Learning from Travelex

Due to a cyberattack, Travelex, the world’s largest foreign exchange bureau, has been at a standstill for more than a fortnight. The reputational and financial impact on the company and its senior leaders will be severe. New laws and regulations, like GDPR and NY Shield, mean that such breaches can no longer be swept under the carpet, and the commercial damage will be compounded by huge fines.

Travelex is a wake-up call to all businesses. In today’s cyber-risk environment, maintenance of your basic IT infrastructure and services is critical to remaining profitable and even staying alive. You may be concerned that if a giant like Travelex gets hacked, how can a mid-market company protect itself? It’s less complicated than you might think.

When we engage with clients, we talk about ‘getting the basics right’. A fundamental part of that is making sure the IT infrastructure and services are fit-for-purpose and up to date. If the basics aren’t right, then there’s no hope of looking at ways to use technology to grow the business and get ahead of the competition.

To provide you with a head-start, here are your first nine priorities:

1. Prioritise systems maintenance. All systems and services, particularly those that are connected to the outside world, must be kept up to date with the latest software patches. The IT team or your Service Provider must review and update systems in a regular, controlled manner.
2. Review your backups. Many malware infections encrypt your data and hold it to ransom. Frequent backups mitigate the chance of you losing everything. A regular complete backup of data stored somewhere with no connection to your systems – what’s called an air-gap – will greatly limit the damage of an attack.
3. Get a penetration test. Get a reputable security company to undertake an external penetration test of your systems and services. Resolve all the concerns raised in the results. Find your vulnerabilities and patch them before hackers find them for you!
4. Earn a certification. Spend some money, usually less than £10k on earning the Cyber Essentials Plus certification. The process involves making your technology secure, and we’ve seen clients win new business after being certified.
5. Lock down your data. Each individual in your business should only have access to the data they need to do their job. This minimises the risk of data loss should they leave with it or accidentally click a malware link. Allowing employees wide-ranging access to data is asking for trouble.
6. Invest in protection. Keep the bad guys out with well-configured firewalls, anti-spam email systems, malware detection software, and pro-active Day-0 protection systems.
7. Get some insurance. Cyber insurance covers the losses resulting from a cyberattack. It can also aid with the management of the incident itself, particularly reputational damage and regulatory enforcement. Crime insurance covers the loss of money due to theft, fraud or dishonesty and includes theft of money by hackers. Add these two insurances to your portfolio as separate policies, not just add-ons to existing business insurance.
8. Train your staff. Your employees are the most vulnerable security point in your business. The more they know what to look for and what to do, the better your chances of avoiding an attack. Training is essential for all new starters, and it needs regular refreshing for the whole business – including you!
9. Plan for the worst. Even with all the above nailed down, you still need to be ready for the worst. Sit down with your top team and discuss potential disasters and plan your way out of them. Who would be in charge? Who is authorised to make major decisions on the spot?

Will Travelex survive this attack? Who knows – the reputational and commercial damage may be terminal. But by following these nine steps, you can avoid that fate for your own company.

For more information see our Knowledge Centre about Cybersecurity.

Freeman Clarke is the UK’s largest and most experienced team of part-time (we call it “fractional”) IT leaders. We work exclusively with ambitious organisations and we frequently help our clients use technology to beat their competition. Contact Us and we’ll be in touch for an informal conversation.

13 Key Steps to Cyber Security for Non-Technical Board Members

Cyber attacks can be complicated, but in our experience over many years, most are REALLY SIMPLE and EXPLOIT BASIC WEAKNESSES.

In the vast majority of cases, simple steps can make you safe, or minimise disruption in the event of an attack. But, normally, these decisions are taken by technicians and the Board are not able to effectively challenge or lead.

Here is a simple list of 13 questions and answers to allow non-technical Board members to stop hoping for good luck!

1. How do we get security risks and issues under control?
   Every substantial business should maintain a list of risks and issues, with some analysis of the options and mitigations. Each risk or issue should be owned by someone around the Board table who has the expertise, time and ability to manage it. This document should be reviewed by the Board at least annually. The list and the open discussion drives sensible, productive decision-making and avoids a culture of sweeping issues under the carpet. This approach prevents overspending in the wrong areas – it’s all about “proportionate response”.
2. What kind of insurance do we need?
   Unfortunately, not all Cyber Insurance is created equal and you need to take care to select an appropriate policy and provider. Check the exclusions on the policy and ensure a member of your Board understands the cover. Cyber Insurance may not give you back money that’s stolen from you – that generally requires Criminal Insurance. Check your IT is compliant with your policy conditions – the devil is always in the detail and your IT team or supplier need to know what they have to do to maintain compliance? Finally are your suppliers’ contracts clear about their liability and are they appropriately insured?
3. How do I get staff to take security seriously?
   Security systems can be bypassed by canny criminals because they know where the weak link is … it’s your people. Create a “security culture”, where taking this stuff seriously is encouraged. Ensure you and the Board demonstrate good practice – for example, if you write your passwords on post-its then you should fully expect your staff to do the same… and one day you will probably be hacked as a result. Many hackers exploit helpful staff who simply hand over money! Sound financial processes, clear controls, good education and ongoing training are all vital to security. Remind people to “think before you click”!
4. How do we keep data secure?
   Access to systems and data should only be given to those who need it. This is known as a least-privilege policy. For example, when a person is given access to a system, the default should ensure that person has no rights to anything. Then privileges should be granted according to what that person needs to do in the system, building up to only include the data and processes they require. If you don’t follow a least-privilege system, then you are really exposed to cyber attack, to fraud and to errors. When users’ roles change their access should be reduced if their job doesn’t require it anymore (and their access removed altogether when they leave!)
5. What are firewalls?
   Start by ensuring your office has sensible physical security. Then make sure the equivalent measures are in place for your systems – these are your firewalls. Knowledgeable and trusted experts who understand the complexities of system and firewall management need to configure this equipment and to keep it up to date. Specifically ask them whether they have minimised points of access (ports) and are using secure ports for email and web access rather than standard ports.
6. Why is it important to keep security up to date?
   This should be so simple, but most hacks exploit the fact that many companies fall behind. All computers should use up to date operating systems which are properly patched; utilise up to date anti-virus and anti-malware systems. However these systems only work well when they know what they’re up against. Newer protection systems coming on the market look for programmes acting suspiciously and will automatically shut down the programme before it has had time to cause mayhem. These systems provide protection against new attacks (often called “Zero Day”) because they spot the bad behaviour of an application rather than recognise the malware itself.
7. What is data encryption?
   To protect your data, it should be encrypted and only accessible to those with the approved rights to look at it. Where you have customer data, particularly user accounts and passwords, ask your IT team whether the data is “hashed and salted” which will make it very secure and difficult to break even if your systems are breached. It is unforgivable nowadays to be holding personal or confidential data unencrypted (known as “clear or plain text”).
8. How should we backup our data?
   Your data and systems should also be well backed up and the backup must be stored off-site, preferably with no connection to your live systems (known as an “airgap”). Ensure the backups include multiple versions of the same document in case corruption or malicious encryption took place at some point in the past. Having a decent data backup can be the difference between having a business post-disaster and not.
9. What is a penetration test?
   A penetration test is an assessment by an expert company of your website and network to find weaknesses. This is essential if your website includes custom software or any kind of ecommerce services. Poor technical practices can result in custom software being full of holes and these are well documented in a standard list known as the OWASP top 10. This list are the standard vulnerabilities that almost all hackers focus on – ensure your penetration test includes checks against the OWASP top 10. Simple!
10. Practical but secure password rules.
    Many hackers don’t have to be clever because users make it easy by choosing “password123” – hackers automate attacks testing thousands of obvious passwords until they get lucky! Users must take passwords seriously, choose long passwords that are hard to guess, use different passwords, and don’t share. Software can be used to store passwords securely, but if people must write down details then these must be locked away. Make sure your systems are configured to enforce good password discipline and lock out users after repeated failure attempts. Sensitive systems should be protected by 2 pieces of information, not just a password (this is called “2 factor” or “multi-factor” authentication).
11. Sensible Cyber Attack crisis plans.
    Establish how you will handle a crisis in advance. Who’s in charge if you are attacked by ransomware and decisions need to be taken on the spot. GDPR makes specific requirements about notifying the ICO if you suffer a security breach – who is responsible for making this happen; failure to do so will result in a fine.
12. Why does security certification matter?
    Certification will give a focus and purpose to your efforts to improve security. A good place to start is Cyber Essentials Plus certification. This will provide you with a government standard accreditation that directly demonstrates to you, your company and your customers that you take security seriously and that you’re working to ensure their data is held securely and your systems are well managed. We know of clients that have won new customers simply because they stood out from the competition by having Cyber Essentials Plus accreditation. If your business is complex or has specific security requirements then ISO27001 provides you with a means to go further and embed a “security culture”.
13. Who should be in charge of Cyber Security?
    Someone around the Board table who has the time, expertise and right commercial attitude! This person needs to start by getting clear on what you’ve got – who are the users, 3rd parties and suppliers who access your systems. List your equipment, networks, software etc. What are the crown jewels that really matter and ensure these are these properly protected. If you want a high-class CIO, CTO or IT Director on your side and sitting around your Board table … then that’s where we come in!

You can download and read our full CEO’s Briefing about Cyber, Legal, Compliance here. And a short video about cyber security & compliance strategy for non-technical Board members. Or, visit our Knowledge Centre which includes all content related to this topic.

Freeman Clarke is the UK’s largest and most experienced team of part-time (we call it “fractional”) IT leaders. We work exclusively with ambitious organisations and we frequently help our clients use IT to beat their competition. Contact Us and we’ll be in touch for an informal conversation.

GDPR – The Voice of Reason

Anyone who is involved with GDPR will know that there are always complexities and dilemmas, and these are often not simple and not quick to fix. The important thing is to start, to address the things you can, and to create a plan for dealing with the difficulties as well.

Here are some examples of how we’ve been working with clients, to illustrate the realities – warts and all!

For many of ours clients internal communications has been a major piece of work. Everyone is busy and this can feel like just another problem so ensuring that people buy-in to the issue is critical. This is partly about understanding the potential fines and reputational damage to the business, but you can also help people to relate to the importance of this by talking to them about how they themselves would want their own data to be looked after.

A common theme is making sure people understand what is caught by GDPR and organising discussions around what amounts to personal data. The best way to reduce your problem is to minimise the personal data you collect in the first place – do you really need the data you’re currently collecting? Many companies collect special data about their employees (GDPR defines special data which is particularly sensitive) they don’t really need, or they are not very good at deleting it even when employees leave.

For many companies, the focus is on marketing. For example, our clients in professional services often have lists of business email addresses that they have built up over years. In many cases these databases are not well maintained and they don’t have routines for cleaning and pruning – they just keep on adding to them! Some companies have embarked on a programme to get consent for continued marketing, some are using legitimate interest justifications (as we are).

Manufacturers and supply chain businesses often have lots of supplier data, whereas facilities management, care home or construction companies may have large numbers of staff, some casual or freelance. They may have lots of details about them that they have historically managed quite “loosely”. At the extreme end, we have modelling agencies with large volumes of images and videos as well as passport and visa details.

Many companies need to overhaul some technical aspects of their IT, including things like encryption, password handling, patching and firewall configuration. As well as backup and disaster recovery plans. And of course being clear on where internal responsibility lies for ongoing maintenance of this.

In almost all cases, contracts have needed some improvements to ensure everyone is clear on their duties. This includes suppliers, staff and partners as well as cookie policies, privacy notices and information security standards.

And most companies have no existing plans for dealing with a breach or request from someone to provide or correct or delete their data. As well as creating policies and plans for this, there is a cultural change to focus on honesty and learning, rather than silence and cover-up.

But whenever we can, our aim is to find a business opportunity. For example, in many cases this is an opportunity to engage with the old sales prospects.

Analysing what data you have, how it moves around the business and why is critical to GDPR compliance but it’s also a starting point for improvements. There are always opportunities for greater efficiency, and reduction in errors as well as serving customers better.

In many cases we are able to use GDPR discussions as a spring-board for serious consideration of radical improvements to processes and systems. Bringing data under control not only positions you for GDPR compliance, it’s also the starting point for integrated and streamlined business. And it’s a solid platform for digital initiatives as well.

You might find our previously published articles also of interest :

GDPR: A simple guide for CEOs (and what to do right now)

GDPR Action Plan: 6 months to go

Freeman Clarke is the UK’s largest and most experienced team of part-time (we call it “fractional”) IT leaders. We work exclusively with ambitious organisations and we frequently help our clients use IT to beat their competition. Contact Us and we’ll be in touch for an informal conversation.

Technology Fire Triangle. Part 3: Compliance

Successful businesses are worth protecting. But it is very difficult to strike the balance between investing in the success of your business and spending time protecting it. Safeguarding your assets, managing risks and ensuring compliance is not the natural territory for an entrepreneurial business leader and, quite frankly, for many of us… it’s a bit boring! This is the final part of our 3-part Fire Triangle series where we focus on security and compliance which encapsulates:

1. Understanding your risks
2. Cybersecurity
3. Getting certified
4. Regulatory compliance
5. Process and training

The Technology Fire Triangle. Part 3: Compliance

Successful businesses are worth protecting. Read Part 3 of our Technology Fire Triangle and make sure your business is protected.

Download now for FREE!

Part 1 deals with Systems Integration which you can download here and Part 2 looks at Data which can be downloaded here.

Freeman Clarke is the UK’s largest and most experienced team of part-time (we call it “fractional”) IT Directors, CIOs and CTOs. We work exclusively with SME and mid-market organisations and we frequently help our clients use IT to beat their competition. Contact Us and we’ll be in touch for an informal conversation.

CEO’s Briefing on IT Risks, Compliance and Security

No doubt you worry about growing your business and being successful, but as the business grows and becomes successful, protecting it against risks becomes a new source of worry!

New concerns range from compliance with Data Protection regulations, ensuring the business will survive a climatic event, or fall victim of a cyber attack that destroys all your data.

CEO’s Briefing on IT risks, compliance and security

This briefing explains practical cyber security protection measures to prevent attacks, viruses, hacking, data theft, data leaks, cyber insurance, cyber crime, ransomware, phishing.

Download now for FREE!

This document covers compliance, data management and data protection including DPA (Data Protection Act), GDPR, ICO, PCI (credit, debit and payment cards), FCA and related topics. It explains practical cyber security protection measures to prevent attacks, viruses, hacking, data theft, data leaks, cyber insurance, cyber crime, ransomware, phishing. It also makes reference to backups, system failure, risk management, risk registers, risk and issues logs. It makes particular reference to SME and mid-market companies and specific sectors like life sciences, pharma, defence, builds and construction, legal and accounting, transport, supply. It provides independent advice on anti-virus, patching, IT security experts and IT suppliers, and firewalls. The document covers passwords, audits, audit trails, cyber insurance, security accreditation like Cyber Essentials Plus, and how to get started.

You may like to visit our Knowledge Centre which includes all content related to this topic.

If you’d like to discuss how Freeman Clarke could support your business Contact us now for a no-strings conversation.

CEO’s Action Plan: GDPR – One Year to Prepare!

There is now just one year until the new GDPR becomes law. The new rules are very different, and there is every indication both the UK and European authorities (regardless of Brexit) will be taking this extremely seriously. So we are too.

We are still meeting companies that have done nothing so far, and time is now getting short. But if you get GDPR on your Board agenda now, then there is still time to make the necessary technical and process changes to be compliant.

We have produced a simple slide deck to explain the new regulations and a starting point template for your Action Plan. Below are some samples from this deck.

To download the full slide deck click on the button below. The full deck explains the following:

1. What is GDPR and common terminology being used
2. How will it affect my business
3. Action plan to start now

To download the full slide deck click on the button below:

Click on the button below to download the full slide deck to prepare yourself for GDPR or you can read our further blog post here. If you require any assistance, please get in touch.

We are currently helping many businesses implement a GDPR plan so they are prepared and compliant by May 2018.

If you would like to discuss how GDPR could affect your business and a practical approach to making sure you’re compliant, contact us for a no-strings conversation.