Latest / The HIDDEN Podcast by Babble / Episode 2: Cyber Security Made Simple: A Six-Area Framework for SMBs
Transcript
- Lynn Murape: Welcome to the HIDDEN™ Podcast, where we simplify cyber security and all things tech for those of you who, like need it to be explained without all the So if you've ever wondered why you still feel vulnerable even though you've bought all the fancy tools, come to the right place. ⁓ your host, Lynn Murape and job is to take one of our resident experts and help them translate their cyber expertise into plain This means having practical conversations That's a wrap on today's episode of the HIDDEN™ podcast. If this episode gave you an aha moment that helped you untangle something that's been bugging you, subscribe and share it with a friend who's in the same boat. And if you're wondering where you stand across the six HIDDEN™ layers, our cyber security snapshot in the description below. a lot less painful than a breach. Until next time, don't let your risks stay HIDDEN™. studio today is none other than Adam Bearder, the creator of HIDDEN™, you guys. So exciting. So thank you for being Adam. Adam Bearder: Thank you for having me, Lynn. Pleasure to be here. Lynn Murape: Awesome. usually built around Babble's HIDDEN™ cyber security framework, which we break down in the show. Or sometimes we'll take a hot topic in the tech industry, like a major breach or a new legislation, and we'll explain how we help you stay ahead. Basically, this podcast exists so that you can sleep well at night, preferably not during the podcast. So, before we dive into the of episode, Adam, do you mind telling ⁓ our friends or watching out there a about yourself in terms of what you do and where you live? Adam Bearder: Absolutely, yeah. So as you said, Adam Beader. My main role here at Babble is a product manager for cyber security. have the wonderful of the relationship management for our partners in the cyber space ⁓ and also we actually of build our go-to-market offerings, the products and services that wrap around it and where unique sort of assets sit for Babble and sort of what makes us different in market. So I really enjoy sort of building on ⁓ that and function there. And yeah, really pleased with what we're doing at the moment and the direction we're wanting to take our customers on. Based in Sheffield, ⁓ or actually just outside of Sheffield in the UK. ⁓ pretty good access to most of the UK get about many of the Babble offices. Lynn Murape: Nice, love to hear it. And you have already preemptively answered next question, which is, what do you like most about what you do outside of these cool new frameworks and being a notable guest the podcast? But yes, you've already touched on that. ⁓ so today we formally introducing the framework by addressing a little bit of uncomfortable question, which is, if ⁓ something went wrong tomorrow, do you know your weakest link or your point of entry? So lot to unpack there, but before we dive into the HIDDEN framework, we'll start with a common scenario. So let's a business has a firewall, they antivirus backups, and maybe something fancy like endpoint detection response, which also known as EDR. So on paper, they are secure, right? They have all these tools in place. But Adam in your opinion, why would they still feel exposed? Adam Bearder: think it's the versus reality. ⁓ You have the tools, you may have the technology in place, ⁓ but do they all connect together? Do you have the right processes behind them? ⁓ And think that can often ⁓ instill little bit of a lack of confidence ⁓ and ⁓ the around actually what if this happened, how do we as an organisation handle those certain circumstances. I think that's certainly what would be probably sort of top of mind for a lot of business leaders at the moment is, we've bought those technologies, but do we truly understand how to use them? Lynn Murape: As you or watching out there know that this podcast is exactly answering that question as to I've spent an arm and a leg on cyber security. ⁓ Why am still feeling exposed? Why can't sleep well at night? And that's exactly what HIDDEN was created tackle essentially. ⁓ So, you it's evident the underlying issue here with these businesses that invest in all of this Adam Bearder: Yeah, exactly. Lynn Murape: technology is not a lack of technology per se, right? But it's not having that structure to tie it all together as you've just said. So this question is a two-parter. Firstly, what is tool sprawl? And then how does it increase risk rather than reducing it? Adam Bearder: Mm-hmm. Yeah, so I think sprawl sort of first of all, ⁓ led in different directions via either specific advertising or sales on technologies and tools for So there's many arms and legs of cyber security today, whether that be protecting your people, them, whether that be going down into how you secure your data, ⁓ how do you an entry. by either firewall or detecting on devices. ⁓ all ⁓ technologies, tools, different vendors that are supplying those services. ⁓ sort of on top of that, they're producing alerts. ⁓ producing sort of actions, remediations that need to be taken because of it. ⁓ so within that, it's very easy for certain areas of that to get missed. So you may have implemented it, but what again, to the sort of comment before is what processes have you wrapped yourselves up around to actually ensure that you handle certain scenarios when they arise? How do those alerts make sure that they hit that individual's either inbox or ⁓ management tool that they're using to centrally go and say, we need to take action there and do something about either that device or ⁓ activity might be taking place a certain Lynn Murape: Got you. Just to be clear, just to make sure I'm on the same page as you, you know, when we talk about these alerts, are you referring to endpoint response that I had ⁓ earlier? Is that? ⁓ okay. Adam Bearder: Mm-hmm. I mean, absolutely could be that, but it could be as simple as of alerts where an individual has clicked on a phishing link an email. And there's and technologies in there that would alert, let's call it engineer or an admin to that activity. But if no one's properly taking actions upon that, they're still going ahead with the phishing Lynn Murape: Right. Right. Yeah. Adam Bearder: expectation of what that particular attacker was after. Lynn Murape: Yeah. Yeah, a little bit bleak, of course, when we talk about cyber security. It's difficult to find that happy medium. I mean, this is the reality of things. And I love the fact that you brought up, ⁓ know, people clicking on phishy things, because that is the very next episode when we about, you know, how to ensure that people have the right behaviour and things like that. We call it human risk. But yes, that is definitely upcoming after this episode. So be sure to tune in for that one. But switching gears and coming back to this Adam Bearder: Yeah, it is. Lynn Murape: episode, we hear the word maturity thrown around all the time, especially when we talk about cyber security, right? So Adam, what does this actually mean in practice? Adam Bearder: Mm-hmm. Yeah, I'm quite careful with the word maturity. It can certainly get overused and ⁓ quite sort of an abstract way of looking at it. But in practice, ⁓ effectively means a way of understanding how your exposure currently sits, how well are you protected in certain areas of that and ultimately ⁓ what you need to fix next? So ⁓ have understood the gaps? Lynn Murape: Mm. Adam Bearder: Have you made a plan in which you think, okay, we're not very strong in that particular area, let's look to tackle that next. So that's building your maturity out, building out your cyber security posture, that's quite a common word as well in the industry, and ensuring that you've got those right protections in and around that. Lynn Murape: Mm-hmm. Okay, great. All right, so we know that many businesses buy these security tools reactively. It's usually after something bad happens like an incident or a breach or due to audit pressure. So how do these businesses move from reactive spend to more deliberate investment? Adam Bearder: it back a little bit to the maturity, it's having that plan and of tying that together with ⁓ the So ⁓ I say reactive spend is very emotional. You're doing it at the drop of a hat because something has happened within that that might mean you buy the wrong tool. It could mean that make a hasty because it's... yeah, that feels like the right thing that's going to protect us right now for that given instance. And maybe not necessarily evaluated the bigger picture or some of the developing technologies that are maybe coming in that might be sort of two birds, one stone kind of sort of motions that you could build that out. having a deliberate investment would sort of mean understanding a true baseline of where you are today. from that, you can understand what risks exist elsewhere or in other areas that you can then specifically and deliberately make a plan to invest correctly going forwards. Lynn Murape: Nice, okay. we'll of course dive a little bit deeper into that, know, especially when it comes to establishing that baseline of what good looks like, because we obviously know this isn't exactly a silver bullet and ⁓ cyber looks different for every business, right? No two businesses are alike anyway, but those are definitely great points to make. ⁓ So the you have all been waiting for, switching gears to HIDDEN, right? So we've mentioned it often enough, so we might as well define it clearly. So Adam, this is your baby or rather your cyber security ⁓ What is the HIDDEN framework and how did it come about? Adam Bearder: ⁓ ⁓ a simple structured to understand how secure a business is. But ultimately is also an acronym. Okay. And it's an acronym for six critical areas that we kept hearing time after time. So ⁓ we've been cyber security for many, years here at and it was ⁓ repeatedly the six areas that we ultimately kept addressing our customer base. And those specifically ⁓ risk, identity management, data controls, disaster recovery, endpoint protection, and network & cloud security. So quite straightforward, simple words that hopefully means something to the whole organisation. So try and put it in a common language that the whole business and certainly across the SMB sector where you don't necessarily have technology experts. Lynn Murape: Mm. Adam Bearder: we can put across a nice structured framework that you can follow to ultimately ensure that you're protected and you have the right cyber security practices in place. Lynn Murape: I appreciate, you know, just establishing this shared language that everybody in the business can speak because obviously, you know, when it comes to technology cyber security, it's easy to get overwhelmed all the tech jargon, right? So let's take a second unpack each. Adam Bearder: It confuses me half the time. Lynn Murape: Exactly, exactly, and you're in the field, right? So let's take a little bit of time to unpack each of those six layers. you know, listening or watching out there, we will be unpacking of the letters in their own designated episodes after this one. ⁓ But now, at a high level, Adam, do you mind just ⁓ unpacking human risk is, what ⁓ identity is, et cetera, et cetera? Adam Bearder: Yeah, I'll try and keep it sort of very brief and not go into the weeds, but very simply, human risk would be understanding if your people are a weak point is a great way to sort of frame it. Do you put practices in place to help educate them? I think it's something in the realm of just 8 % of your users can actually contribute to 80 % of the threat. And across organisations, there's a huge piece of actually identifying who those maybe eight users are or 8 % if you look at in a percentage frame. How do we identify them? How do we properly educate them? one area. Identity, that's really looking around access, permission. How do you control? How do you put the right practices in place? If you have a user leave the business. Lynn Murape: Mmm. Adam Bearder: What is your process behind removing their access? How quickly can that be done? Do they put their, are they a salesperson and they might be looking to take their account base elsewhere? How do you of lock down that permission and remove them in a timely manner that may not necessarily allow them to do anything ⁓ And controls, there's two flavours to data controls. There's the... The external, so it's sharing the data externally and again putting the security layer around that data so that it controls it and it can't be shared externally. Also think about the likes of AI and AI adoption. It's on pretty much every topic of everyone's lips at the moment as to new technologies that are being adopted. I would absolutely implore everybody to start looking at AI and the huge efficiencies that you can benefit from it. Lynn Murape: ⁓ yeah. Adam Bearder: But the ultimate question is, is which is the right tool? And if that tool is the right tool, how do you protect what data is put into that tool? Do you label it correctly? Do you have the right sort of controls if it's sort of private and confidential data that you don't necessarily want to be put to the tool? So there's certain areas there and there's many tools out there in the market at the moment on how to control that. But again, having that right protection around the data is critical. Lynn Murape: Okay. Adam Bearder: Disaster recovery, quite straightforward one this one. Most organisations will be running backups. Are you testing those backups? Do you know how to recover from the backup that you've been doing daily for the last six years? Have you ever gone, I'm gonna take that backup and just see if it gets me to that point in time that I thought it So many organisations don't test it. then have the endpoint protection as mentioned and is really again a lot of organisations have been doing antivirus ⁓ and endpoint detection and response services that have been out there for many years. ⁓ That's moving towards that management. So many to what we're talking about alerting coming through before. What are we doing? How are we action in those ⁓ alerts ⁓ protecting devices? ⁓ And just on the other side of that, ⁓ are actually patching those devices? Lynn Murape: Yep. Adam Bearder: by patching, mean, the latest updates. ⁓ vendors that are running these devices, such your Lenovos or your IBMs, the actual developers in certain instances, they'll be continually updates to their ⁓ itself, ⁓ like operating systems the devices with security patches. Are you Lynn Murape: Okay. Adam Bearder: in those security patches as they come out. They've made that change for a reason. Yeah, there's layers there. then it's network and cloud. Do you know all of the cloud applications that are hitting your Do you know ⁓ what that they have to those And similarly, are they getting those applications via the network? Do you have firewall controls? ⁓ Do you permit them paths to get there? ⁓ Again, how well is that sort of control? So pretty common six areas that we see time after time. And the way in which we sort of structure this is ensuring that you've got the right sort of base level of protection and then enhancing depending on the organisation and the needs that you have ⁓ cover correctly for ⁓ the security standards there. Lynn Murape: Great points, well put as per usual. And I think what I appreciated most about you walking us through those levels is you were also throwing in some little gems in terms of what you guys listening or watching out there can actually do to start to get this under control, whether it's making sure all your systems and applications are updated by, AKA patching, new word over there, or ensuring that your backups are tested. Yes, you have it in place, but let's pretend that touch disaster has struck ⁓ you no longer have access what do you have to via those backups as well is something to note of. So thank you for that, Adam. ⁓ So going to an earlier point that made around ⁓ the power of having this ⁓ shared language, right? So when business starts using this language for cyber security across leadership and IT, what actually changes? Adam Bearder: you Lynn Murape: or put differently, how does HIDDEN turn that into clearer ownership and governance rather just putting more pressure on the IT team? Adam Bearder: Okay, so think The biggest thing that we're doing here is we're ultimately trying to put it in, we the language and the communication becomes easier for the organisation to adopt and ⁓ also sort communicate correctly across. But the other area is really just ⁓ ensuring that got a measurement within that. So, okay, everyone's speaking that same language. ⁓ As we those The biggest that we're doing here is we're ultimately trying to put it in, like we say, the and communication becomes easier for the organisation to adopt and ⁓ also sort of communicate correctly across. the other area is really just ensuring that you've got a measurement within So, okay, everyone's speaking that same language. As we address those sort of areas that we've certain topics that we've just sort of covered on, can we can put a score towards it. You can then see clearly how that score is improving over time the way that ⁓ we can address those scores. ⁓ is ⁓ great ways that senior leadership and organisation, can actually ⁓ measure improvements making over that time. But in a language that ⁓ goes from sort sort of areas that we've certain topics that we've just sort of covered on, can we can put a score towards it. You can then see clearly how that score is improving over time through the way that which we can address those scores. That is all great ways that senior leadership and organisation, ⁓ actually ⁓ what they're making over that time. But in a language that ⁓ goes from of base level users if they're explaining that this is the human risk that you potentially may put to the organisation and this is why we need you to go through training, but also certain other areas of the network and areas on that front. We've seen that many access points hit in this way. We've now got a measurement to say that this is actually an area that we've improved in the last six months. base level users if they're explaining that this is the human risk that you potentially may put to the organisation and this is why we need you to go through training, but also certain other areas of the network and areas on that front. We've seen that many access points hit in this way. We've now got a measurement to say that this is actually an area that we've improved in the last six months. Lynn Murape: Yeah. ⁓ huh. Nice, awesome. And I'm sure you can attest to the fact that it also reduces fear to a certain extent, right? Because as humans, we tend to fear what we don't understand. And by having this, clearer, easy to understand language, which is also, ⁓ you know, easy to remember with the great acronym that you came up with, ⁓ that also them to have these better conversations at a board level, as you said, ⁓ develop clear understand what these alerts that keep coming in mean as well. So that gives them that sense of agency. Yeah. Okay. Adam Bearder: and things best work out a bit. Yeah, absolutely, and hopefully sort of provides them some clarity. Lynn Murape: ⁓ Of course. right. ⁓ in closing, ⁓ but certainly not least, the question that I have for you here is if business listening or watching today ⁓ realises they don't in fact know what their link is or where they're most exposed, what would you say should be their first step? Adam Bearder: I think the first thing that I'd probably say is don't buy another tool just yet. your gaps and ⁓ of really assess where you're at. And that the general sort place to Go and evaluate where your business is currently sat. ⁓ So what tools have put in place? ⁓ What protections have you in? ⁓ What are the processes make those work? And something here at Babble, what we have put together is a cyber security snapshot. And that snapshot, we can go through some very sort of base questions that can start to lead you down that path of, ⁓ okay, is how we approach that particular area. Are our that weak point for us? Do we need to go and look at a certain strategy on that path? And we can give you a bit of a scale on you could answer those questions and ultimately that would give us a bit of a direction to help you in the future. Lynn Murape: Nice, love that. And it's funny that gave the same advice as Mark O'Dell, who, as you know, was on the previous episode. The first thing he said was, don't go out and buy more tools. I love that we all here at Babble. So the snapshot will be definitely made available in the description below. So do check that out as well. ⁓ But yes, that brings us to the of this episode. Thank you so much, Adam, for your time. It's been Adam Bearder: Okay. Yes. Really good. Lynn Murape: and a pleasure speaking to you today. Awesome. Adam Bearder: Likewise, Lynn, thank you for having me.