Countering ransomware – it’s time to patch the human

Ransomware relies on human fallibility crypto-ransomware, malware that extorts money from victims by encrypting their files and systems until they pay a ransom, has been much in the news since WannaCry hobbled IT systems around the world last month. While much was made of the fact that WannaCry spread through networks by exploiting SMBv1 vulnerabilities in unsupported Windows systems (such as Windows XP, Windows 8 and Windows Server 2003), it is unusual for ransomware to self-replicate in the way WannaCry did.

Often, ransomware, in common with most other forms of malware, is spread by drive-by downloads or phishing campaigns, both of which exploit human error. So, even if you use robust anti-virus and anti-malware solutions, conduct regular penetration tests and ensure you keep your systems up to date and install the latest patches, your system could still be compromised thanks to a careless employee.

According to a 2016 report by SentinelOne:

  • 39% of organisations in the UK were hit by ransomware in the previous year
    • 72% of those infections were attributable to phishing
    • 38% were attributable to drive-by downloads from compromised websites

People are frequently acknowledged as the weakest link in any security system. But with better levels of staff knowledge, companies are more secure as you can, in effect, ‘patch’ your employees. Therefore, a best-practice approach to information security such as an ISO 27001 compliant ISMS (Information Security Management System), follows a holistic approach that addresses people as well as processes and technology.

Amicus ITS takes security seriously.  “We say security is part of our DNA here” advises  JP Norman, Director of Technology, Security & Governance, “and I consistently refer to the importance of “the squishy bits” (ie. the people) in IT management.  You can deploy the best systems and infrastructure money can buy –  but you have to ensure your people are trained too.”

G-Cloud 9 – official Crown Commercial Supplier status awarded to Amicus ITS

Amicus ITS is delighted to confirm that it has been granted ‘Official Supplier’ status on the Government’s Digital Marketplace cloud services framework. This offers buyers a host of transparent, commoditised managed cloud services on G-Cloud 9, the latest Government procurement platform for technology services for the public sector, healthcare bodies, agencies and arm’s length organisations.

To check out what services you can get through Amicus ITS on G-Cloud 9, follow these simple steps to get our full service details:

1. Go to https://www.digitalmarketplace.service.gov.uk
2. Look under the heading ‘Find cloud hosting, software and support’.
3. Click on Cloud support or Cloud hosting
4. Enter one of the service descriptions below in the Keywords box (eg. NOC).
5. Amicus ITS’ services will be found on the first page of your search for each.

• Cloud hosting – Enterprise Compute Cloud
• Cloud support – Service Desk
• Cloud support – Network Operations Centre (NOC)
• Cloud support – SQL for Public Sector
• Cloud support – Security Operations Centre (SOC)
• Cloud support – Backup and Disaster Recovery

Alternatively to speed up navigation to Amicus ITS, if you type in ‘Amicus ITS’ in Cloud support, this will pull through all five services listed in that Lot.

Sales Director Les Keen commented:  “I am delighted to announce that we have been awarded official ‘Crown Commercial Supplier’ status by the CCS.  We have a thirty year heritage as a leading MSP and a fine pedigree of security accreditations which puts us in a compelling position as data guardians to offer specialist cloud and managed services to wider public sector organisations, healthcare and government departments. 

Being on G-cloud 9 will offer the rightful assurance and transparency that public service buyers demand and we have a highly experienced team here to guide everyone through the process. 

Indeed, early indications are already proving positive, with my team having fielded a number of enquiries from public bodies in the first 72 hours since our services went live.  We are here to help, so do contact us”.

The Government’s handy Buyer’s Guide to be found at:  https://www.gov.uk/guidance/g-cloud-buyers-guide.
Anyone wanting further information can contact any member of our G-Cloud 9 bid team on +44 02380 429429 or you can email us at:  bidteam@amicusits.co.uk

Not Much Deep Thinking Evident Behind NHS Trust’s Data Share with Google DeepMind

Not for the first time, the NHS has come under fire from patients, patient groups and the scrutiny of the UK’s National Data Guardian (NDG), Dame Fiona Caldicott – and the ICO’s chief Elizabeth Denham.

The Royal Free Hospital in London commissioned Google’s DeepMind division in 2015 to help develop a Streams app to detect acute kidney injury through a blood test to identify deterioration. They provided DeepMind with 1.6 million patient records in the process to enabling ‘real time’ testing.

• Patients at the Royal Free Hospital in London were mainly unaware that their details were being used by a third party, nor how it was being used.
• No details on the financial terms of the deal have been disclosed publicly.

To Dame Fiona Caldicott, whose letter to the Royal Free was recently leaked, laid out her  concern that the data had been transferred on a ‘legally inappropriate’ (read ‘unlawful’) basis.  The app being developed was not ‘central’ to patient clinical care.  Caldicott shared her concerns with the ICO.

Caldicott does not dispute the app’s ability to help clinicians save lives today, but added in her letter: “Given that Streams was going through testing and therefore could not be relied upon for patient care, any role the application may have played in supporting the provision of direct care would have been limited and secondary to the purpose of the data transfer.  My considered opinion therefore remains that it would not have been within this reasonable expectation of patients that their records would have been shared for this purpose.”

Google DeepMind’s clinical lead Dominic King, was swift to distance any cross-use of the patient data with other Google products or services, or use for commercial purposes.

The ICO’s Elizabeth Denham has yet to give her judgement on misuse under the Data Protection Act, but the issue underlines the importance of individual consent.  This will be evermore intensely examined with the forthcoming GDPR regulations in 2018.  As it stands though, the ICO nonetheless has powers to fine a company up to £500,000 for the misuse of personal data as well as seek individual criminal prosecution.

Irrespective of the worthiness and potential benefit to patients in the longer term from the app, Dominic King agrees: “I think one thing that we do recognise that we could have done better is make sure that the public are really informed about how their data is used.”

It may prove a costly oversight to the Royal Free at a time of increasing NHS budget constraints, as well as prompting an ignominious slap in the face to the Trust from its patient body through damage reputation.

Amicus ITS is continuing its series of thought leadership events, this time on GDPR through 2017 for its customers and invited guests.  Further information on the programme can be found by contact Marketing (email) or calling Lindsay Burden on 02380 429475.

WannaCry ransomware attack goes global

 

News on Friday 12th May that NHS England had suffered a major ransomware cyber attack has since been extended to a wider victim base. We now know that the attack has affected around 150 countries, with major hits on the UK and Russia. It is estimated to have affected over 200,000 users to date.  In the UK 48 NHS trusts have reported problems at hospitals, GP surgeries and pharmacies, along with 13 NHS bodies in Scotland – and no doubt the early part of this week will result in more problems as staff come into work and switch their PCs back on.

The hack which targeted Windows machines was miraculously stopped in its tracks from spreading by a young security expert (under name @MalwareTechBlog) who accidentally hit the kill switch on the malware by registering the hard code as a domain name which had been seeded by its creator

SAFEGUARDS:

There are some urgent checks that all companies and organisations should be making in the next 24 hours:

  1. Ensure you are up to date on patching your environment– a lot of organisations were caught out because they didn’t (and Microsoft released a patch for the vulnerability exploited by WannaCry in March 2017).
  2. Check your Anti Virus is up to date (and preferably use a cloud based service ie Webroot)
  3. Ensure you back up all your essential data in line with your businesses Recovery Time Objective (RTO) and Recovery Point Objective (RPO), so you can’t be held to ransom and fearful of operational losses.
  4. Communicate with your staff to alert them to avoid clicking on any suspicious emails and making sure that your operating system software is up to date (it was a rare move for Microsoft to release security updates for unsupported software such as XP as a direct result of this event)

Companies that want advice on data security, can contact Amicus ITS in confidence on 02380 429429.

 

HCI, waking up the storage market – the new must have for enterprise and SMEs

What’s got us talking?

Amicus ITS has secured a major new contract for Hyper-Converged Infrastructure and will be providing professional services to deploy and implement the solution for the customer.

What is Hyper-Converged-Infrastructure (HCI)?

In our fast changing technology world, hyper-convergence is the latest new buzzword and a topic that is exciting many here in Amicus ITS.

Hyper-convergence grew out of the concept of converged infrastructure. Under the converged infrastructure approach, a vendor provides a pre-configured bundle of hardware and software in a single package from different hardware vendors.  Hyper-converged systems are modular systems designed to scale out by adding additional modules.  The magic is that HCI requires only a single vendor’s server platform and a ‘single pane of glass’ management console.

Enabling integrated technologies to be managed as a single system through a common toolset is a big step forward and to assure flexibility, HCI systems can be expanded through the addition of nodes to the base unit. Hyper-converged infrastructure streamlines the deployment, management and scaling of datacentre resources by combining x86-based server chassis and storage resources with intelligent software in a turnkey software-defined solution. Separate servers, storage networks and storage arrays can be replaced with a single hyper-converged solution to create an agile datacentre that easily scales with our customers’ business.

Why is Amicus ITS so excited by HCI?

We are constantly looking to keep ahead of the technology curve and stay one-step ahead of the MSP competition.  By taking solutions to our customers that add true value to their business, this gives us real opportunity to demonstrate forward thinking and benefits all round.  Amicus ITS has the confidence of combining the right technologies with our most important assets, our people and our proven processes – to build comprehensive and compelling solutions, fit for tomorrow.  Wrapped with Amicus ITS’ quietly assured Managed Services capabilities, it creates a powerful combination of positive results for both sides.

Whether a customer wants an HCI solution delivered that they manage, or an HCI solution that Amicus ITS as an MSP looks after – what this shows is that to be a fit MSP in today’s market, you cannot go on just selling traditional three-tier architectures with their associated multiple different technologies, higher costs and greater complexity.  This swallows up greater day-to-day management resource, as well as the people and skills to support and maintain a wide variety of servers, storage, networking and software management technologies.  At scale, this can be challenging as it increases the chance of incompatibilities and administration overheads.

HCI appeals because it radically simplifies infrastructure for the customer and enables smooth management processes to wrap around it.   So, it’s time to slim down and de-mystify the technology and show what is really good out there for our customers – and here, utilising what was designed for Google and Facebook always available engineering, as a technical model for both enterprises or SMEs.   Being forward thinking and flexible in our consultative approach – where the solution benefits both the customer and MSP, it’s a win-win for both.

 

 

 

 

 

 

Amicus ITS Awarded Full Certification For Cyber Essentials Plus

cyber-essentials-plus-award-2017_03_03_17

Amicus ITS has announced its award of the higher level ‘Cyber Essentials Plus’ status.  This industry-backed technical security scheme seeks to heighten the defences of companies against threat.  For Amicus ITS with its long history of serving healthcare, regulated industries and blue chip corporates, it was a logical and natural extension of its existing security standards.

Led by Standards Co-Ordinator Emma Purr of Amicus ITS’ Security & Compliance Team, Emma Purr said:  “This was a good team effort, supported by members of our technical Escalation Team.  Cyber Essentials Plus is normally a first step-in for organisations to gain the more stringent security accreditation, ISO 27001.  Cyber Essentials Plus requires a 5-step security approach, whilst information security standard ISO27001 has 114 control requirements in 14 groups and 35 control objectives which must be addressed, so is both very broad and very deep.  However, we’ve done it in reverse, having gained our ISO27001 status back in July 2014. This was however no walk in the park and illustrates the critical importance of ensuring robust defences exist around your business.  Obtaining Cyber Essentials Plus status has further strengthened our resilience and is great to have on show as another recognised security badge”.

What is Cyber Essentials Plus about?

To create the UK Cyber Essentials scheme, the UK Government worked with the Information Assurance for Small and Medium Enterprises (IASME) consortium and the Information Security Forum (ISF) for several years before launching the current system in June 2014.  Backers also include the Federation of Small Businesses (FSB), the Confederation of British Industry (CBI) and various insurance institutions.  Forming a set of comprehensive and challenging technical controls, it endorses compliance for organisations to create better technical protection from cyber attack and misuse of systems.  With standards which are risk-based and prompted by international best practice, they include aspects such as physical security, staff awareness and data backup.

What does Cyber Essentials Plus focus on?

Amicus ITS had to focus on five mitigation strategies:

1.   Boundary firewalls and internet gateways – for any user trying to access any websites which may have malicious content
2.   Secure configuration – ensuring the administration control of all user devices are securely configured, so the rights on what can be downloaded is appropriate and controlled.
3.   User access control eg, new starters only have access to the systems they require as part of their job; special access privileges which are restricted to a limited number of authorised individuals, which includes domain admin and the restriction of selected system administrators to be able to make any changes at a high level to internal systems and security firewalls; plus password strengthening and complexity in relation to service accounts. These get changed regularly – and automatically on the exit of any personnel.
4.   Malware protection – ensuring that relevant antivirus malware software is installed and kept up to date, which scans files and web locations automatically on access to identify they are safe and also to re-endorse the protection against accessing unsafe websites which get automatically blocked.
5.   Patch management – this ensures all software running on company devices are licenced and up to date, installed in a timely manner and that out of date software is removed from devices. Additionally, that security patches are deployed automatically on release.

Anyone wishing to discuss business information security issues or about being supported to obtain Cyber Essentials status, should contact the Sales team or speak to JP Norman on 02380 429429.

cyber-essentials-plus-badge-high-res

Taking ownership of cyber – it involves us all

 

boardroom1

New research by BAE Systems of 984 IT managers and 221 executives from Fortune 500 companies across the world, has found that there is still a damaging gulf in the perception of who should take charge to manage the aftermath of a cyber-attack in an organisation.

• The survey suggested that 50% of IT staff believed boardroom executives should take the lead when it comes to deciding how a company should respond and repair after it has been penetrated by hackers.
• In contrast, more than 30% of Chief Executives said that IT staff should be the ones cleaning up, fixing problems and hardening defences.

This, according to Dr Adrian Nish, head of the cyber-threat intelligence unit at BAE Systems, could lead to organisations not being prepared for oncoming attacks.

Cost of attack
There was also a mismatch when it came to the perceived cost of a breach:  technology bosses believed that, on average, a breach could cost a company about $19m (£15m).  This estimate included fines, legal fees, remediation expenses and compensation for customers.  By contrast, boardroom members put an average price tag of $11.6m (£9.2m) on breaches.

Prevention much better than cure
Ultimately, whatever the price of a cyber-attack, unless organisations have taken the necessary preventative steps, they remain highly vulnerable to not only the cost of breach, but the enormous impact of reputational damage and loss of trust.

Oliver Parry, head of corporate governance at the Institute of Directors commented:   “As with other principle risks to a business, responsibility of outlining this strategy should fall with the board.  Lasting cybersecurity only comes from embedding good practice throughout the culture of an organisation, starting from the top. No system or person alone can prevent indefinitely the threat of a cyber-attack.”

This ties in with one of the main recurring themes for Amicus ITS’ Director of Technology, Security & Governance, JP Norman, who has stated many times over recent years that good education and awareness by staff (the “squidgy bits”) around data security remains central to good defence efforts in thwarting a successful attack.  Commenting recently

“At Amicus ITS we carry out a 3 stage review on a monthly basis with data being collated via our support functions, reviewed at a formal Information Security Committee meeting and further reviewed at every Board Meeting. This enables us to ensure strategy, training and new developments flow in both directions across our company” JP NormanDirector of Technology, Security & Governance.