What can be protected without a cybersecurity professional.

Cybersecurity choices in today's worldWhat Protection can be achieved without a Cybersecurity professional?

That is a loaded question, because most professional cybersecurity experts believe that nothing can be done to protect an organisation without said expert.

There are a number of things that can be done to make your business environment secure, but all have to be driven by management with the vision to protect their organisation.

If management, C Level execs, board members and owner beleive that business security is important, vital in fact, then it will be picked up by everyone else in the organisation.

The introduction of cloud computing and everything stored in the cloud has exposed more and more data. This data is targeted by the bad guys.

Here are 6 tactics that can be implemented by any organisation without the need for a security expert

Patch it

The constant barage of patches and updates that come from microsoft, apple and android are exceedingly annoying.

In fact they can have an impact on business.

The reason that they are produced is to protect the operating system.
Patches are developed because someone, somewhere has found a way to compromise a piece of software, the manufactrer has found out about it and the software has been rewritten or changed to stop it from happening.

These changes are called patches and are BENEFICIAL to you. Every organisation needs to have a process to implement those updates.

Complex Password

Passwords have to have 3 requirements.

They have to be complex, any character on the keyboard should be and can be in a password. Letters, numbers, symbols all mixed together to create a complex password.

But, it does not stop there – they also have to be unique, different for every digital location and that have to be longer that 10 characters.

We use to specify 8 but changes to technology and the speeding up of processing power has reduced the time needed to crack an 8 digit password.

2 factor authentication

Any additional protection to data is a good idea.

Two factor authentication relies on three things instead of two to access the information.

It is addirional to username and password and is only triggered if the combination of the first two is correct.

In todays world, we all have a mobile phone, this is used as the two factor authentication process.

User name, password and a code delivered to your phone means you are verifying who you are.

Separate and segregate data.

I can think of three areas in any organisation where information needs to be separated.

Email, financial data, trade secrets have seperate requirements within an organisation.

You do not need to have everyone access financial data.

In the old days it was called compartualisation, need to know. Today it is still very relevant.

Train and educate everyone

There are many free or inexpensive training and education programs available to suit any organisation.

Training needs to be focused on the individual.

Everyone needs to understand why the organisation is protecting the data, why certain things are done in a certain way but most improtantly why the organisaion is trying to protect their staff, clients and finances from the bad guys.

Back it up.

You never know when you are going to experiance a cyber event.

You have to know what information needs to be protected, how often it is accessed and what will happen to the organisation if that information is compromised or lost.

This should be part of your business risk management plan. (You do have one of those?)

The other part of backing it up is to test it.

All of these can be done without the aid of a professional cybersecurity expert.

There is one additional tactic.

Remain vigilant.

The bad guys are everywhere.

They target you, not because you have something worth stealing, but because you are connected to the digital world and you think that is a good idea.

The days of the gentalman cyber criminal are well and truly gone.

Everyone is out for themselves and even a basic hack, malware attack or cryptovirus can shut down your organisation.

Cybersecurity is your responsibility!

Roger Smith is funny, scary, on point and is focused on one thing – increasing everyone’s awareness and understanding of the problems and issues associated with the digital world.

He is the winner of the worldwide 2018 Cybersecurity Educator of the Year award and was Runner up in 2017 .

He is a highly respected expert in the fields of cybercrime and business security and is a Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity) on Cybercime, Cybersecurity and the hacking techniques used by the digital criminal.

He is an Amazon #1 selling author on Cybercrime with his best selling book, Cybercrime a clear and present danger, going to number one on Amazon.

He is the primary presenter for the Business Security Intensive (BSI) and author of the Digital Security Toolbox which is given away for free at the BSI.   He is a speaker, author, teacher and educator on Cybercrime and an expert on how to protect yourself, your staff, your clients and your intellectual property from the digital world.

Cybersecurity – we still do not have the correct focus!

focus on cybersecurity

With the expected $660 billion loss to cybercrime this year, we definitely have to change our understanding, our focus and most importantly our attitude when it comes to business security and cybersecurity.

We have to stop with the simplistic crap – I have been guilty of this myself but we have to stop.

Cybersecurity is not only about AV, firewall and patching.

Doing one is good, but the attitude of doing all makes you bullet proof is definitely stupid thinking in today’s business world.  The number of SME’s that adhere to that thinking is phenomenal.

Cybersecurity is about knowing your data, the location of your data and more importantly protecting it from people who should not have access to it.

It is about risk management and understanding that all risks associated with your data have been mitigated, differed or migrated.

There is a whole ecosystem of things that have to be done, as fast as possible, to reduce the risk of a cyber event, but the simplistic keeps getting in the way.

Attitudes like too small, nothing to steal and she’ll be right abound, and really does show that most people have a basic disdain for protecting their organisations.

Until this attitude changes, the basics are the only things that will be applied.

Introduction of the NIST framework (any framework), implementation of SOC and SEIM environments, an acceptance and adherence to policies, process and procedures and a basic understanding of what the bad guys are capable of is absolutely paramount for any organisation going forward.

But, we still rely on just or only the basics.

Without a change we will still go through the same solutions expecting a different outcome.   Definitely stupid thinking.

We forget the capabilities of today’s cyber criminal.

  • They are well educated in ones and zeros, in other words – the digital world.
  • They know how to bend and break the rules that society relies on to be a society.
  • They know how to bend technology to do things that even the designers never thought of.
  • They have a vast range of motivations to do wrong, and
  • They do not give a stuff about you.  To them you, your family, your business are cannon fodder.
Applying this knowledge to your business environment makes you realize that sitting ducks abound and improving your status is paramount.

To change, you need help in changing.

Changing the attitude, getting and listening to advice but more importantly actioning what needs to be done is the only way forward.

There is still one fundamental issue, in most cases, you do not know what you do not know.

Getting advise from experts is important.

You can no longer rely on the jack of all trades, someone who knows computers or thinks they know the digital world.

You need an expert!

You need an expert to stop a cyber event from compromising your organisation.

You have to find the time, the expertise and the financial motivation to make change, but you need an expert to put you on the right path.

If you cannot find it internally then you have to go outside your organisation.

 

Roger Smith is funny, scary, on point and is focused on one thing – increasing everyone’s awareness and understanding of the problems and issues associated with the digital world.

He is the winner of the worldwide 2018 Cybersecurity Educator of the Year award and was Runner up in 2017 .  

He is a highly respected expert in the fields of cybercrime and business security and is a Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity) on Cybercime, Cybersecurity and the hacking techniques used by the digital criminal.   

He is an Amazon #1 selling author on Cybercrime with his best selling book, Cybercrime a clear and present danger, going to number one on Amazon.   

He is the primary presenter for the Business Security Intensive (BSI) and author of the Digital Security Toolbox which is given away for free at the BSI.   He is a speaker, author, teacher and educator on Cybercrime and an expert on how to protect yourself, your staff, your clients and your intellectual property from the digital world.

“She’ll be right”, is not cyber event protection!

A cyber event is not a punch line.   It is a serious effort to derail your organisation.

Cyber event protection?

If an attack is intentional then you need to manage the risk.   If the attack is accidental or random then you have to understand the implications.

Understanding what is happening in your industry, your supply chain or other areas of the digital world is important.

The implications to your organisation could be a flow on effect of a cyber event on the other side of the planet.

To us humans it is 10,000 kilometers away in the digital world it is just a click.

Our understanding of the digital world for most organisations is mainly focused on client management, communication and service delivery.

CRM, sales, marketing, email, data and information are all woven into the fabric of improving the bottom line.

What can we do with the tools available without spending too much money but with a significant return on the money invested in the organisation.

10 years ago any business who was on the cutting edge of technology had the ability to multiply their revenue by a factor of 10.

Today everyone is using the same products and services to improve the bottom line.

Technology is no longer the multiplier that it use to be.

But, security of that technology is!

The news of significant hacks like Ashley Madison, Target, Yahoo and Equifax have created startling headlines but have they changed the attitude of business organisations world wide?

No they haven’t!

The problems with raising awareness to the true cost of a cyber event is not understood by most people.

“It will not happen to me” or the colloquial response of Australians – “she’ll be right” significantly reduce your ability to handle a cyber event and to come through one with the organisation intact and still functioning.

Making the simple attitude change, “it could or may happen to me”, has a significant impact on any organisation.

The change in mindset, a couple of words in a statement, starts people down the road to better protection.

Isn’t it about time that you made that change?

Once you have made that change, questions and answers start to be heard.

  • How about we put a policy around this process.
  • How about we put processes and procedures around the database.
  • How about we put together a disaster recovery plan.
  • How do we get back to business as usual – lets put together a business continuity plan.
  • How about we educate our troops so they can recognize an attack.
  • How about we invest in new technology.

All good ideas that would never come about if we believe we do not have a problem.

If we persist with an attitude of “she’ll be right” I can guarantee that we will not.

Roger Smith is funny, scary, on point and is focused on one thing – increasing everyone’s awareness and understanding of the problems and issues associated with the digital world.

He was Runner up in the 2017 worldwide Cybersecurity Educator of the Year award and has been nominated for the 2018 Cybersecurity Educator of the Year award.  

He is a highly respected expert in the fields of cybercrime and business security and is a Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity) on Cybercime, Cybersecurity and the hacking techniques used by the digital criminal.   

He is an Amazon #1 selling author on Cybercrime with his best selling book, Cybercrime a clear and present danger, going to number one on Amazon.   

He is the primary presenter for the Business Security Intensive (BSI) and author of the Digital Security Toolbox which is given away for free at the BSI.   He is a speaker, author, teacher and educator on Cybercrime and an expert on how to protect yourself, your staff, your clients and your intellectual property from the digital world.

What every CEO and CIO should know about cybersecurity

The problem with cybersecurity is it is not sexy.

In most cases it is down right boring.

Although not sexy and down right boring it is still something that every CEO, manager, owner and board member has to focus on.

With all of the automated attack vectors available to the cyber criminals, we can no longer say we are not a target. We cannot say we have nothing worth stealing.

The more and more reliant business has on the digital world the greater the chance that a cyber event will cripple the organisation.

What are the main things that every management type needs to focus on when it comes to prevention of a cyber event.

Here are a few!

The cost of a cyber event.

The cost of a cyber even can range from lost time and functionality within the organisation to more money than the organisation can find to pay for the breach.

Cryptovirus is an example of lost time and functionality. If you do not have a functioning and tested backup of the data, you have to rebuild the offending device but you will also have to also replicate all of the data.

A full blown breach by a dedicated black hat hacker can steal everything and then use your system as a platform to target your clients, suppliers and staff. When that happens you realize that you are NOT too small to be a target

How they get into your system

The go to weapon of most cyber attacks is social engineering. Two parts of a very effective attack strategy. The technology to effect change, follow a link to an infected website, click on an ad in social media or open an attachment in an email, combined with getting you to trust them where you let them in.

Either way they are now in.

Risk and problems just compounded.

Simple ransomware for instance, the initial encryption of data is only one of the stages of the attack. What about stage 2,3 and 4.

Wannacry showed us that a combination of 2 attack vectors allowed a single infection to traverse a whole network. One computer is a problem for any organisation. All of the computers is a nightmare.

The protection challenges

In most situations managers, owners, executive and board members do not understand the digital realm. Risk management of data (a critical component in today’s business world) is often overlooked and considered an ICT problem.

Its not! Today’s digital security challenge is everyone’s issue and the sooner it gets noticed as a business risk and treated as such the faster we will see a reduction in attacks.

From the largest organisations to smallest single entities, we all keep critical data in places that are easily accessed, relatively unprotected and mobile.

What are you doing to manage the expected cyber events that could cripple your organization?

There is no single, simple fix. If there was everyone would be safe.

It is a complex issue and one needs to dedicate some time, money and expertise to understanding the issues and risk associated with a cyber event.

Come to one of my intensive workshops it will open your eyes on your business requirement to be safe as an organistion.

Roger Smith is funny, scary, on point and is focused on one thing – increasing everyone’s awareness and understanding of the problems and issues associated with the digital world.
He was Runner up in the 2017 worldwide Cybersecurity Educator of the Year award and has been nominated for the 2018 Cybersecurity Educator of the Year award.  
He is a highly respected expert in the fields of cybercrime and business security and is a Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity) on Cybercime, Cybersecurity and the hacking techniques used by the digital criminal.   
He is an Amazon #1 selling author on Cybercrime with his best selling book, Cybercrime a clear and present danger, going to number one on Amazon.   
He is the primary presenter for the Business Security Intensive (BSI) and author of the Digital Security Toolbox which is given away for free at the BSI.   He is a speaker, author, teacher and educator on Cybercrime and an expert on how to protect yourself, your staff, your clients and your intellectual property from the digital world.

Cyber event – Why does it take so long for answers?

Have you ever thought to yourself – that hack – Cyber Event –  happened 6 weeks ago why do we not yet know what happened?

The problem with today’s cyber events is actually how complicated and complex that hack or breach was to achieve.

Like every criminal they like to cover their tracks and there are a huge variety of ways to do that in the digital world.

How many out there have fudged on our profiles – old photos (missing the gray hair), wrong birthdays, wrong year of birth.

So the first problem – who just hacked my system?

Everything can be fake.

If you, an honest law abiding citizen, can lie on your profile why then can’t the bad guys.

We only lie about our profile out of vanity, they do it because they are legitimately trying to hide.

This is the first hurdle when it comes to identification.

Little or no information.

In addition they use what we call handles – think old radio speak “over and out rubber ducky”.

Today’s handles are a little more complex, or they convey some level of anonymity.

The calling card of a cyber event

The calling card of a cyber event

The second problem – what system did they use to hack my system?

The internet is full of systems, information and attack weapons that are easy to use, have large quantities of how to’s, help and videos.

That is just the internet.

If you want to know more get onto a chat room on the dark web and see what happens.

In addition to this there are also a vast range of ‘Proxies’.

These are devices and systems that have either been hacked and the owner has not discovered it or have been put together in other countries and locations specifically used as a way to hide the next attack.

The third problem – what has actually been stolen?

Everything today is data.

If I steal money from your credit card or bank account it is noticeable in the real world. I can see that someone has removed money from my possession, in some way. Stealing money from you then comes down to making you trust the transaction.

If I can steal $20 from you with an illegal pay wave transaction will you notice it?

But data is different. When i steal data from you, the information stays in the same place.

I am stealing a COPY of that information.

What I now do with that information will not have an impact on the original copy of the information.

If I have removed that data, how do you know that I have done that?

Each one of these steps can take hours, weeks, months or years to unravel. In that time the general public, industry, regulators, government and press are screaming and carrying on. To find out what happened.

Roger Smith is funny, scary, on point and is focused on one thing – increasing everyone’s awareness and understanding of the problems and issues associated with the digital world.
He was Runner up in the 2017 worldwide Cybersecurity Educator of the Year award and has been nominated for the 2018 Cybersecurity Educator of the Year award.  
He is a highly respected expert in the fields of cybercrime and business security and is a Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity) on Cybercime, Cybersecurity and the hacking techniques used by the digital criminal.   
He is an Amazon #1 selling author on Cybercrime with his best selling book, Cybercrime a clear and present danger, going to number one on Amazon.   
He is the primary presenter for the Business Security Intensive (BSI) and author of the Digital Security Toolbox which is given away for free at the BSI.   He is a speaker, author, teacher and educator on Cybercrime and an expert on how to protect yourself, your staff, your clients and your intellectual property from the digital world.

 

What is the difference between a Penetration Test and a vulnerability scan?

Ransomware for Medical devices – what happens then?

One of the biggest problems with our bright new shiny digital world is everything we do or use today has some level of digital components.
We know that everyday computers, smart devices, mobile devices and gaming platforms, are digital in nature.
We forget that Fitbits, Internet of Things devices and medical devices also have some level of digital incorporated into them.
So what happens to these devices if they become infected with malware, even worse if that malware is a ransomware.
If I had a pacemaker installed in my body and the medical staff lost control of it (that is what malware and Ransomware does, removes their control and gives it to someone else) I think that I would get a little panicky.

Definitely a WTF moment.

Most medical devices are either WiFi or blue tooth enabled.   That makes them relatively easy to break into.
Researchers have been looking at compromising medical devices and in 2015 there were 25 known vulnerabilities in some of the most popular devices.   What about the unknown ones, how many of them were there?
We all saw what happened with IOT devices when Mirai was released on the internet late 2016.   It compromised a certain level of device that had a hard coded username and password in the system.
We also saw what happens when the wannacry ransomware hit and the fall out from that in May 2017.

Now imagine a wannacry variant that targets your pacemaker.   “Give us $1000 or we stuff around with your heart!”  That would certainly make your life pretty interesting.
What’s to stop it happening?   Whats to stop it happening right now?
I keep coming back to people taking responsibility for the code they write.   I think we need to have a serious look at our new and shiny world and do something about it.  Before it is too late and people start dying!

We need to think things through.

Think like the bad guys.
Oh, and before you say “why would they target my pacemaker?” In most cases it is because they can.
Roger Smith is a highly respected expert in the fields of cybercrime and business security and is a Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity) on Cybercime, Cybersecurity and the hacking techniques used by the digital criminal.
He is an Amazon #1 selling author on Cybercrime with his best selling book, Cybercrime a clear and present danger, going to number one in 3 sections of Amazon.   
He is the primary presenter for the Business Security Intensive (BSI) and author of the Digital Security Toolbox which is given away for free at the BSI
He is a speaker, author, teacher and educator on Cybercrime and an expert on how to protect yourself, your staff, your clients and your intellectual property from the digital world.


What is the difference between a Penetration Test and a vulnerability scan?

Duty of Care in a cybercrime world!

We are all connected in today’s world through the invisible and mostly unknown world of the internet.
We practically do everything in “cyber” space.   From ordering food, organizing a date to storing our whole lives in bits and bytes.
Email, social media, web and mobility are all driving our world.
Everything is connected to the internet!
So who is responsible for making sure all that information, all of those little bits of information is safe.
Is it the person who supplies that information?
Is the organisation collecting it and storing it?
Is it the Governments responsibility?
We all know that it can’t be the people who are are collecting and storing the information.   The giants of the internet tell us they are just a platform!
We click through all of these legal documents, acceptable use policies, that have been designed to protect them from practically every eventuality.
SME’s don’t have that luxury.   Our reputation is our only constant and we need to keep it safe.   When it comes to SME’s, ask these questions.
What is the difference between a Penetration Test and a vulnerability scan?

What is the difference between a Penetration Test and a vulnerability scan?

If you are collecting that information – What’s your duty of care?   

Have you done everything in your power to protect that information?
Have you done everything to comply with all of those regulatory requirements that make doing business difficult?
To support your clients, customers and staff are you protecting their information?
If you are supplying the information – what is your duty of care?
Have you asked the simple question, how much information am I putting out there.   When I take a photo and upload it to social media have I removed the geo tags.
When I get into a conversation with someone on social media am I checking their “humanness”, are they really that person?
Am I mistrusting everyone, am I paranoid about everything, am I aware of some of the things that can significantly impact my life, both in the real world or in the digital.
These are the questions that we need to ask and here is some advice.
In today’s world have you done this?
  • “TRUST NO ONE”
  • Be aware
  • Get paranoid and
  • Use some common sense.

Roger Smith is the CEO of R & I ICT Consulting Services, Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity), Amazon #1 selling author on Cybercrime, Presenter for the Business Security Intensive, author of the Digital Security Toolbox and Digital Security Framework.   Rapid Restart Appliance Creator.   He is a Speaker, Author, Teacher and Educator on cybercrime and how to protect yourself from the digital world. 

6 cybersecurity countermeasures your organisation needs right now

Modern organisations use and need access to today’s technology but understand little of the actual underlying systems.

This creates a huge problem for the cybersecurity of the organisation.

With due diligence to the fore you would think that implementing a cloud solution would be relatively easy, everyone is doing it and of course it will make the organisation more competitive.

But will it?

Today’s organisational technical environment are a hash of unrelated systems needed to fit a niche requirement, combined with the least available spend and with the best return available.

It is no wonder that inter operability becomes a huge problem when combined with the cybersecurity aspects of protecting the organisation.

Now tie that in with the business compliance requirement and you can see how big a problem business security becomes.

There are a number of strategic requirements that can be used to make the organisation more secure.

They are:

Education

Teach your children well, never mind the children, teach your staff an understanding of cybersecurity and securing your business. Your staff are usually the first line of defence and the last line of resistance.

They will see something happen, open an attachment, follow a malicious link and they need to be able to recognise what they have done and then do something about it.

Realise that they have gone to a malicious website and unplug the network card.

Technology

Invest in the best.

The newest operating systems and applications, the best firewall you can afford to buy, the most secure wireless and VPN system.

They are all important in protecting your organisation.

But, they all need to be updated and patched as required.

Data management

Who has access to what and what can they do with it. Where is it stored and have you got a backup of all critical data.

Those questions are all part of the risk management component of an organisation.

When it comes to risk and data always err on the best protection that you can afford.

User access

Restrict access to system.

Need to know, yes its an old saying but it still has currency in today’s world.

Make it a rule that no administration account has access to the internet or has an email account. These are the primary attack vectors for a cyber criminal.

Policies, procedures and processes

Build them and they will protect your organisation. There is a fine line between over restrictive and non existent.

All of the three P’s should be designed to support business functionality.

Back it up

No matter the expense, an investment in a backup strategy, a disaster recovery plan and a business continuity plan can mean the business will survive a silly mistake.

No matter the situation a decent strategy around recovery will save you every time.

Your organisation can come to a complete stop with one interaction with a dedicated bad guy. Make sure that you are not exposing your organisation to that problem

Everyone within the organisation has a requirement to look for the signs that depict a cyber attack.

Use them, educate them and make sure that everyone knows that the requirements are within their job purview.

Roger Smith is the CEO of R & I ICT Consulting Services, Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity), Amazon #1 selling author on Cybercrime, Presenter for the Business Security Intensive, author of the Digital Security Toolbox and Digital Security Framework.   Rapid Restart Appliance Creator.   He is a Speaker, Author, Teacher and Educator on cybercrime and how to protect yourself from the digital world. 

Stopping Cyber Events, It’s all about focus

Until the people in charge, managers, board members realize that

  • cyber crime is not going away,
  • no one is immune and
  • protection is everyone’s problem but needs to be addressed from the management down

We will continue to have spectacular cyber events.

Spectacular cyber events that cross over from the internet into the real world.

Stop the blame game and focus on the solutions.

The solutions need not be expensive, but they have to be implemented.

They are your first line of defence.

In today’s social media driven world any mistakes will be highlighted, in some cases spectacularly.

People no longer keep they mouths shut.

They open their mouths for political gain, to score points, to settle old scores, for just plain vindictiveness or they are just being idiots.

The information will come out.

The information will come out whether you want it to or not.

I was told something a long time ago.

It was called the today tonight test.

and i think that it still applies today.   If i had made a mistake and someone put a TV camera and microphone in my face would I still be able to say that i acted in the best interests of what ever i am talking about.

If i could then OK, if not why not?

Armed with this piece of advice I have kept it in mind with everything that I have done since.

I think it is about time that government officials, politicians, board members and C level executives went back to applying the same principle.

If you stuffed up, admit it, take the bumps and bruises and get on with fixing the problem.

The Japanese attitude of fixing the problem not assign the blame is really important in today’s world.

The rain of cyber events

We are all still looking to assign the blame

In the last cyber attack (wannacry) the blame game has once again come to the fore.

  • Stop thinking that the cyber event will not happen – it will
  • Stop thinking that the cyber problem is going to go away – it will not
  • Stop thinking that investing in cyber event prevention is too expensive – it is not
  • For F!?k sake, Just stop

Today’s cyber criminal needs you to think that the operating system is fine even though it hasn’t been updated or patched in years.

Needs you to think that easy to remember passwords are not a problem.

Needs you to think that your staff are informed or trained enough to prevent a cyber event – they are not

Needs you to not invest in better security around everything digital.

Needs you to think that the whole cyber problem is an IT problem.

The cyber criminal is happy that you think that, because that is how they get in.   Once in, well we saw the repercussions on the weekend of the 12 May 2017.

Roger Smith is the CEO of R & I ICT Consulting Services, Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity), Amazon #1 selling author on Cybercrime, Presenter for the Business Security Intensive, author of the Digital Security Toolbox and Digital Security Framework.   Rapid Restart Appliance Creator.   He is a Speaker, Author, Teacher and Educator on cybercrime and how to protect yourself from the digital world. 

Why Business Security is a specialised field

I am sorry, but if I hear another IT person or manager express that they do not know how they were target by malware when they have Anti Virus I am going to scream.

The issues and problems associated with Business Security needs to have a different and more refined and robust focus than normal IT.

They need to focus on what the bad guys are actually capable of.

Normal IT, in most organisations, have a primary focus of keeping the lights on, making things work and keeping it functional.

We have to stop thinking that Business Security is the realm of IT, because it is not.

Business Security is a whole of business process and HAS to be treated that way.

This is why you need a professional who is focused on the security component of an organisation.

Someone who can cross all of the areas of the business and get all levels involved in the process.   For small and medium business, this is an expense that few can afford.

The ways that a system and organisation can be compromised are numerous, and in most ways are practically invisible to small and medium sized organisations.

There are also numerous reasons that they are targeted, but automated systems are the primary contender.

The only reason they are targeted is that they are connected to the internet.

The bad guys need no other excuse than you have a digital device and it is connected to the internet.

In addition small and medium organisations do not have the three things that are vital to protecting the organisation:

  • Skills
  • Time
  • Money

Investing in these things are normally outside the purview of ordinary business.

Its not from want or trying.

Most want to be secure.

They just do not know how to get to that next level, and if they knew would not have the above resources to make it happen.

Cybersecurity / Business Security is a typical catch 22 situation.

Professional Business Security Support

You need to invest in the skills, time and money but do not have the skills, time and money within the organistion to be able to apply what you need.

This is why you need a framework.

A framework that is going to apply a progressive protection strategy around the business.

That framework can be any of the available frameworks but for small and medium business i think that mine would be a great place to start.

My framework puts technology, management, adaptability and compliance into a system where each additional components makes the organisation just that little bit more secure.

Try it here

In addition a managed Security Service Package is a great way to make your money, expertise and time go a lot further.

Most MSSP’s will look after all of those critical components of an organisation.

They have the skills to do it, they have the expertise to make it more secure than an untrained person and will definitely make your money go a lot further.

Roger Smith is the CEO of R & I ICT Consulting Services, Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity), Amazon #1 selling author on Cybercrime, Presenter for the Business Security Intensive, author of the Digital Security Toolbox and Digital Security Framework.   Rapid Restart Appliance Creator.   He is a Speaker, Author, Teacher and Educator on cybercrime and how to protect yourself from the digital world.