Latest / The HIDDEN Podcast by Babble / Episode 10: Are you getting the cyber protection you’re paying for?
Transcript
- Nisha: So most people tell us that they have antivirus or Microsoft Defender or even an IT provider looking after things, which is a great start. But what's really important is ensuring that the security software installed doesn't automatically mean you're protected. I think what matters the most is how it's A, configured, B, being monitored and regularly updated. And that is actually covering the devices that people are using to access the organisation's business data. Lynn: Welcome to the HIDDEN Podcast, where we simplify cyber security and all things tech for those of you who, like me, need it to be explained without all the jargon. So if you've ever wondered why you still feel vulnerable, even though you've bought all the fancy tools, you've come to the right place. I'm your host, Lynn Murape, and my job is to take one of our resident experts and help them translate their cyber expertise into plain English. This means having practical conversations usually built around Babble's HIDDEN cyber security framework, which we break down in the show. Or sometimes we'll take a hot topic in the tech industry, like a major breach or a new legislation, and we'll explain how we help you stay ahead. Basically, this podcast exists so that you can sleep well at night, preferably not during the podcast. Joining me once again in the virtual studio Nisha: Thank Lynn: today is Nisha Sondhi. As a cyber security solution specialist, Nisha regularly works with organisations completing Babble's HIDDEN assessment, helping them make sense of what their results mean and where to focus first. Nisha, a warm welcome back. Nisha: Nice to meet you and thank you so much for having me again. Lynn: Love that. Most businesses aren't starting from zero. They already have laptops, phones, security software, and some form of IT support. But when NISHA begins asking how those businesses are managed, updated, and reviewed, the answers are not always as clear as expected. Today we're drawing on the conversations happening through Babel's hidden assessments to ask a simple question: Are you getting the cyber protection you are already paying for, or are employees? Important gaps hiding behind the assumption that everything is covered. So, of course, we've got a lot to unpack. So, without further ado, let's get into it. So, Nisha, when a business comes to you for a hidden assessment, what do they usually tell you first about how their laptops and their phones are protected? Nisha: Usually when we get into that engagement, they tell us that they will have some antivirus, maybe even Microsoft Defender and or even an IT provider, which are great, you know, starters. But I think what's really important for them to understand is By having the security software installed, it doesn't automatically mean that you are protected. I think what matters the most is A, whether it's configured correctly, B, being monitored and updated regularly, and C, it's actually covering the everyday devices that people use to access their corporate data. Lynn: Interesting and I love those little top tips that you included at the end there. But something that has commonly, you know, come out of these kinds of conversations we have on the show is this element of assumption, right? Just because you have, a various tool like Microsoft Defenders you mentioned, they kind of look at it like a silver bullet. Don't get us wrong, that tech is absolutely phenomenal, right? But there is that human element that is needed for that, overall security, which we'll get into a little bit further on into the conversation. But to bring us back, you know, what do the follow-up questions that you ask during these hidden assessments usually turn up that the first set of questions that they got in the snapshot, didn't cover? Nisha: So some of the things that I do find that I'm a bit wary in terms of how or why they don't have the answers to them. So one example could be having visibility of bring your own devices. I think that's an area where there isn't much clarity and equally there's not much clarity in terms of how they're being managed and secure. So that gives them a level and an element of exposure, which I seem to uncover quite a lot when delivering the hidden assessment. Lynn: you've talked about the assessments that confirm what leaders already suspected, but at the same time they also do cover some of the stuff that they thought was fine, right? Going back to that element of assumptions. So why is that combination so powerful or useful? You know, that element of validating their suspicions, but also uncovering those hidden, pun intended gaps in their security posture? Nisha: I think it's really important that when we deliver the hidden assessment that we validate what they believe, but equally we undercover other areas. I think it's important because A, it demonstrates that hidden actually does work. There's a method behind what we're delivering and the way that we are delivering it is undercoving those areas that we have previously been discussing with the customers. But equally, we're also finding other areas which they weren't so much aware of. And I think that's where the value comes in. We're finding the root cause of the problem. And that's where we've seen the conversations continue. Lynn: to switch gears now to this element of who is responsible for what, Which you have mentioned before is quite a little bit of a a gray area, right? So businesses will often tell you that their devices are quote unquote fully managed. what actually needs to be true for that to really mean something. Nisha: So when an organisation says we're fully managed, what that means it should be that someone has a clear responsibility for managing those devices. That includes keeping them patched, they're managing security, they're controlling who can access what company data, and they're checking that everything is working as expected. And that's just as important as making sure that they've got the right people in the organisation to continuously maintain that. And equally, we need to make sure that it's also reporting on the activity, so they're aware of the noises. Lynn: Those are good points to make, especially when you think about the average SMB environment or you know, how the organisation is set up. Many don't have, you know, dedicated IT teams as well. sometimes it falls on the finance department or whatever the case is. So yeah, just getting those policies ironed out sooner rather than later is great because when and if disaster does strike, then you have those clear policies and procedures so that people aren't necessarily running around like a headless Chicken, so to speak. so those are Nisha: Absolutely. Lynn: good points to raise awesome. Okay, so next up we're going to touch a little bit on Microsoft Defender, which you had mentioned at the beginning of this conversation. So a lot of businesses, particularly amongst our client-based at least, are already running on Microsoft Defender, right? Or they have it installed. Without turning this into a full-blown product review, what actually determines whether a tool like Microsoft Defender works well? Yeah. Nisha: So the effectiveness of any security tool isn't just about the product itself. We have to remember it's about whether it's the right fit for the organisation. And that means that we need to ensure that it's configured properly, is deployed across all the relevant devices, and it's managed actively over time. So we need to ensure that the tool that anybody invests in, whether that be Microsoft Defender, actually is filling those gaps and it's giving them that monitoring capability to make the right decisions. Lynn: Mm, nice. All right. So you had touched on this element of bring your own device, which is known in the tech space as BYOD. So if someone's using their own phone for work, which many of us do, where does their privacy end and the business's responsibility for its starter begin? Nisha: Yeah, that's an interesting topic because we do see organisations allowing bring your own devices. Now, I think organisations need to understand monitoring bring your own devices isn't monitoring their personal data. It's securing them having access to your applications, to your data. And I think that's where we need to actually make sure organisations understand where it begins and where it ends. And that then allows trust to the individual and equal allows policies to be written that are clear and understandable. Lynn: Mm, nice. Now, playing devil's advocate a little bit, let's say that and I will touch wood. my device is compromised in whatever fashion, right? Someone has hacked into my device, so to speak, and I do work on my phone from time to time. Now, what would that look like in terms of securing the company's data, but also, you know, securing my personal data? Nisha: So if you're using your own. device for work and you are compromised. The organisation has the capability with the right tools to remove access and to retract their corporate data. So they can do a corporate wipe. So they are securing their data. Now, when it comes to your own personal data, that won't be affiliated to the security policies from the organisation. So remember, we have to respect your personal data, but we need to secure our data. And that's a differentiator there. Thank Lynn: Great. And just touching on that last point when you said respect your personal data. for those of you listening out there or watching out there that might have, you know, a little bit of anxiety around what can my company see? Can they see my pictures, my DMs, my my notes app, you know, just to clarify the company cannot see that. Nisha: It's not about snooping, it's about ensuring that you are respecting their rules of engagement when it comes to their corporate data. So there is that misconception that someone's going to see what I'm looking at or what I follow and things like that, but it's nothing to do with that. we can say organisations Lynn: Perfect. Nisha: haven't got the time to snoop around what you're doing. Lynn: Exactly. Love that. Okay. So now just talking a little bit about the difference between having a policy in place and then mobile device management, which I'll ask you to unpack a little bit. So this question is a two-parter, which is, where does a clear policy fit versus mobile device management? And then why can't one just stand in for the other? Why does an organisation need both in place? Nisha: So when you have mobile device management, that is the system used to manage and secure the company devices. whether that be a mobile, whether that be a laptop, that's what that particular tool is there for, is to give them that capability to monitor and for security settings are implemented, such as passwords, encryption, and software updates and so on. Now, the policy driven behind that is to show the organisation that A, they are following best practice and potentially compliance regulation needs, and also allowing the individuals who work for that organisation in terms of what they need to adhere to. So it keeps everybody following best practice. Lynn: now when it comes to policies, who's responsible for putting those in place? Would it be solely on the company itself or could they ask their MSP to handle that for them? Nisha: So when it comes to owning it, the policy is usually owned by the business and often with the input from maybe IT, their cyber security team and or even HR and management. And employees are then responsible to follow what that policy is then obviously suggesting. But the ownership tends to come from the business owner. Now typically when we look at a policy around let's say endpoint, so mobile devices, there are certain areas that they need to cover. So one might be MFA requirements, so that's going to be a must and that will be driven into their policy. There also might be the use of MDM or Intune, so that's going to be another factor within that policy. So there's many aspects in terms of how we can harden and strengthen and implement those policies to support our organisation's needs. Lynn: Awesome. Love that. Alright, so switching gears to what happens, you know, when tools lose their owners. As you guys can probably tell, this element of responsibility and accountability is coming up quite often, and understandably so. So, Nisha, you've seen a business inherit a security platform after whoever was managing it leaves the business. How quickly can a good tool just fall out of use when that happens? Nisha: We see this more often than people think. And we've seen this situation where a company is invested in a capable security platform. But when that particular person leads, nobody really knows how it works or whether it's still being maintained or relevant. So the tool itself hasn't failed. It's the ownership that has failed. Usually when it comes to us completing a hidden assessment and we pick this up and identify it, we're actually quite quick in terms of enabling that re-engagement, showing the value. ensuring that that individual now has an additional extension to their team coming from us to give them the training, the capabilities and the understanding in terms of how they can continue using and monitoring that tool. Lynn: great insight shared there, Nisha, as usual. So the last question that I have for you is if a business feels secure because they have every laptop, tablet and phone that has security software installed on it, what's the one thing they still need to check? Nisha: Despite having all of those tools in place and feeling secure, you still need to ensure that the tools are actually delivering what it's supposed to deliver. So you've got to ensure the continuation of reporting, that it's delivering the right reports back to you, that you're getting the right visibility. And equally, we need to look out for misconfiguration, misalignment. These are still really fundamental elements to consider when continuously using particular tools. Another element to add is you need to document how and who is responsible for these toolings to make sure we ensure organisations have the continuation of using that tool. Lynn: I think something that all our cyber security experts here drum on about and understandably so is MFA. So you have noted that even in this episode that ensuring that multifactor authentication is installed on every single device. Would you agree with that as well? Nisha: Absolutely. So MFA and Zero Trust is a critical aspect when it comes to our organisations. It's rule 101. Zero Trust is quite important when it comes to certain organisations because Even though you've connected to maybe their corporate network, it's still a hard no. We still want to verify the identity of the person. So you could have the best endpoint protection. We still need to make sure that the person using that device is the person we believe should be using that device. Lynn: Awesome. So you've just touched on a technical term there which is zero trust. And while I appreciate that the name is pretty much self-explanatory, do you mind just breaking that down a little bit further than what you already have in terms of what is zero trust? You've already spoken about why it's important, but yeah, for those who might not know. Nisha: So zero trust is basically a term that we use when it comes to not trusting anybody to access certain areas of your organisation. So even though you've got MFA, even though it's bypassed the MFA, you still have a zero trust policy in place because it has the assumption that nothing should be trusted, if that makes sense. Lynn: Okay, great. So it's almost like tr having trust issues, but on the technical side of things. Got it. Nisha: Yeah, so it's there to help the right people accessing company systems. it's reducing the risk of anybody that has a unethical intention in gaining access to maybe stolen passwords, to access any organisations. And this is what it's there for. It's to check everything before we allow it to come in. Lynn: Nisha, thank you again once so much. It has been an absolute pleasure to have you. Nisha: Thank you so much. Lynn: That's a wrap on today's episode of the Hidden Podcast. If this episode gave you an aha moment that helped you untangle something that's been bugging you, subscribe and share it with a friend who's in the same boat. And if today's conversation left you with more questions than answers, bring them over to our upcoming webinar on managed cyber security. We will cover them live. Register using the link in the description below, and until next time, don't let your risks stay hidden.