essentials applicants, including their company names and corporate email addresses, may have been leaked to hackers.

Read more

Shane Chambers 1 Comment

ICO Less Likely to Issue Fines to Companies Who Train Staff

The Information Commissioner’s Office in the UK has issued a statement that organisations who train their staff in data security will be less likely to receive a fine or monetary penalty. The ICO recommends that at least 80% of an organisation’s staff are trained on how to handle sensitive data and keep it secure from data breaches, with a spokeswoman stating that “reasonable steps” must be taken to secure data, with “full account of the facts” taken into consideration in the event of a data breach being discovered.


At least 80% of an organisation’s staff should be trained on keeping data secure. Human error remains the top cause of data breaches.

Read more

Shane Chambers 3 Comments

New Global Ransomware ‘Petya’ May Be Deadlier Than WannaCry

Back in May, the world saw a global ransomware attack on a then-unprecedented scale – WannaCry. This cyber attack affected more than 230,000 computers in more than 150 countries, and is estimated to have cost businesses up to $4 billion. To say that businesses were caught off-guard is an understatement, with the malware utilising vulnerabilities in the long-obsolete Windows Server Message Block (SMB) v1 and through computers with out-of-date Windows security patches. It gets onto a network most often through human error – employees clicking phishing emails – then spreads like wildfire to other machines that are connected to the internet.

This week, however, reports came in from Ukraine and across Europe that a new mass-ransomware attack was underway. Initially theorised to have been a variant of WannaCry, cyber security experts now believe it to be a variant of Petya, a strain first seen in 2016 which was then predicted to be “the next step in ransomware evolution”.


Oops, your important files are encrypted. There is currently no known way to recover files affected by Petya.

Read more

Gerry Morley - Director of Cyber Security 4 Comments

Ransomware – WannaCry No More – Train and Phish your staff.

prevent ransomware

By now, many of you that have not been under a rock for the last couple of weeks have heard about the worldwide ransomware cyber-attack WannaCry Decrypt0r that began in earnest on Friday 12th May 2017. The new ransomware caused major disruption to the IT systems of 40 National Health System hospitals across the UK (resulting in most non-emergency operations being suspended). Not only that, but it also caused disruption to an additional 200,000 victims, distributed over at least 150 countries (including several banks, Renault, Nissan, FedEx Corp, Telefonica, German Railways and even the Russian Interior ministry).

How Did This Happen?

Global reports from cyber security experts confirm that this ransomware gets onto a network through an unsuspecting user clicking on a link or attachment in a spam email.

The last few years and countless data breaches have shown that human error (due to a lack of security awareness training) from phishing and social engineering is the number 1 cause of cyber-attacks, ransomware and data breaches worldwide. Unfortunately, many companies including hospitals who have not invested in security awareness training and ongoing testing of their staff with simulated fake emails (to keep them savvy to the latest scams) will continue to be the most vulnerable to this and future similar style cyber- attacks.

Read more