Latest / The HIDDEN Podcast by Babble / Episode 1: Why UK Businesses Are Being Targeted by Cyber Attacks
Transcript
- Lynn Murape: Welcome to the HIDDEN™ Podcast, where we simplify cyber security and all things tech for those of you who, like need it to be explained without all the So if you've ever wondered why you still feel vulnerable even though you've bought all the fancy tools, come to the right place. ⁓ your host, Lynn Murape and job is to take one of our resident experts and help them translate their cyber expertise into plain This means having practical conversations So, you know, switching gears to how there has been this shift risk, right? You've spoken about how threats have essentially changed the name of the game and things like that. So, two years ago, what looked different about the threat landscape compared to That's a wrap on today's episode of the HIDDEN™ podcast. If this episode gave you an aha moment that helped you untangle something that's been bugging you, subscribe and share it with a friend who's in the same boat. And if you're wondering where you stand across the six HIDDEN™ layers, our cyber security snapshot in the description below. a lot less painful than a breach. Until next time, don't let your risks stay HIDDEN™. Mark O'Dell: Yeah, so I think if I take it back slightly slightly further than that, the old world was very much around securing your network. So you had an office or a location and you had your data in your systems and everyone was inside that umbrella. And so you think about perimeter only and you say, well, if I stop people getting into the perimeter, then data is safe. So you think a lot about the perimeter and not a lot about that. ⁓ Lynn Murape: Joining me in the virtual studio today is Mark O'Dell. Thanks for us, Mark O'Dell: Hi, Lynn it's great to be here today. Lynn Murape: Nice. So before we dive in, do you mind telling our friends listening or watching out there a little bit about yourself in terms of what you do and where you live? usually built around Babble's HIDDEN™ cyber security framework, which we break down in the show. Or sometimes we'll take a hot topic in the tech industry, like a major breach or a new legislation, and we'll explain how we help you stay ahead. Basically, this podcast exists so that you can sleep well at night, preferably not during the podcast. Mark O'Dell: Hi, yeah. Well, I am director of secure cloud and AI here at Babble. essentially my responsibility is to ⁓ and sure that we're delivering products to our customers that are useful to them and providing them real benefit. ⁓ I'm based in Northern Ireland and today is a typically dreary day, shall we say. As the world has changed in terms of our working practices, people are everywhere. They're working worldwide. We talk about our own business here. We've got people worldwide running different services. therefore we don't have a perimeter. We have lots of different places. So ⁓ end point then becomes really important because protecting the end point, regardless of where that is. And by end point, we mean ⁓ that's a mobile phone, whether that is a laptop, a tablet, whether that's a traditional phone as well. They're all Lynn Murape: Right. ⁓ you know, the weather isn't too much of a but at least summer is around the so have to look forward to. So before we also just unpack the rest of this very first episode, do you mind telling us a bit about ⁓ what you like about what you do? Mark O'Dell: potential route into your data. So detecting that endpoint becomes important protecting the connectivity that's there. ⁓ second bit that really brings into it is identity and identity protection in a way that was far less important in a world where you were inside a perimeter. If think about, ⁓ you in a building sense, you had ID card that got you in the building and then you were kind of considered safe. Well, I'm in the building now, so it's fine. Yeah. Lynn Murape: Mm-hmm. Mm-hmm. Mm-hmm. ⁓ Mark O'Dell: So I think two aspects really, there's a customer aspect, which means that I get to speak to and be involved in ⁓ of different customers and lots of different business types. So I get to ⁓ about what they do, not just about the technology. ⁓ secondly, is the technology. ⁓ really from a technical background and like the technology and that stuff is exciting to me. Identity and IT sense is not that dissimilar. You have your Microsoft login, for example, and it gets you access to things. And the way we set up access these days is with SSO, which is single sign on. So most applications, and you will have seen this as an individual and as a company, most applications will use your account and you'll go, well, I'll use that account for my ⁓ app and for my Microsoft 365 app and so on and so on and so on. The problem is, is it... Lynn Murape: Nice, awesome. So without further ado, today for our very first episode, we're kicking things off with unpacking why cyber threats are so prevalent in the UK today and get you thinking about this. If a cyber incident hit your business tomorrow, who would actually take control? So there's a lot to unpack there. So let's dive right in. Mm-hmm. So Mark, the UK has been ranked as the third most targeted country globally, which is insane. So from your perspective, right, why the UK and why now? Mark O'Dell: That's in theory secure, but if that account gets compromised, you've suddenly got access to all of these SaaS providers wherever they may be. And identity becomes critical then. And the way we're looking at protecting that and the way the industry looks at protecting that is about the examples of things like ⁓ impossible It's fairly dealt with, but if Mark O'Dell logs in from Northern Ireland at 10 o'clock the morning, So I think from a criminal, from an attacker's point of view, the UK has a lot going for it. Lynn Murape: Okay. Mark O'Dell: And let's be clear that the criminal world is really a business. They are thinking about these things in a sensible way. It's not random. So the UK is very high value and a relatively easy target or rather a wide target. We have a very connected economy. We have a very connected workforce and a consumer base. And comparatively in the world, it's a wealthy consumer and base. Lynn Murape: Yeah. Mark O'Dell: and then suddenly is logging in from South Africa at quarter past 10 in the morning. Well, that's not possible, is it? So you need to think about that. Should I even be allowed to log in from South Africa? If I'm a UK based employee and I'm not travelling for work, do we want Mark to be able to log into there? Isn't that just a risk? There's no need. So we start to think about things like that. How do you secure the identity of that person and identify things and make sure that they're safe? Lynn Murape: ⁓ Definitely not. Mark O'Dell: Being English speaking should not be underestimated. Phishing attacks are easier to craft even for non-English speakers in English because there's so much of the world can speak English. AI accelerating that, making it faster, cheaper and more scalable. So as a top ten economy, we would naturally be in those crosshairs for both the opportunistic and more structural attacks. Lynn Murape: Okay, okay. Yeah. There's no need, yeah. Mmm. Yeah. Yeah, ugh. a lot to unpack, is why we've dedicated an entire podcast about this, because there are a lot of things to consider, right? And something that you've mentioned in the past is this dichotomy between the physical world and the virtual world, right? And I'm glad that you went back further than two years, because I think maybe a lot of listeners or viewers out there might be solely thinking about the physical protection of it all, protecting your physical assets, and that's why I also really appreciate the emphasis that you placed on data, which obviously leans now into the virtual side of things and how that needs more protection than the physical, arguably. you say that attacks now the dominant threat? You had mentioned ⁓ how human risk is basically at top of the charts terms of the kinds of threats coming out. Yeah, those were great points to make. So if you could the state of cyber security for UK SMBs in one sentence, what would it be? know that's a bit of a lofty goal there. ⁓ Mark O'Dell: That's a bit of an ask. Most SMBs think they've done enough, but they haven't. So to dig into that a little bit, a classic answer would be, well, we've got antivirus or we haven't ever been attacked, but it does miss the point and the threat landscape has been changing. And so that past safety doesn't guarantee the future safety. Lynn Murape: Mmm. ⁓ Mark O'Dell: Yeah, I think that's right because if you think about your typical phishing attack, what that's really doing is trying to steal identity and by identity, we mean the accounts access. it's trying to... Yeah, yeah. So it's trying to encourage you to share that identity, that credential. Oh, okay. So this is Mark's Office 365 account. Okay, we know what that is. Lynn Murape: Right, so not my physical ID. Okay. Mark O'Dell: And hopefully we've got his password because he's now gone and filled in a form. And now we can see where we can get to with that. And there's an offshoot of this, often I think affects individuals than it does companies, but it's the reuse of usernames and passwords. So if I habitually use my email address and a password, and I use it for a birthday card website that I've created a nice picture on and my corporate email account. Which one of those is likely more likely to get hacked is the birthday card website. And you might think, well, I don't care because what are they going to do? Send me on a birthday card with a picture of my face on it. Who cares? But the answer is that they now know corporate email address and the password that you used for that. ⁓ if you were a person that reuses it, Lynn Murape: Okay. Yeah. Yes. Right. Mark O'Dell: Well, what they're going to do is you're to go and try it on your corporate email. So that's why password reuse is really dangerous because you might get it stolen from a low quality security place and get it reused on a high quality security place. Lynn Murape: Yeah. No Mm-hmm. Goodness, I don't know about you guys listening at home or watching at home, but in and of itself just made me rethink, ⁓ passwords, you know, and how I'm using them So many businesses still believe that they are quote unquote too small to matter. ⁓ Why is misconception so dangerous? Mark O'Dell: Well, I think in the physical world that that makes sense, right? You're a florist on a high street and you're next to a bank and a jewelry shop. It's pretty logical to say, well, know, burglars are unlikely to come in and break into my florist. that doesn't ⁓ happen you move into the virtual world. Lynn Murape: Mm-hmm. You're welcome. So, yeah, thank you for that top tip there, Mark. So switching gears a little to now the business impact of getting hit by, cyber security Right. attack. So when an S MB is hit by a serious incident, usually the first real consequence that they feel? Mark O'Dell: because attackers quite often are not actually targeting anyone. They are using bots and again, AI to attack wide swathes of the population and the businesses that are out there. And the cost of attacking is near zero. So once you've created a bot, once you've created a method or you have found an in, repeating that 1000 times, a million times, the costs don't really change, unlike if you've got to go and physically break into a load of buildings. So the result is that Lynn Murape: Okay. Mark O'Dell: So biggest consequence, if we go that way around, ⁓ ⁓ reputational. This is a lot of the stuff they ⁓ lose can replaced recreated. So the data, quite often, they can restore it from a backup. But as we talked about earlier, well, if they've also stolen all of that data and they had to essentially selling that data, they're potentially doing bad things to your customers and your customers are then in a much worse position. And you also, because of the law, which quite rightly... even if you don't think you are important enough, you might just be unlucky enough to fall into that. There's few things with SMBs where they might be specifically targeted. So quite often SMBs have left the doors open, ⁓ you metaphorically, because they've got less time and money for security. You have to go and tell those customers. Oh, by the way, we've lost all of your data. So even if the business impact directly is containable because you're like, okay, I've got backup, I'm back out of this. We're good. good. You've got to to your customers. Yeah. All that credit card information about you, we've just lost it. All of the orders that you've placed with us over the last six months, yeah, that got stolen. And now that's out in the wide world. I can't put that back in the box. I can't put the lid on. Lynn Murape: Yes. ⁓ yeah. Mark O'Dell: And they're also quite often likely to pay ransomware because the amounts tend to be smaller. So there's a higher chance that they're just like, OK, it's quote, only a thousand pounds. And they're also quite likely to keep them quiet. So they'll pay out, they'll keep it quiet. It can be done en masse. There's a little less risk for the criminals involved in that. Lynn Murape: Right. you Hmm. ⁓ my gosh. Right, yeah you can't. Right, and touching on that last point around ransomware, you know, it's not exactly a foolproof solution, right? Because we all know, even if you do pay that ransomware, there is still the high ⁓ that they could still hold your data at ransom, they could, you know, release your data back to you, but then they could be selling that data on the black markets as well. Yeah. Mark O'Dell: Yeah. So don't want that to happen in the first place. Lynn Murape: Mm-hmm. And you also don't want to lose the trust of your employees as well. Obviously, depending on what sector you're in and the nature of your business, they would also feel vulnerable on a personal note in terms of their employee data, if you will, being compromised. Because HR has a lot of personal data on their employees as well, and we don't want that getting out either. yeah, I definitely ⁓ that emphasis on that ⁓ trust or that loss of trust rather. ⁓ Mark O'Dell: Of course. Yeah, and I think that's if you go back a number of years, the early days of that, literally, they would they would encrypt your data, you get away with paying it. You don't your data, all would be well. ⁓ Data now so valuable that they're not only encrypting it, they're stealing it and they're encrypting it. So you pay them and they will they will probably decrypt it because that's kind of how their business works. If they never decrypted it, no one would ever pay them. Lynn Murape: because that is something that you can't really throw money at to solve, essentially, or to get back rather. All right, so in your experience, Mark, could most of the SMB leaders you've spoken to directly confidently answer the question, are we covered? Bit of a loaded question. Yeah. Mark O'Dell: Yes. Lynn Murape: Yeah. Yeah. Mark O'Dell: but they've also taken a copy of it over here and they're now going to sell that data to the dark web or they're going to use it again against you. And the other thing is that once they've gotten into your network, if you didn't fixed that, then they're quite happily come back and do it again. And they'll quite happily say, oh, they're an easy target. Well, let's, let's try something else with them. I mean, they can confidently answer it. Are they right is another matter. So I think this is the thing. I think a lot of people will confidently answer, yes, yes, we're covered. And they will genuinely think that they're covered. And to be fair, they will have gone through process and thought about it. And they're not idiots. These people are not running businesses foolish. they don't know what they don't know. Lynn Murape: Mm. Right, because they're effectively the low-hanging fruit in that sense. And I'm really glad that you brought up network in particular, because that is an upcoming episode where we just dive a little bit deeper into network and cloud security. But something else that you had said jumped out at me in terms of a lot of the time, these scales that are basically automated en masse, it's not necessarily about targeting an SMB, but there are cases where they are specifically being targeted. ⁓ Mark O'Dell: Yes. I think that is thing. And some sort of framework and some sort of process, it's really easy to miss things. And internal IT, ⁓ and to some extent an outsourced ⁓ service they are not specialists in thinking about some of these things. So again, they will tick the boxes. Lynn Murape: Mm-hmm. Mm-hmm. So in those cases, what would you say makes SMBs attractive targets? Is it because they've left those virtual back doors open? Is there more to the story that makes them more attractive to cyber criminals? Mark O'Dell: The world evolves so quickly and the changes are so significant at times that if you're not keeping ahead of it, are going to fall behind and you are going to potentially fall victim to the latest iterations of scams and attacks. So thinking about ⁓ the way with our HIDDEN™ model that we're looking at, human risk is the biggest element of that. And that is about people being not trained fully. So, bigger organisations will tend to have bigger training budgets and they'll have the ability to make sure that people are more up to speed what's required. Lynn Murape: A little doom and gloom, but I mean that's the name of the game when you talk about cyber security. It's difficult to balance being informative realistic about the situation, but also not leaning into fear-mongering. So ⁓ while we are giving a realistic depiction of security in the UK today, ⁓ that doesn't mean that there aren't solutions to of these. We're just bringing these issues to your attention because as you ⁓ Mark O'Dell: you Again, it comes back to slightly to this, it's not going to happen to me, we're too small, we're not important. I'll be relaxed about security. I've lots of things going on my life. I've got no one in the business specifically thinking about this. And endpoints the But often that's just misusing the endpoints. That's humans clicking on things, or that's humans not applying or risky behaviour, them places, leaving them on Lynn Murape: know you had mentioned Mark a lot of these are HIDDEN™ ⁓ intended ⁓ it's also about just uncovering you don't know as well so that you can actually do something about it and protect the business. ⁓ ⁓ Mark O'Dell: Yeah, just to jump on that, I would say you are unlikely to... trains, that kind of thing. other thing with SMBs ⁓ supply chain attacks, i.e. where you the intended victim but you are not the route in, that's through one of your suppliers. set up a business and think about how to set up your tax affairs and how to produce what they've worked without consulting a lawyer or someone legal and without consulting someone on the accountancy on the tax side. Now, they might be your staff, might not be, but you're unlikely to just go, ⁓ well, I'm probably just going to guess it'll be all right. I've read a couple of things online about what the tax regime is or how you do PAYE for start or what your HR laws are. Lynn Murape: Mmm. Yeah. Mark O'Dell: Think someone like the Jaguar Land Rover supply chain attack that came through a smaller business. So most of those higher profile things will come through small businesses. So as an SMB is providing services to a bigger company, you might actually be at risk because of that. Because you're like, don't care about X company, but I do care about the person that they're supplying. Lynn Murape: Right. Yeah. Mmm. ⁓ no. ⁓ ⁓ Yeah. Yeah. Mark O'Dell: So it'll be fine. So why would you do that? Why would you do that with your IT security? And so that's all we're saying is that all these things are, for the most part, solvable. You just need to go, well, let's go and about it with an expert. Let's find out where the gaps are and let's decide as a business, what ⁓ our risk appetite? ⁓ some businesses may have huge risk appetite because ⁓ Lynn Murape: Right, So now when we talk about suppliers and customers as well, that me of a term that I recently came across called island hopping. So, for who might have come across that term as well, is that what you are basically describing? You know, where they're effectively using your small business as a or a bridge to gain access into the database of a much bigger business that you're connected to. ⁓ Yeah. Yeah. Mark O'Dell: the downside of happening is really low for them because their estate is ⁓ not complicated or whatever. Whereas other businesses, ⁓ think we have clients are ⁓ in the medical profession. Now clearly, their data is very sensitive and they have to take a much higher level of ⁓ care and they take... Lynn Murape: Yeah. Mark O'Dell: Yeah, exactly that. The big companies will have better security often, not always, ⁓ ⁓ therefore it's like, how can we get into there? And what are we going to do that's going to work our way through the back door? Lynn Murape: Mm. Mm-hmm, mm-hmm. Yeah. Mmm. Mm-hmm. Yeah, you know, I'm glad that you already touched on HIDDEN™, which we will be diving a little bit deeper into Adam Beader in the next episode. But I to just stay on these silent or HIDDEN™ if you will. So we've already ⁓ spoken about human and supply chain and endpoint, which are basically the devices that connect the company data. So let's chat a little about backups, right? Because this comes up a lot ⁓ there we go. Right. Mark O'Dell: this much more seriously than others. Lynn Murape: Excellent points, well made as usual. So in this up, the last question that I have for you is, if you advising a 50 person business owner listening or watching today, what's the first step that they should take to feel like they can start getting a hold over this big looming cyber security in terms of they are a security threat. Mark O'Dell: Yeah, as has been my habit so far in this, I'm going to answer a different question. No, so I'm going to say, what would I get them to not do first, actually, is what I'm going to say. So what I would say is don't go out and buy something, because I think that is the trap that we can easily fall into, is saying, well, I need a tool to solve this problem. So I'm just going to go out and I've heard that. So there's two ways. There is the initial, have you got it back up? Lynn Murape: Okay. Okay. Mark O'Dell: which is as old as IT, you know, that is, and probably beyond IT, you know, what do you do? What do you do if you lose your primary source of something, you want a secondary source of it? And there is, so there is just the simple fact of something's gone wrong, can I get it back? That's what a backup is for. But of course, what's happening with a backup is you're taking all of your data set, and you're putting it somewhere. And that somewhere nowadays is often in the cloud. Lynn Murape: Yeah. Yeah. Mark O'Dell: ABC product is great. Everyone tells me it's great, so I'm going to buy that. Lynn Murape: Sure. ⁓ Mark O'Dell: And it might be the right answer, but you don't know because you've not gone through the process of understanding what your risks are, where those gaps are and the things that you need to plug. You may already have a perfectly good solution. Microsoft comes with a load of bits and pieces if you've got 365 that covers a lot of this. You might not need a third party solution. You might not need to do buy anything. You might just need to train your staff to make sure that they are behaving in a sensible way. So to me, that first step is to speak to someone who is a professional on it and to run through that process of Lynn Murape: Yeah. Mark O'Dell: It could be a actually could be a box that you physically keep it some people still do that or it could be with a smaller or bigger vendor where they're keeping a copy of your data. So now if I'm thinking about how I steal data, well, there's two things I've got to worry about. can either go to the source, which we've thought a lot about, we've really secured the source, or I can go, where's that backup gone? I'll go and find the backup provider and the backup copy of that data. And I'll just take the data straight out of the backup. I don't need the live copy. I don't care if it's a day Lynn Murape: Right. Mm-hmm. Mark O'Dell: going, let's look at what we've got, let's look at what we do, let's look at the gaps and then how we fill those gaps. ⁓ You not need to fill any. So don't rush out and buy something. ⁓ Lynn Murape: Mm-hmm. ⁓ my goodness. Yeah. Mark O'Dell: or two old. Yeah, so you need to be thinking about the backup and that's quite often outside. Is that encrypted properly? that secured? Have you put it somewhere reliable? Lynn Murape: I love that, that is definitely not the answer I would expect from a product director because usually it's all about buy this, buy that. this is basically that magic silver bullet, but I'm glad that you went the opposite way. Mark O'Dell: You Lynn Murape: that brings me to the next question, which is, you know, in your experience and your opinion, would you say that most businesses are aware of those gaps or are they unfortunately discovering them the way? Mark O'Dell: No, so I think they are discovering them the hard way. I think that's fairly the backup one is as an example is is probably fairly rare. it does it definitely does happen. ⁓ more often simpler things with within the SMB. There's there's quite often free things haven't been done because security is always this balance between ⁓ and being secure. Lynn Murape: ⁓ All right, so that brings us to the end ⁓ of your episode. you for joining us. Thank you. Yeah. Okay. Okay. Mark O'Dell: Thanks, Lynn. Cheers. There's a kind of a techie type joke that's like, well, I can make your stuff secure. I'm going to put it in a lead box. I'm going to bury it 50 feet under the ground and I'm going to make sure no one can get to it. It's secure. Your data is safe, but it's no use to you because you can't access it. Yeah. Lynn Murape: Yeah. Okay, good luck getting your work done. ⁓