Protect Everything with Microsoft Using Built‑In Security and Controls
Safeguarding Your Digital Assets in an AI-Driven World
Discover the key takeaways from the Securetour 2023 session “Protect Everything With Microsoft” as we delve into the wide range of comprehensive solutions and strategies provided by Microsoft. Explore how these offerings can safeguard and fortify your valuable digital assets in today’s interconnected landscape.
This article covers:
- Understanding the Cyber Security Landscape
- Microsoft’s Comprehensive Security Solutions
Securetour, the virtual cyber security event, brought together industry experts to share valuable insights and strategies for fortifying digital defences. In one of the sessions, Damian Andrews from CyberLab and Jon Davies from Microsoft (MS Link) shed light on the importance of robust cybersecurity measures and how organisations can benefit from Microsoft’s comprehensive security solutions.
This blog post explores the key takeaways from their session and highlights the role of Chess ICT and CyberLab in helping organisations strengthen their cybersecurity posture.
Understanding the Cyber Security Landscape
Cyber threats are more sophisticated than ever, driven by AI-powered attack vectors, deepfake phishing, and supply chain vulnerabilities.
Damian Andrews, Security Consultant at CyberLab, emphasised during SecureTour 2025 that organisations must adopt proactive, layered defence strategies to protect sensitive data, infrastructure, and intellectual property.
Microsoft’s Secure Future Initiative and AI-Driven Security
Jon Davies, Chief Security Advisor at Microsoft, outlined how Microsoft’s Secure Future Initiative (SFI) is transforming cybersecurity through AI-first principles and Zero Trust architecture. [microsoft.com], [microsoft.com], [microsoft.com]
Key Components of Microsoft’s Security Ecosystem:
- Threat Protection & Detection: Microsoft Defender and Security Copilot use AI and behavioural analytics to detect and respond to threats in real time. [microsoft.com]
- Identity & Access Management: Azure Active Directory (now Microsoft Entra ID) enforces multifactor authentication, conditional access, and identity governance to prevent unauthorised access. [microsoft.com]
- Data Protection & Compliance: Microsoft Purview and Information Protection tools help classify, label, and secure sensitive data across hybrid environments. [microsoft.com]
- Cloud Security: Azure’s built-in security controls, combined with Microsoft Defender for Cloud, provide visibility and protection across workloads, endpoints, and cloud services.
Tales from the CyberLab: Adopting Microsoft Copilot Securely Explained with Chess
CyberLab’s Role in Strengthening Defences
CyberLab continues to be a trusted partner in helping organisations implement Microsoft’s security solutions effectively. At SecureTour 2025, CyberLab showcased real-world attack simulations, incident response strategies, and AI-driven threat detection.
CyberLab Services:
- Security Consultancy: Tailored assessments and implementation support for Microsoft security tools.
- Security Awareness Training: Programmes to build a cyber-aware workforce.
- Managed Security Services: 24/7 monitoring, incident response, and continuous improvement.
CyberLab’s MDR service now integrates natively with Microsoft 365, Azure, and Intune, ingesting telemetry from Exchange Online, Teams, SharePoint, and Entra ID to detect phishing, MFA bypass attempts, and suspicious inbox rules.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
How To Recover From a Cyber Attack: Steps to Bounce Back Stronger
Building a Resilient Recovery Strategy for 2025 and Beyond
Gavin Wood, CyberLab CEO, summarises how to recover from a cyber attack and advises how to create your disaster recovery plan.
He covers:
- Introduction to Cyber Disaster Recovery
- Creating your Disaster Recovery Plan
- Regular Testing
Creating an Effective Disaster Recovery Plan
A robust DR plan should include:
- Infrastructure Visibility: Know your estate – if you can’t see it, you can’t recover it.
- Impact Assessment: Evaluate the business impact of losing access to each system.
- Prioritisation: Identify mission-critical systems and define Recovery Time Objectives (RTOs).
- Technology Selection: Choose appropriate DR technologies, from real-time replication to secure offsite backups.
- Policy & Governance: Document procedures, assign roles, and ensure accessibility of the plan- even during a crisis.
Regular Testing: The Key to Confidence
Testing is the only way to validate a DR plan. Organisations must go beyond checking backup logs – full restoration drills are essential. Early failures during testing are expected and valuable, helping refine procedures and improve resilience.
As highlighted by the Gloucester Council incident, where systems remained offline for nearly ten months, the cost of inadequate recovery planning can be severe – impacting reputation, revenue, and public trust.
Rapid Recovery Is Now a Strategic Differentiator
Speed is critical. In 2025, businesses that recover quickly from cyber incidents will retain customers and avoid regulatory penalties. Modern DR strategies must integrate cyber resilience, including:
- Immutable backups
- Automated failover systems
- Real-time monitoring
- Isolated recovery environments for forensic analysis
Tales from the CyberLab: Ransomware Response Explained
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
Cyber Security Challenges Within the Public Sector and How to Respond
How Threat Hunting and MDR Are Shaping Public Sector Resilience
The UK’s public sector – spanning the NHS, central and local government, emergency services, and education – is increasingly targeted by cyber criminals.
With digital transformation accelerating post-pandemic, the stakes have never been higher. According to recent government reports, ransomware attacks have cost public bodies over £1 million per incident, and more than 25% of breaches go undetected for months.
Key Challenges in the Public Sector
1. Skills Shortages
Public sector organisations face a critical shortage of cyber expertise. One in three cyber roles remains vacant or filled by costly contractors, and many departments lack senior digital leadership.
2. Financial Constraints
Budget pressures make it difficult to invest in proactive security measures. Yet prevention remains far more cost-effective than remediation.
The Solution: Sophos MDR
Sophos Managed Detection and Response (MDR) offers 24/7 threat hunting and incident response, bridging the skills gap and providing scalable protection. It combines AI-driven detection with human-led analysis to:
- Proactively hunt and validate threats
- Assess severity and business impact
- Contain and neutralise attacks remotely
- Provide root cause analysis and remediation guidance
Deployment options include:
- Notify: Sophos alerts your team to threats
- Collaborate: Joint response with your internal team
- Authorise: Sophos handles containment and informs you of actions taken
This flexible model ensures public sector organisations retain control while benefiting from expert support.
Protect the Public Sector: Understanding Security Frameworks & Log Management
Real-World Applications
Healthcare
An NHS Ambulance Trust adopted Sophos MDR to ensure uninterrupted access to patient data and services. Building an in-house 24/7 SOC was cost-prohibitive, making MDR a practical alternative.
Education
A leading independent school implemented Sophos MDR to protect student data and avoid ransomware-related downtime. Their proactive stance ensured continuity in teaching and learning.
Housing Associations
CyberLab has supported housing providers in deploying MDR to safeguard resident data and maintain operational integrity. These organisations now benefit from continuous monitoring and expert threat response.
Summary
The UK Government Cyber Security Strategy calls for a shift from reactive to proactive security across the public sector. Sophos MDR enables this transition by delivering round-the-clock protection, addressing talent shortages, and supporting digital resilience.
CyberLab is proud to support public sector clients across healthcare, education, housing, and government. As Sophos Public Sector Partner of the Year for ten consecutive years, and with a team of CREST and CHECK-certified testers, we’re here to help you strengthen your cyber defences.
Sophos Managed Detection and Response (MDR)
Where others stop at notification, Sophos MDR takes action.
Few organisations have the right tools, people, and processes in-house to manage their security program around-the-clock while proactively defending against new and emerging threats.
Unlike other MDR services which simply notify you of suspicious events, Sophos MDR provides an elite team of threat hunters and response experts to take targeted actions on your behalf to neutralise even the most sophisticated threats.
Security Simplified with Forcepoint for Modern Data Protection
Simplified Protection Against Complex Cyber Threats
Uncover how Forcepoint redefines security practices with their streamlined solutions. In this blog, we explore the key takeaways from the session, showcasing how Forcepoint simplifies and reinforces cybersecurity measures to protect your vital assets in the dynamic digital landscape of today.
- Simplifying Security with Forcepoint 4.1
- Forcepoint’s Security Offering
- The Role of CyberLab
As part of Securetour 2023, Forcepoint and CyberLab discussed the importance of simplifying security practices and the role of Forcepoint in achieving this objective. The session featured Tim Headicar, Head of Technical Services at CyberLab, and Stuart Wilson, Manager of Sales Engineering for UK&I at Forcepoint. In this blog post, we will delve into the key insights from the session and explore how CyberLab and Forcepoint can assist organisations in their security endeavours.
Simplifying Security with Forcepoint 4.1
The session commenced with Stuart Wilson outlining the need for a simplified approach to security, given the increasing complexity and the staggering number of open security positions. Forcepoint’s mission is to alleviate the burden by enabling organisations to embrace a zero-trust security approach.
Wilson highlighted Forcepoint 4.1 as the solution that empowers organisations to manage policies for web applications, cloud applications, and private applications in a unified manner. By leveraging 4.1, organisations can push enforcement down to the edge, allowing intelligent decisions to be made locally.
This approach not only enhances user experience but also ensures faster and uniform data access across wired and wireless devices.
Forcepoint’s Security Offering
Wilson emphasised that Forcepoint’s security solution extends beyond 4.1. He discussed the integration of Secure SD-WAN and next-gen firewall solutions, which work harmoniously with the 4.1 platform. This comprehensive offering provides organisations with a robust and holistic security framework.
Another notable aspect of Forcepoint’s portfolio is its renowned Data Loss Prevention (DLP) technology. This technology, deeply embedded within the 4.1 platform, allows for consistent and enterprise-grade DLP capabilities. Forcepoint’s commitment to integrating DLP ensures that data remains secure across web connections, cloud applications, and private applications.
Tales from the CyberLab: AI’s Role in Data Protection Explained
The Role of CyberLab
During the session, Tim Headicar from CyberLab emphasised his role in helping businesses navigate the complexities of cyber security. As a trusted partner, CyberLab offers expert guidance and consultation to organisations seeking to strengthen their security posture.
By partnering with Forcepoint, CyberLab can provide tailored solutions that align with each organisation’s unique needs, ensuring robust protection and peace of mind.
Conclusion
In an era of increasing cybersecurity complexities, the session on “Security Simplified with Forcepoint” at Securetour 2023 served as a reminder of the importance of simplifying security practices. Forcepoint’s 4.1 platform, along with its comprehensive offering of solutions, presents organisations with the opportunity to embrace a zero-trust security approach and achieve a unified and simplified security architecture.
With the expertise of CyberLab and the robust capabilities of Forcepoint, organisations can confidently navigate the evolving threat landscape. By leveraging tailored solutions, businesses can enhance their security posture and safeguard their digital assets.
Securetour 2023 provided an ideal platform for industry professionals to gain insights, exchange knowledge, and collaborate on building a more secure future. The session on “Security Simplified with Forcepoint” underscored the significance of simplified security practices and the role of innovative solutions in achieving this goal.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
What is Malware and How to Protect Against It with Smart Security
Everything You Need To Know About Malware
Malware is one of the most persistent threats to modern businesses. CyberLab outlines what malware is, how the threat has evolved, and five practical steps any organisation can take to reduce risk and strengthen defences.
What is Malware?
Malware (short for “malicious software”) is an umbrella term for software designed to infiltrate systems, disrupt operations, or steal data. Categories often overlap, but common types include:
- Viruses
Malicious code that attaches to legitimate files and can corrupt, modify, or delete data. - Worms
Self‑propagating software that spreads across connected devices and networks without user action. - Trojans
Malware that masquerades as legitimate software, often creating a “backdoor” that allows further compromise. - Adware
Software that displays intrusive adverts; beyond nuisance, it can weaken security and lead to additional malware. - Spyware
Software that covertly captures sensitive information such as credentials, payment data, and browsing activity. - Rootkits
Tools that provide stealthy, privileged access so an attacker can operate like an administrator without detection.
The Modern Malware Threat
Historically, threats tended to sit neatly within one category. Today, adversaries combine techniques to maximise impact. A single campaign might hide like a trojan, spread like a worm, disrupt systems like a virus, and quietly harvest credentials.
Motivations have also shifted. Where older malware often aimed to cause nuisance, modern operators are financially driven. Ransomware remains one of the most common and disruptive threats: attackers encrypt business data and demand payment for decryption. Increasingly, groups use double‑extortion tactics, exfiltrating sensitive data before encryption, then threatening to leak it to increase pressure on victims.
The implications are clear. Organisations need layered controls that can prevent, detect, and respond to sophisticated, multi‑stage attacks, and they need the governance and processes to recover quickly.
Five Steps to Protect Against Malware
1) Use modern endpoint protection
Traditional antivirus relies on signatures of known threats. Given the pace of change, that is no longer sufficient by itself. Organisations should adopt behaviour‑based protection such as Endpoint Detection and Response (EDR) or Next‑Gen AV, which use analytics and machine learning to detect suspicious activity, block unknown malware, and provide investigation and response capabilities. Consider managed detection to extend coverage outside business hours.
What good looks like:
- Behaviour‑based detection, not only signatures
- Ransomware rollback or containment features
- Centralised policy, alerting and response across all endpoints
2) Manage devices and privileges
Limit administrative rights and separate admin accounts from day‑to‑day user accounts. Apply least privilege and strong authentication to reduce the blast radius if an account is compromised. For mobiles and laptops, use device management to enforce security baselines, control app installation, and protect corporate data.
What good looks like:
- Role‑based access, separate admin credentials, multi‑factor authentication
- Mobile and endpoint management (for example, Microsoft Intune) to enforce policies
- Only approved app stores such as Google Play and the Apple App Store
3) Keep software up to date
Attackers routinely exploit known vulnerabilities. Maintain an accurate asset inventory, apply security updates promptly, and remove software that is end‑of‑life or unsupported. Regular vulnerability assessments help identify gaps and track remediation progress.
What good looks like:
- Standard patching cadence with clear service‑level objectives
- Prioritisation for internet‑facing and business‑critical systems
- Continuous scanning and reporting to verify closure of issues
4) Control USB and other removable media
Removable media can introduce malware into otherwise controlled environments. Reduce risk by blocking ports where not required, restricting device types, and scanning any permitted media. Provide secure alternatives for file transfer so staff do not need ad‑hoc USB sticks.
What good looks like:
- Default block on removable storage, allow by exception with approval
- Device control and data loss prevention to monitor usage
- Approved, secure file‑sharing solutions and clear guidance for staff
5) Use firewalls and network controls
Firewalls act as a first line of defence between internal networks and the internet. Apply default deny where practical, restrict inbound and outbound traffic, and enable features such as intrusion prevention and web filtering. Use host firewalls on endpoints and segment internal networks to limit lateral movement.
What good looks like:
- Properly configured perimeter and host‑based firewalls
- Application‑aware controls, DNS and web filtering
- Segmentation of critical services and monitoring of east‑west traffic
Bringing it Together
No single control stops every threat. A layered approach that combines prevention, detection, response, and recovery is essential. Training and clear processes matter as much as technology. When organisations align controls to their risk profile and keep them well managed, they significantly reduce the likelihood and impact of malware incidents.
Talk to CyberLab
CyberLab helps organisations assess their exposure, strengthen controls, and get more value from existing tools. To discuss how to improve protection against malware and wider cyber threats, the team is available to help shape a pragmatic plan that fits the environment, budget, and risk appetite.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
Vulnerability Assessment vs Penetration Test: Key Differences Explained
What Is The Difference & When To Use Each?
CyberLab explains how Vulnerability Assessments (VAs) and Penetration Tests (Pen Tests) work, how they complement each other, and how to build a sensible testing cadence that fits risk and change.
Quick Summary
- Vulnerability Assessment: Automated discovery of known weaknesses across systems and networks, producing a prioritised list to remediate. Fast coverage, broad visibility, highly repeatable.
- Penetration Test: Expert‑led simulation that chains weaknesses to achieve realistic attack objectives, validating impact and controls. Deeper insight, business‑level risk narrative, targeted improvements.
Both are essential. A VA finds what is exposed. A Pen Test proves what is exploitable and why it matters.
What is a Vulnerability Assessment?
A Vulnerability Assessment actively scans internal and/or external infrastructure to identify known weaknesses that attackers could exploit. It is run against defined IP ranges or assets and produces a report with findings and remediation guidance.
Typical issues uncovered include:
- Unpatched or end‑of‑life software
- Misconfigured or exposed services and ports
- Default or weak credentials (for example, admin/admin)
- Insecure protocols and ciphers (for example, legacy TLS versions)
Where it helps most:
- As the first step in a security testing journey, establishing a baseline quickly
- As a regular control to catch drift from secure baselines, configuration errors and newly disclosed vulnerabilities
Cadence: Monthly or quarterly is common, depending on change rate and risk appetite. Remember that VAs, like Pen Tests, provide a point‑in‑time view, so frequency matters.
Beyond automation: While scanning is largely automated, experienced teams add value with context, open‑source intelligence (OSINT) where appropriate, and aftercare that helps teams interpret, prioritise and fix efficiently.
What is a Penetration Test?
A Penetration Test goes further and deeper. It uses expert techniques to validate how vulnerabilities can be combined, exploited and escalated to achieve meaningful objectives.
Activities typically include:
- Research and reconnaissance
- Threat modelling and attack path analysis
- Vulnerability exploitation and privilege escalation
- Lateral movement and data access validation (within agreed scope)
- Documentation of impact with an executive summary, attack narrative, and ranked remediation plan
Cadence: Often annual as a baseline, with additional testing after significant changes such as new remote access solutions, major application releases or compliance drivers. Pen Tests are more resource‑intensive and take longer than VAs, which is why a staged approach is effective.
A Simple Analogy
Think of a network as a house.
- A Vulnerability Assessment identifies weaknesses: a rusty lock, a half‑open window, a bin that could be used as a step.
- A Penetration Test tries to chain these findings: test the lock, leverage the bin to reach the window, and prove whether a break‑in is possible.
Both insights are valuable. The VA shows where to improve. The Pen Test shows what really happens if issues are left unfixed.
Key Differences at a Glance
- Depth vs breadth: VA prioritises coverage and speed, Pen Test prioritises depth and realism.
- Automation vs expertise: VA is largely automated with expert interpretation, Pen Test is expert‑led throughout.
- Outcome: VA provides a list of weaknesses to remediate, Pen Test provides validated attack paths, business impact and targeted fixes.
- Frequency: VA more frequent to reduce exposure between changes, Pen Test periodic or change‑driven to validate resilience.
How They Work Together
- Start with a VA to remove the obvious and reduce the attack surface quickly.
- Follow with a Pen Test to validate critical paths, controls and detection/response.
- Repeat VAs regularly to catch configuration drift and new vulnerabilities.
- Trigger Pen Tests after major change or on a set cycle to keep assurance current.
What ‘Good’ Looks Like in the Reports
Vulnerability Assessment report:
- Clear asset scope and scan coverage
- Findings grouped and prioritised by severity, with fix guidance
- Trends over time when assessments are run regularly
Penetration Test report:
- Executive summary in business terms
- Attack narrative that explains how access was achieved and what it enabled
- Ranked vulnerabilities with technical detail and remediation steps
- Evidence that supports replication and verification
Both are only worthwhile if the organisation acts on remediation and tracks closure.
Practical Testing Cadence
- High change or internet‑facing assets: VA monthly, or more frequently for critical services
- Broad internal estate: VA quarterly
- Pen Test: annually as a baseline, plus after significant architectural or application change, or when required by regulation
Plan windows carefully. Automated scans can be “noisy” on the network, and some Pen Test activities may require coordination to avoid operational disruption.
Choosing a Trusted Provider
Look for independent, accredited testing delivered under strict NDAs and with clear separation from sales and implementation teams. Frameworks such as CREST help ensure quality, ethical practice and consistent methodology. Vendor‑agnostic reporting and unbiased recommendations support better decision‑making.
Getting Started
CyberLab helps organisations plan a sensible testing programme, starting with rapid visibility through a Vulnerability Assessment and moving to targeted Pen Testing that validates real‑world risk. The team can also support prioritised remediation and help embed repeatable processes so improvements stick.
To discuss scope, cadence and outcomes that fit your environment and risk profile, the CyberLab team is available for an initial consultation.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
What is Social Engineering and How Can You Prevent It? Essential Tips
Everything You Need To Know
When people think of insider threats, they often picture a disgruntled employee misusing legitimate access. In reality, one of the most dangerous risks comes from well‑intentioned employees being manipulated by attackers. This is the essence of social engineering.
What is Social Engineering?
Social engineering is a tactic where attackers exploit human behaviour rather than technical flaws. Instead of breaking through firewalls, they trick individuals into giving away information, credentials or access. These attacks rely on trust, curiosity or a desire to help.
Unlike malicious insiders, social engineering attacks are usually launched by external actors who manipulate employees into actions that compromise security – such as clicking a malicious link or sharing sensitive data.
Common Types of Social Engineering Attacks
Phishing
The most widespread form of social engineering. Attackers send emails, messages or create fake websites that mimic trusted organisations (banks, government agencies, major brands). Victims are lured into entering credentials or downloading malware.
Baiting
Offering something enticing – like free music downloads or branded USB drives – in exchange for action. Once the bait is taken, malware is installed or data is harvested.
Quid Pro Quo
An attacker offers a service in return for information. For example, posing as IT support and offering “free troubleshooting” in exchange for login details.
Pretexting
Building a false sense of trust by impersonating someone in authority (e.g., HR, IT, auditors). The attacker fabricates a scenario to justify requests for sensitive data or access.
Piggybacking (Tailgating)
Physical intrusion by following an authorised person into a restricted area or borrowing a device under false pretences. For example, asking someone to hold a door open because they “forgot their badge”.
Why Social Engineering Works
- Human nature: People want to be helpful and avoid conflict.
- Authority and urgency: Attackers often create pressure to act quickly.
- Familiarity bias: Impersonating colleagues or trusted brands lowers suspicion.
How to Protect Against Social Engineering
1. Be cautious with emails and attachments
If you don’t recognise the sender, don’t engage. Even if you do, verify suspicious requests through a separate channel (e.g., call the person directly). Remember: email addresses can be spoofed.
2. Use layered security
Deploy professional spam filters and enable multi‑factor authentication (MFA). MFA adds a critical layer of defence if credentials are compromised.
3. Think before you click
If an offer seems too good to be true, it probably is. A quick online search can confirm whether it’s legitimate or a scam.
4. Secure your devices
Maintain a standard build, keep antivirus and firewalls active, and apply patches promptly. Outdated systems are easy targets.
5. Educate and test regularly
Run security awareness training and simulated phishing exercises. People are the first line of defence – make sure they know how to spot and report suspicious activity.
Key Takeaway
Technology alone cannot stop social engineering. The most effective defence combines awareness, process and technology.
By training staff, enforcing strong access controls and maintaining layered security, organisations can significantly reduce the risk of a successful attack.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
Securing Healthcare Organisations with Modern Cyber Defence Strategies
Navigating Cyber Security Challenges
Healthcare organisations often face challenges in safeguarding sensitive patient data and critical infrastructure.
With 67% of healthcare organisations hit by ransomware last year, the threat level is high. In this blog, we explore the complexities of securing healthcare organisations amidst the evolving threat landscape and discuss strategies to mitigate risks effectively.
Understanding the Threat Landscape
Healthcare organisations are prime targets for cyber attacks due to the valuable information they possess, including medical records, financial data, and intellectual property. Threat actors, ranging from cyber criminals to nation-state actors, constantly probe for vulnerabilities to exploit.
Some of the most common threats to healthcare include:
- Phishing Attacks: Cyber criminals use deceptive emails or messages to trick employees into revealing sensitive information or installing malware.
- Ransomware: Malicious software encrypts critical data, rendering it inaccessible until a ransom is paid, disrupting healthcare operations and patient care.
- IoT Vulnerabilities: The abundance of Internet of Things (IoT) devices in healthcare introduces new attack vectors, posing risks to patient safety and data integrity.
Cyber Diagnosis: Navigating Cyber Security Challenges in Healthcare
In this exclusive webinar hosted by CyberLab, in collaboration with industry-leading partners Sophos, Logpoint, Forescout, and SecurEnvoy, we explore how to safeguard healthcare organisations against cyber threats.
“We have Microsoft E5 licences, are the included protections enough?”
Many healthcare organisations leverage Microsoft E5 licenses for cyber security capabilities. While these subscriptions offer robust security controls, they may not address all security requirements.
- Comprehensive Coverage: Assess whether E5 subscriptions adequately cover endpoints, servers, and other critical assets, including unmanaged IoT devices.
- Third-Party Integration: Evaluate the interoperability of Microsoft tools with third-party solutions to ensure comprehensive threat detection and response capabilities. For example, Sophos offer MDR for Microsoft Defender.
- Continuous Improvement: Cyber security is an ongoing process and organisations need to invest in regular assessments, updates, and training to stay ahead of emerging threats.
Balancing Budget Constraints and Cyber Security
Securing healthcare organisations requires striking a balance between budget constraints and cyber security needs. Key strategies include:
- Risk-Based Approach: Prioritise investments based on the organisation’s risk profile, focusing on critical assets and vulnerabilities.
- Baseline Security Practices: Implement foundational security measures, such as patch management, access controls, and employee training, to establish a strong security posture.
- Vendor Collaboration: Partner with trusted vendors and technology providers to leverage expertise, identify gaps, and implement cost-effective security solutions tailored to the organisation’s needs.
Next Steps
Securing healthcare organisations is a multifaceted challenge that demands a proactive and strategic approach. By understanding the evolving threat landscape, evaluating security controls, and balancing budget constraints with cyber security priorities, healthcare institutions can mitigate risks effectively and safeguard patient data, ensuring continuity of care.
CyberLab look after over 150 public and private healthcare providers, working together to develop solutions that secure their sensitive data, meet compliance requirements, and ensure online threats don’t compromise their operation.
Our range of security services and solutions have been developed to meet the requirements of the NHS Data Security and Protection Toolkit (DPST) and future-proofs against the NCSC’s Cyber Assessment Framework (CAF).
Want to know more about how to secure your healthcare organisation? CyberLab will be at the Healthcare Excellence Through Technology (HETT) Conference in London, so come and talk to us!
Find out more about our healthcare solutions or book a consultation to speak to one of our experts.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
Top 5 Cyber Attacks of 2024: Even The Mighty Can Fall in Minutes
Even the Mighty Can Fall: The Top Five Cyber Incidents of 2024 So Far
Ministry of Defence, Microsoft, and more!
As we approach the halfway point of 2024, we have already witnessed several significant cyber incidents that have had far-reaching impacts on major global organisations. These incidents have led to the likes of the MITRE, Microsoft and even the Ministry of Defence (MoD), having to answer uncomfortable questions as to how these incidents occurred.
In this blog, we highlight the top five cyber incidents of the year so far, examining what happened, who was affected, the fallout, and the broader implications for cyber security practices. Join us as we cover these major cyber incidents and explore the lessons we can learn from them.
Chinese State-Sponsored Cyber Attack Campaign
Hackers backed by China’s government spy agency have been accused by the US and UK of conducting a year-long cyber-attack campaign, targeting politicians, journalists, and businesses. The campaign, attributed to a Chinese state-sponsored hacking group, aimed to steal sensitive information, and disrupt critical infrastructure. These coordinated cyber attacks reveal the growing threat posed by nation-state actors and the need for international cooperation to combat hostile nation states or state backed cyber threats effectively. [source: The Guardian]
These attacks highlight that cyber threats don’t just originate from opportunistic cyber criminals, they also have the power of nation-states behind them. Organisations need to ensure they are regularly reviewing their cyber security posture to ensure that cyber defences are up to date and current best-practices are followed. A cyber security posture assessment can highlight the strengths of your organisation’s defences and also indicate where you should focus for improvement.
Ministry of Defence Data Breach
In a significant data breach reported earlier this month, personal information of an unknown number of serving and former UK military personnel was accessed through a payroll system used by the Ministry of Defence (MoD). The compromised data includes names, bank details, and, in some cases, personal addresses. The breach, which targeted a system managed by an external contractor, did not involve any operational MoD data. Immediate action was taken to take the system offline, and investigations are ongoing. Defence Secretary Grant Shapps is set to outline a response plan, which will include measures to protect affected individuals.
Whilst it has still not been revealed as to who is behind the attack, this incident highlights the importance of securing supply chains and systems managed by external contractors and demonstrates how easily vulnerable products can leave even the most mature organisations exposed to persistent threat actors.
MITRE R&D Network Penetrated
In another unfortunate tale of supply chain security, MITRE disclosed a significant cyber-attack in April 2024, orchestrated by state-sponsored hackers that exploited zero-day vulnerabilities in Ivanti VPN software.
MITRE are a key player in R&D for US government projects and authors of the widely adopted MITRE ATT&CK framework . The attack, attributed to a Chinese cyber espionage group known as UNC5221, targeted MITRE’s NERVE (Networked Experimentation, Research, and Virtualization Environment) an unclassified network used for research and development.
The hackers leveraged vulnerabilities CVE-2023-46805 and CVE-2024-21887, deploying sophisticated malware such as BrickStorm and BeeFlush, and used compromised administrator credentials to create rogue virtual machines.
This breach again underscores the critical importance of supply chain security, as vulnerabilities in third-party products can serve as entry points for significant cyber attacks. Organisations looking to prevent these types of attacks should have rigorous vulnerability management and ensure they are using supply chain risk assessments to determine the best third-parties to work with.
Despite maintaining persistence and attempting lateral movement within the NERVE infrastructure, the attackers failed to access other resources. This highlights the importance of architecture and configuration as although the hackers got in, their movement within the network was restricted and therefore reduced the damage these cyber criminals could do.
Microsoft Azure Data Breach
According to an article posted by Spiceworks, Microsoft’s premier cloud service, Azure, suffered a data breach in February 2024 affecting hundreds of executive Azure accounts, raising concerns over the security of big cloud-based platforms. The breach revealed critical vulnerabilities in Microsoft’s security measures, similar to previous incidents.
The attackers exploited a zero-day vulnerability, CVE-2024-21410, in Microsoft Exchange servers, which allowed them to access and misuse Windows NT Lan Manager (NTLM) hashes to impersonate legitimate users. Up to 97,000 Exchange servers are vulnerable to this flaw, which has a severity rating of 9.1. Additionally, Microsoft disclosed two more zero-day vulnerabilities: CVE-2024-21412, a security feature bypass, and CVE-2024-21351, a SmartScreen bypass vulnerability. These issues affected Exchange server versions before the February 13th update.
The perpetrators are believed to be hacking groups from Nigeria and Russia using proxy services and phishing links embedded in documents, primarily targeting mid and senior-level executives. This attack, involving user impersonation, data extraction, and financial fraud, marks the first time such a breach has occurred on the Azure platform.
Microsoft has since implemented measures to mitigate the impact of the breach and enhance the security of its cloud services. This incident brought Microsoft back under fresh scrutiny as a similar incident occurred in 2023 where Chinese-backed hackers were able to access sensitive data stored within the Azure platform [source: NPR]
These two incidents underscore the importance of regular vulnerability scanning and patch management. Organisations looking to mitigate risks from outdated software and zero-day vulnerabilities should ensure they have a robust patch management process and conduct regular vulnerability scans across their infrastructure and applications to maintain the integrity of their estate.
With such a vast and evolving suite of customisable products and features, it can be hard to stay up to date with the most recent security recommendations for Microsoft 365. In a Microsoft 365 Security Assessment, CyberLab can help you ensure security in your day-to-day operations by reviewing your MS365 configuration against industry-standard benchmarks from the Centre for Internet Security (CIS).
Cyber Attacks on NHS Dumfries and Galloway
Digital transformation has revolutionised processes and information management, especially within the healthcare sector. However, with these advancements come significant cyber security challenges.
NHS Dumfries and Galloway faced significant disruptions due to a cyber attack targeting its systems. The attack, which occurred in early 2024, prompted concerns over the security of sensitive healthcare data and patient records.
While details about the nature and extent of the breach remain limited, the incident underscores the persistent threat posed by cyber attacks on critical infrastructure, particularly in the healthcare sector.
Learn about the complexities of securing healthcare organisations amidst the evolving threat landscape and discover the strategies to mitigate risks in our Securing Healthcare Organisations blog.
In Conclusion
In conclusion, the top five cyber attacks of 2024 so far serve as a stark reminder of the evolving threat landscape. By understanding these incidents and implementing a layered and strategic approach to cyber security, organisations can better protect their people, data, and customers.
Stay vigilant, continuously update your defences, and ensure your incident response plans are robust to safeguard against future cyber threats.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
Exploiting ChatGPT: The Darkside of AI and Emerging Cyber Threats
How Cyber Criminals Are Weaponising AI
Artificial intelligence (AI) being used for malicious intent has surfaced as a significant concern within the digital space. Cyber criminals are using Large Language Models (LLMs), like ChatGPT, and deepfake technology to launch cyber-attacks and scams. In this blog, we focus on the darker facets of AI, shedding light on the exploitation of AI systems, its impact on the threat landscape, and what organisations can do now to better protect themselves and their most sensitive assets against this new wave of threats.
Malicious ChatGPT Prompts for Sale on the Dark Web Marketplace
- Recent reports reveal a disturbing trend where thousands of malicious prompts designed to jailbreak and exploit AI are up for sale on the dark web. These prompts deceive AI models, enabling threat actors to steal data, orchestrate sophisticated scams and other illegal activities with alarming efficiency.
- According to recent research carried out by Kaspersky, thousands of these nefarious prompts and compromised premium ChatGPT accounts are now available for purchase, posing a significant threat to ChatGPT, its users and their data. (source: The Register)
Deepfake and AI: Partners in Crime
AI and deepfake technologies are becoming more readily available. OpenAI, for example, recently announced their new generative AI, Sora, that can create video from text. And, although this advancement in technology and its availability is exciting, it is also inevitable that there will be cyber criminals looking to use it maliciously.
Around the globe we are already seeing examples of these technologies being exploited by advanced threat actors, including cyber criminals, nation states or nation sponsored hacker groups.
$25 million theft executed through a sophisticated deepfake scam
A recent article by Ars Technica has shed light on a ground-breaking cyber crime incident considered to be the first successful heist of its kind: a $25 million theft executed through a sophisticated deepfake scam. The scam involved the creation of highly convincing AI generated deepfake videos, which were used to impersonate key individuals within a financial institution.
By leveraging these deepfake videos, the scammer manipulated employees into authorising fraudulent transactions, resulting in the substantial loss. This unprecedented heist marks a significant escalation in the sophistication of cyber criminal tactics, underscoring the evolving threat landscape faced by organisations worldwide. As the prevalence of AI-driven scams will inevitably continue to rise, it becomes increasingly crucial for businesses to bolster their cyber security posture and remain vigilant against such deceptive schemes.
Deepfake news segments
Iran-backed hackers had recently disrupted TV streaming services in the United Arab Emirates (UAE) by injecting deepfake news segments into the broadcasts according to The Guardian. These deceptive deepfake videos, generated using AI technology, were designed to resemble legitimate news reports, spread misinformation, and sow discord among viewers. This incident underscores the growing threat posed by state-sponsored threat actors and the increasing weaponisation of deepfake technology for political purposes.
As nations continue to grapple with the challenges of cyber warfare and disinformation campaigns, it becomes imperative for governments to collaborate and implement international legislation that both prohibits and protects against the use of such attack methods, as well as educate and inform organisations across all industries about AI threats and how best to protect themselves and their assets. Additionally, organisations need to enhance and adapt their cyber security capabilities to be able to identify and defend against orchestrated AI driven attacks, which is backed up by a recent assessment conducted by the NCSC. The assessment focuses on how AI will impact the efficacy of cyber operations and the implications for the cyber threat over the next two years. (source: NCSC)
Tales from the CyberLab: Generative AI in Cyber Security Explained
Global Cyber Threats Expected to Rise With AI, NCSC Warns
According to the above-mentioned assessment by the NCSC, AI is poised to significantly impact the cyber threat landscape in the near future. The report suggests that AI will almost certainly be utilised by cyber adversaries to enhance their capabilities, including the development of more advanced attack techniques and procedures (TTPs).
As AI technologies evolve, cyber criminals are increasingly going to automate tasks, evade detection, and execute targeted attacks with greater precision. This assessment underscores the urgent need for organisations to adapt their cyber security strategies to effectively mitigate the evolving threats posed by AI-driven cyber-attacks. This includes enhancing detection and response capabilities, investing in AI-powered security solutions, enforcing zero trust policies, implementing a culture of sufficient cyber awareness and vigilance amongst staff, and staying informed about emerging AI-driven threat vectors.
While ChatGPT and other LLMs may not yet be capable of being used to write sophisticated malware to be sold at scale on the dark web or be in possession of nefarious nation states, we may not be far away from AI being used to orchestrate attack chains or write malware that can evade detection. A separate recent report from the National Cyber Security Centre (NCSC) sheds light on how AI driven ransomware attacks could become a reality by 2025. (source: NCSC)
What Can Organisations do to Protect Themselves Against AI Threats?
As AI technologies are rapidly evolving, the application of its use for both good and bad is evolving with it, leading to a rapid shift in the threat landscape. It is imperative for organisations to not just understand how to defend against AI driven threats, but to learn how to use AI technologies securely and in a manner that best protects their assets and does not expose them to new vulnerabilities or risk.
Already we are seeing collaboration amongst the international community to tackle this very issue. A recent publication on how to engage with Artificial Intelligence has been developed by the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) in collaboration with the NCSC, United States (US) Cyber security and Infrastructure Security Agency (CISA), Canadian Centre for Cyber Security (CCCS) and several other cyber security/government agencies from international partners. The publication highlights some key threats related to AI systems and summarises steps organisations should take when engaging with AI technologies (both in-house and 3rd parties) to mitigate risk. (source: ASD’s ACSC)
While this new wave of advanced threats seems daunting and paints a bleak future for stakeholders responsible for managing risk, there are several steps organisations can do to protect against these threats. Many of these types of attacks still rely on the presence of human error and social engineering. Regularly training your people and creating a positive cyber awareness culture are key to reducing this type of threat.
Further to this, unsecured vulnerabilities are a common route of entry for cyber criminals and can be identified with regular vulnerability scanning and penetration testing to identify your security weak spots.
Organisations across all sectors, of all sizes should not neglect the fundamental steps that make up the foundations of any cyber security strategy. Few organisations have the right tools, people, and processes in-house to manage their security program around-the-clock while proactively defending against new and emerging threats. Adopting security defences like Sophos MDR can provide an elite team of threat hunters and response experts to take targeted actions on your behalf to neutralise even the most sophisticated threats.
Tales from the CyberLab: AI’s Role in Data Protection Explained
In Conclusion
For better or worse, AI is going to change how we live our lives greatly, and while its application for solving huge problems on a global scale is something to be embraced, we should also be aware of its capacity to cause great harm. Organisations need to adapt to the new world of AI driven technologies and attacks, whilst continuing to invest in the foundations of their cyber security posture.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.