Max Clark

Yesterday we announced the renewal of our 𝗖𝘆𝗯𝗲𝗿 𝗘𝘀𝘀𝗲𝗻𝘁𝗶𝗮𝗹𝘀 Certificate of Assurance. Cyber Essentials, A UK Government-backed scheme to help organizations improve cybersecurity defenses against common internet-based attacks. Here are 5 controls you can implement today: - Use a firewall: Create a buffer zone between your IT network and external networks. - Use secure settings: Configure devices and software with secure settings to reduce vulnerabilities. - Control access: Limit data and service access to essential personnel only. - Protect against malware: Use antivirus software and regular updates to prevent harmful software. - Keep devices and software updated: Regular updates patch vulnerabilities and protect against new threats. Our renewed certification highlights our commitment to top-notch cybersecurity. Learn more about how we can help protect your business by booking a demo at the link below ⏬ https://lnkd.in/g_5wtScu #CyberEssentials #CyberSecurity #Certification #DigitalSafety #PrivilegedAccessManagement #ZeroTrust #RemoteAccess #AdminByRequest

13

Sometimes you absolutely positively got to have a reverse shell! 🐚 At the weekend I was helping a client with an internal infrastructure test but with extremely flaky RDP access, hopping through many different servers and workstations before arriving at my destination. 🔗 In these situations, I wield a bit of SSH-fu 🥷 so I can work more efficiently. In this case, I used autossh configured in a systemd service. If the service ever drops out, it comes straight back up like magic! ✨ Then you just pick up your shiny new tunnel on your remote server — happy days! PSA: Make sure both servers in this configuration are properly secured with firewall rules, strong passwords, MFA, and the appropriate SSH crypto — ideally on servers you’re allowed to be on! 🛡️ How do you access your servers when working remotely? 💬 #PenetrationTesting #Cybersecurity #SSH #RemoteWorking #ReverseShell

18

2 Comments

🔐 New UK Proposal: Mandatory Reporting of Ransomware Attacks 🔐 I came across an interesting article on about the UK’s new proposal to make reporting ransomware attacks mandatory. This would be to enhance transparency, improve response strategies, and strengthen our national cybersecurity defenses. It would be great to hear my network's thoughts on this proposal. 🤔 👇 https://lnkd.in/eY4qVHA8 #cybersecurity #ransomware

14

2 Comments

PSNI fined £750,000 for data breach despite appeals to lower amount due to perilous finances... Would your organisation survive if you received a fine like the PSNI have? Are you ensuring that your staff members are acting as a human firewall to keep you and your data safe? If you are reading this and feel like you have members of the team who may be a risk to your organisation, are you testing and training them to improve education and vigilance levels? At Phishing Tackle, we understand that user education differs and that groups of users have different levels of vigilance. This is where, with the fully managed service, we break the users into groups and test and train them consistently, with up-to-date and relevant material, to ensure that education and vigilance levels increase across the board, within a matter of weeks. Are you looking for someone to take this stress away from you? Drop me a DM! #humanfirewall #phishing #security https://lnkd.in/evD7Q2Ta

7

1 Comment

Are roles being open for 6 months+ putting candidates off applying to your company? 🤔 I spoke to candidate I am working with last week who was approached by a company for a Cyber Security Manager role - one he would be a really good fit for. I’ve seen so many roles readvertised this year that seem to have 100s of applicants and have also spoken to candiates who have been contacted about roles they’ve seen open for 6 months+. The candiates I speak to are out off these roles as they feel the companies aren’t serious about hiring or don’t know what they are looking for. Companies with job postings open for 6 months+ who aren't willing to change strategy or work with specialist agencies like Cyber Spring will miss out on the best candidates. Over the last 5 years, I have helped companies reduce their average time to hire great security talent to 27 days. If you want to make sure your brand is viewed positively in the industry and don't want to miss out on the best candidates - it may be time to rethink your hiring strategy.

32

12 Comments

#tsatuesday Today we go into something wider than just the 258 Measures. We have a look at the Code Of Practice, and take a specific section to analyse. Because I had an internal home failure on my Unraid server this week, I thought why not have a look at Backups and Recovery... Because if my personal home was being audited against the measures. I would have absolutely come unstuck. The Thomson household motto of, "If it ain't broke, don't fix it" didn't work for me here! Thankfully the consequence of me is my Child lost access to his mission critical Minecraft server. Now, given the above scenario. Its crucial we look at our organisations subject to the Telecommunications Security Act and ask ourselves if we're prepared for a failure - malicious or otherwise. #tsa #tsr #backups #recovery

Interesting chat about Cyber Security and Data Security, at LegalTechTalk. This is going to be so much more important with AI and the new ISO 42001. If you are in need of any data security or compliance support, from data discovery to implementing labels and policies, to monitoring, please get in touch. This is what we do! #legal #cybersecurity #cyberinlaw #dataprivacy #datasecurity

45

ISO 27001:2022 transition challenges and how to use ISO 27002 Matthew Peers from IT Governance Ltd once again offers his practical expert insight, this time into ISO 27001:2022 transition challenges. Also, I love how he refers to ISO 27002: the “good ideas book” :) As Matthew explained: “If you’re struggling with how to implement a given control, look at the guidance in ISO 27002. It’ll jog your memory, or spark some ideas to get you on the right track. “Or you might come at it from the other direction: ‘This is how we’ve previously done it; is there a better way of achieving that?’ Then you’d refer to ISO 27002 to see if you can borrow ideas. “It can also trigger ideas by reminding you of things you need to achieve, even without being specific about how to achieve them.” Read the full interview 👇 https://lnkd.in/gxdxBXS6

4

Back to the land of the Viking’s this week helping our client prepare for NIS2’s arrival. If you find a client is already well prepared there is no point in ploughing on with a standard approach. Use their extra knowledge and skills to provide a best practice example and give them the leeway to fill any gaps in a way that operates with their current controls. #PAConsulting #OTCyberSecurity #IotCyberSecurity #NIS2 #CyberFirst

30

4 Comments

Are roles being open for 6 months+ putting candidates off applying to your company? 🤔 I spoke to candidate I am working with last week who was approached by a company for a Cyber Security Manager role - one he would be a really good fit for. He was put off the role as he was told it had been open for almost 8 months and in his own words - "I know I'm good at what I do, but there are definitely other people out there with similar skills and experience for this role". He decided to pass on the role as it had been open so long and wasn't sure they were serious about hiring or knew exactly what they wanted from a candidate. He is at late stages for a couple of roles we are working on so it may have been a different case if he had just started looking at new roles - but this is a common occurance in the market. Companies with job postings open for 6 months+ who aren't willing to change strategy or work with specialist agencies like Cyber Spring will miss out on the best candidates. Over the last 5 years, I have helped companies reduce their average time to hire great security talent to 27 days. If you want to make sure your brand is viewed positively in the industry and don't want to miss out on the best candidates - it may be time to rethink your hiring strategy. #cybersecurity #securityhiring #recruitmentprocess

45

26 Comments

Time for a rant! Boy, haven't I read this piece of utter BS from almost any "political" body. Whether UK / US / Germany ... doesn't matter. ALWAYS the same friggin idiocy. Let's put in some sense into this blabber. About not enough candidates in universities: Well, as "cyber, cyber, cyber" is first and foremost a software, then a complexity and then a configuration problem, it would be so INCREDIBLY AWESOME if those building this dire heap of shit we nowadays call software- or tech-stack would learn "how-to-build-software-securely" IN THE FIRST PLACE! Can't be that hard, can it? There're literally hundreds of books dealing with just that. How to actually build software - AND TEST IT THEN !! - securely. Developing software is NOT an IT-Sec Pro job! Same goes for "IT-professionals": Why don't they learn how our biggest attack surface ever - aka MS - can be administered securely? (Possible, indeed duh!) Yes, it's a huge, extremely overcomplex, monstrous hydra to be tamed. So, what? That's what businesses went for. Deal with your decisions consequesces and stop whining! Administering is NOT an IT-Sec Pro job! High attrition rate: No shit sherlock! IT-Security pros these days need a complete other skill set than trained! They need the capacity to deal with the harbingers of chaos -> humans! Because "humans" are the root cause for this incredibly shitty landscape of operated "days of open doors for anyone"! No, I don't mean normal office staff. Clicking on mail will hardly do any harm nowadays ... anymore -> IF you actually run a patched up, up-to-date Microsoft stack. ... and pay the money, of course. (Welcome to the golden cage.) Those posing the biggest threat are Managers and C-Levels in NOT allowing absolute basics to be done properly and demanding "Cyber,cyber, cyber" to clean up the mess they created. The job of a cyber-sec Pro is ACTUALLY to get "people" to either do the right things OR at least not stand in the way. Therefore you need the following skills: - Communication (happy nerding as a mole is no more! Learn business lingo.) - Psychology (You're dealing with THE most diffucult NI there is!) - Leadership skills (YOU're the expert! You tell them what to do.) - Influencing (They need to do what you want them to ...) - Self-confidence (shaking in front of C-Level decinding on your budget doesn't help) That's for starters. These very simple steps would close this "gap" already considerably!

2

7 Comments

Will You be Applying for Jobs Being Advertised Online in 2025 🤔 As a candidate, with the amount of people applying per role at the moment, do you feel despondent when you see a role which you think you would be ideal for, but which already has a vast number of "people clicked apply", leading to you not applying❓ For employers who are relying purely on their online job adverts, they are missing out on quality suitable candidates, candidates who feel like it is a 'bun fight' to get their details in front of the hiring person. As an example, in the graphic below is an abstract taken from an online job advert where within 20 minutes of 'reposting' the role, they have over 100 people who have clicked 'apply'. We all know that the percentage of 'quality' applicants applying is so low, meaning that the firm is missing out on ideal & suitable candidates. TechCyber Solutions provides a 'human-centric' led Tech, Cyber Security and IT Security recruitment service, where when you receive a CV, you know that the candidate is: Relevant, ideal & suitable for the role. We save you money 💷 , save you time ⏲️ and we protect 👮‍♂️ your employer brand 👍 #ciso #cisos #cisolife #cisoalliance #cyber #cybersecurity #cyberjobs #recruitment #itsecurity #infosec.

5

2 Comments

Some interesting figures from Sky, in their latest article: "SMEs miscalculate the cost of cyber attacks on their business." Direct quote from the article: "With cyber-attacked SMEs estimating average losses of nearly £31,000 for each day they are forced to close, cybersecurity has to be at the top of business agendas" Our goal at Cyber Tzar is to help your business and IT teams focus on what matters—managing and remediating risks—while we take care of the heavy lifting involved in finding and prioritising those risks. We know that downtime is expensive, which is why our solutions are designed to reduce the time and costs associated with addressing vulnerabilities. See my thoughts on the report as well as how we can help you in my latest blog post: https://lnkd.in/eXGSCTdd #cyber #risk #supplychain #SME #cost #of #cyberattacks

11

⏰ Final Call: 1 Week to Get Your Cyber Security Toolkit If you’re planning to launch Cyber Security Awareness Month to your team in October, now’s the time to grab your toolkit. Packed with everything you need to keep your team informed and secure, this toolkit is your go-to resource for a successful launch. Including all the best cyber security resources for your team, this toolkit focusses on: 1. Importance of Multi-Factor Authentication (MFA) 2. Avoiding QR Code Scams 3. Spotting phishing scams 4. Safe practices for online gaming Don’t miss out - get your toolkit this week and be ready to kick off on October 1st https://lnkd.in/gr9RpkNh #CyberSecurity #SecureOurWorld #CyberSecurityAwarenessMonth #ToolkitReady

11

A critical NHS software vulnerability potentially exposed millions of patient records, highlighting urgent cybersecurity risks in healthcare is in the news again. Why This Matters: 🔒 Sensitive Data: Prime targets due to valuable patient information. 🕵‍♂️ Severe Consequences: Identity theft, financial fraud, and physical harm. 💷 Resource Strain: Budget constraints hinder security measures. Action Steps: 💷 Invest More: Prioritize cybersecurity tools, training, and personnel. 🔦 Be Proactive: Use data encryption, access control, and regular vulnerability checks. 💡 Raise Awareness: Cultivate a culture of cybersecurity vigilance among staff. How can healthcare organizations improve their defenses? Share your thoughts and let's have a conversation !

2

As the NHS becomes more digitised, the complexity and volume of threats facing the NHS grow exponentially. Cyber resilience isn't just about compliance - it's about ensuring uninterrupted patient care and safeguarding sensitive health data. Trend Micro is at the forefront of delivering tailored, integrated security solutions designed specifically for the NHS’s unique challenges. Discover how our end-to-end threat protection can empower your team to stay resilient in the face of ever-evolving cyber threats. From protecting legacy systems to securing remote access and critical data, we’ve got you covered. Discover more: Tackling the challenge of NHS Cybersecurity https://bit.ly/4eFez5C

2

Digital forensics experts on our database will be appearing on The Discovery + channel The series called 999 Murder Calling will be broadcast on 15th of November. Joseph and Leighton are appearing in the episodes 3 and 5 Joseph Naghdi and Computer Forensics Lab digital forensics experts can be instructed directly through their Expert Witness profile below. #expertwitness #Solicitors #Advocates #Police #Crownprosecution #Clerks #Barristers #KingsCounsel #DigitalForensicsInvestigations #ComputerForensics #MobilePhoneForensics #ElectronicDisclosure #ComputerCrime

8

1 Comment