Secure Architecture & Configuration for Cyber Security
Design, Build, Maintain and Manage Systems Securely
- Understanding what you are building and why
- Making systems that are easy to maintain and update
- Making compromise and disruption difficult
- Reducing the impact of compromise
- Making it easy to detect and investigate compromises
- Safely developing and managing systems
Adopting a secure architecture is an ideal most organisations aspire to. However, most companies have an existing environment that was architected years ago when the cyber security threat landscape didn’t vaguely resemble the threat landscape we have today. Tearing it all down and starting again is usually not an option, so what do you do?
Designing a systems architecture in line with the MITRE ATT&CK framework is a nice to have, but disrupting a business while you build, migrate and then UAT such an environment simply isn’t practical. Therefore, this blog post will touch upon the theoretical principles you would use to build such an environment if you were starting from scratch as well as include recommendations on how you can do your best to ensure that you are doing the basics right in your existing environment.
Understand What You Are Building and Why
Having a clear vision of the purpose that your environment will serve is key:
- Will there be lots of externally facing or customer accessible elements for example?
- Will the environment primarily be used to host DevOps people who will constantly be needing new VM’s spun up and down?
- Will huge databases be hosted that support applications or interact with cloud resources?
Understand the level of risk that your organisation is willing to accept. Ensure there is an understanding that zero risk is possible, but the cost will be significant – work with your business to understand where the trade-off between acceptable risk and acceptable cost lies.
Ensure you have a concept of how long the system you are designing now is likely to be around for? Legacy systems can be a huge cyber risk. If OS versions will go end of life in 5 years – how will that be accommodated? This will be essential in ensuring that you are building system that is fit for purpose now and in the years to come.
Make Systems Easy to Maintain and Update
Maintenance and support is going to be necessary. Many organisations get stuck with systems that are out of date because they simply cannot take them down for any length of time. This means they are forced to implement other complex, costly solutions to protect the vulnerable areas.
Making it as easy as possible to get updates out and having the confidence that they have been successfully applied is key. You should only use supported OS versions. For anything that doesn’t have reliable automated updates, either use something else or find a methodology that works. For example, you may have to segment that device from everything else and patch it manually.
Patching – Hardware, Firmware, OS & Applications
Patching software vulnerabilities is one of the best ways to ensure your systems are secure. Not only does it remove software flaws, but it means that your organisation is more difficult to compromise. It may not be a deterrent to someone intent on gaining access, but it certainly will be for the opportunistic cyber criminals that are running automated botnets scanning for open ports or phishing email campaigns. If they can’t find an easy foothold, many will simply look elsewhere.
Change Management
Change management should be used to ensure stability of systems, verification of changes prior to implementation as well as providing a record of changes made should an incident occur.
Make Compromise & Disruption Difficult
Having a layered network architecture is a great idea but can be very complex to manage not to mention difficult and/or time-consuming to work with. But as we’re starting again then look at the MITRE ATT&CK framework, familiarise yourself with the tenets it conceptualises and adapt your design approach accordingly. Ensuring that your network is compartmentalised. Then a compromise of a single area does not compromise the entire environment – the same approach to damage limitation/control the military uses. From a risk perspective it’s brilliant and it means you can segment the sensitive data away from any avenue of direct or indirect attack.
Use anti-spoofing controls such as DMAC, SPF and DKIM to make it difficult to spoof your email domains, again, this will deter many threat actors or force them to use domains that are obviously fake and easier to spot.
Web Content Filtering
Actively blocking access to types of unregulated websites protects your environment from the risks posed by embedded or hidden malware as well as users from potentially offensive, malicious or distressing content
Firewalls
Using firewalls has been a staple of IT environments for a very long time, there are still a lot of legacy-type firewalls in use that are not really suitable to combat todays cyber threats, use of next-gen firewalls is recommended if not already in use.
Reduce the Impact of Compromise
Organisations should make it difficult to laterally move from one area of the network to another. Compartmentalisation is arguably worthless of an attacker can still traverse the rest of the environment compromising as they go.
Using next-gen anti-malware to provide the highest levels of protection on your end-points such that should malware get to the end-point, it is detected and removed promptly before it can do damage.
Ensure you have good backup discipline, having a secure local backup repository can mean the difference between a restore operation taking days versus weeks to restore from cloud or off-site repositories. Virtual backup servers are a risk that organisations should avoid. If you lose the virtual environment, you lose your backup server as well. This means you will have to manually rebuild the hypervisor and the backup server to restore everything else.
Monitor for Indicators of Compromise
There are an increasing number of analysis tools available that will user heuristics, ML and AI to automatically monitor network traffic and correlate individually benign indicators of compromise to provide a clear picture of malicious activity and act before damage is done.
Use True Next-Gen Anti-Malware – Must Include AI-Based Detection
Using next-gen anti-malware to provide the highest levels of protection on your end-points such that should malware get to the end-point, it is detected and removed promptly before it can do damage.
Make It Easy to Detect and Investigate Compromises
Communication flows between different components can be particularly vulnerable to exploitation methods such as MITM attacks. Organisations should use tools such as encryption and network access control lists to protect against this and make any subversion attempts easier to spot.
Build a Methodology to Triage and Respond When There Is a Problem
The likelihood of a cyber incident occurring in any business is only going to increase as new threats emerge and the pace at which we work continues to increase. Mistakes will happen. Your incident response speed is vital to maintain high customer confidence.
The cost of cyber incidents is also largely underestimated by most organisations until they are faced with them. Hidden costs from regulatory fines, loss of reputation, legal fee’s from customers whose data has been compromised can all be very real problems.
Safely Develop and Manage Systems
Ensure clear demarcation between production and development systems. Have clearly defined software release processes to prevent untested development software being loaded onto production systems.
The number of remote workers is increasing and with that the variety of devices being connected to business systems. You need to have a clear understanding and control of the connected devices as well as how and where they are being connected. This is important to ensure the devices are legitimate and to protect against data exfiltration.
Control Applications in Use in the Environment
Application control ensures that users do not have the ability to use or install unauthorised software. Having rigorous application control in place with regular software audits can help identify software that should not be there and may be an indicator of compromise.
How CyberLab Can Help
CyberLab can provide consultancy and support on your key technology projects, help deliver business solutions, support your users in adopting them and provide managed or reactive support when your solution is up and running.
If you haven’t done so already, our Posture Assessment tool is a quick-and-easy way to identify your strengths and weaknesses, and get a better picture of your overall security posture.
We have put together a page of recommendations for improving your Architecture and Configuration, and which tools can help, which you can read here.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
How to Prevent Cyber Attacks with Effective Logging and Monitoring
Detecting and Preventing Cyber Incidents
- Why Do We Need Logging and Monitoring?
- How Do We Do Logging and Monitoring?
- Identifying the Right Solution
- Our Recommendations
Why Do We Need Logging & Monitoring?
The dark web has been hugely commoditised and it is now very likely that multiple cyber criminals will gain awareness that you are vulnerable. This happens when one attacker, called an access broker, gains access to your environment and then sells that access to multiple other attackers. Their goal? Making money, causing chaos, stealing secrets, and holding your data hostage.
The risk and cost for organisations that are victim to cyber attacks are also increasing. The result of cyber attacks are often downtime, disruption and data loss. There are also other consequences many organisations face such damage to reputation, hefty fines for compromised data, losing trust from valued customers, and even the loss of hard-earned certifications.
While it might seem like a digital doomsday out there, here’s the secret: cyber attacks leave footprints. The art of prevention lies in spotting these traces before the attack compromises your systems and data. It’s like catching a thief in the act before they can make off with the loot. If you can detect unauthorised activity before damage is done, you can stop or prevent the attack being successful and limit the damage. That’s where logging and monitoring solutions come in.
They have a secondary function as well, anyone who has suffered a cyber attack will tell you that despite having the initial detection of something untoward going on, it can be really difficult to actually feel confidence that you can see the whole picture and you are aware of everything that’s going on – logging and monitoring helps with that as well.
How Do You Do Logging & Monitoring?
In even relatively small IT environments, the scale of log information that will be generated is overwhelming. Especially if it’s scattered across multiple environments like public/private cloud/SaaS etc.
The first challenge? Gathering all these pieces into a single, meaningful picture. Endpoint Detection & Response and eXtended Detection and Response (EDR/XDR) and Security Information and Event Management (SIEM) solutions provide this central location to collate and view the log information from multiple sources.
So, you’ve got all your puzzle pieces in one place, but they’re still just random bits until you put them together. That’s where the real magic happens: processing. EDR/XDR and SIEM solutions typically sift through the sea of data to block out the ‘noise’.
Solutions such as LogPoint leverage some form of AI or ML intelligence to give an indication of how likely a particular event is going to be related to malicious activity. LogPoint’s version is called UEBA, which stands for User Entity Behaviour Analytics. UEBA uses AI and ML to correlate multiple events and link related ones together to give a fuller picture than looking at individual events in isolation.
EDR/XDR solutions usually do something similar but typically the events they are correlating are limited to information coming from endpoint security or proprietary network devices. LogPoint and other SIEM tend to have a much broader scope of interoperability and call pull event information from pretty much anywhere that it’s being generated.
How Do I Know Which Solution Is Right?
It can be difficult to know which solution is right for your organisation, and its often a case of selecting which fulfils your need the best. If you don’t need to monitor extensive hardware devices, web sites, databases, etc, then an EDR/XDR solution might be for you. If you have multiple databases or databases that hold sensitive information, it’s probably a good idea to be watching them closely via a SIEM solution as they will be a prime target for an attacker.
With both types of solution the information still needs to be monitored by a human. LogPoint mitigate this through the use of their Security Orchestration and Response (SOAR) technology that aims to take automated action based on certain triggers when particular activity is detected. EDR/XDR solutions often have similar functionality but it’s probably fair to say they are not quite as extensive or complex as a SIEM solutions.
These automated response solutions are great, but they can also be incredibly disruptive if allowed free reign over systems. Very quickly users will be complaining they cannot carry out their duties because things are being blocked. This brings me to the final challenge with logging and monitoring, it invariably means a security specialist with “eyes-on-glass” (i.e., watching the screen) is necessary to manage both types of solutions effectively.
Again, the approach to take to manage this final challenge depends on any number of factors – the size of business, the driving forces behind the adoption of logging and monitoring, the desire for Opex over Capex, or the constant problem of getting skilled Cyber security staff, to name just a few.
What Would CyberLab Recommend?
If an organisation lacks in-house expertise but recognises the value and importance of logging and monitoring, it is increasingly common to adopt a managed service approach.
This involves partnering with third-party suppliers who have dedicated security specialist teams to handle the heavy lifting. One of the key benefits of this approach is peace of mind – knowing that systems are being actively protected around the clock.
To support this, the Posture Assessment tool offers a quick and easy way to identify strengths and weaknesses, providing a clearer picture of overall security posture.
A dedicated page of recommendations for improving logging and monitoring is available, including guidance on which tools can help.
For organisations looking to strengthen their security and protect their data, a consultation with one of our experts is available to explore tailored solutions.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
What Is Incident Management in Cyber Security and Why It Matters
Secure Your Organisation. Protect Your Data.
Our host outlines importance of incident management for effective cyber incident response and minimising the impact on an organisation.
He covers:
- Understanding Incident Management
- What Does Incident Management Mean
- How to do Incident Management
What Does ‘Cyber Incident’ Mean?
The NCSC’s definition is…
“A breach of a system’s security policy in order to affect its integrity or availability and/or the unauthorised access or attempted access to a system or systems; in line with the Computer Misuse Act (1990).”
This definition covers number of potential scenarios – e.g. intentional or accidental data breaches, disruption of services due to DDoS, web application exploitation – it’s no longer just about how you fix a malware outbreak in the environment.
Understanding Incident Management
Incident management has historically been an aspect of Cyber Security that wasn’t considered until it’s too late primarily since it meant a malware outbreak. Today, with the instances of cyber incidents becoming increasingly frequent many organisations are developing Incident Management processes either because they have suffered an attack and understand the value in being more organised, or they realise the likelihood of one occurring and want to be prepared.
Cyber incidents can range in severity from a minor inconvenience to complete loss of the ability to conduct normal business, they are invariably stressful, frequently involving big decisions being made without necessarily having the full picture and may require a co-ordinated response from multiple areas of a business – it’s not just the IT department problem anymore.
The crux of why Incident Management is an essential component in a modern business is in a word control:
- Control of understanding what has happened when an incident occurs, i.e. the scope and severity of the incident.
- Control of the response to manage the situation and ensure the response doesn’t ultimately cause more harm than the incident.
- Control of the recovery to restore normal operation as efficiently and quickly as possible.
What does Incident Management mean?
Before we get into this, there are two terms we need to be aware of – Cyber Incident Management, and Cyber Incident Response.
The Incident Management element is the overarching banner that manages the 6 different stages of the Incident response:
- Triage
- Analyse
- Contain/Mitigate
- Remediate/Eradicate
- Recover
- Review
We’ll talk more about these in the next section. But for now, lets just say that incident management is more of an oversight aspect that might be managed by a dedicated cyber response management team made up of stakeholders from across the business.
A cyber incident response therefore is a pre-existing methodology of steps to be taken during and after a cyber incident occurs with the cyber incident management being the management ‘plane’ co-ordinating and sometimes controlling the stages of the response.
As a whole the term incident management is a collection of pre-defined processes that direct who, how and when a business responds to the occurrence of cyber incidents.
It’s worth noting that the model in the graphic is a guide, individual cyber incident response plans may differ from business to business depending on requirements.
How do you do Incident Management?
First – you are going to need to develop a process to follow.
I’ve already mentioned that Incident management is more of an overarching term or function that acts as command and control to the actual incident response; this would typically be a team of stakeholders from across the business that provide oversight and guide the response to ensure it is proportionate.
Again, there are no hard and fast rules as such since no two businesses are identical, but broadly speaking there should be a tiered approach to incident management – e.g. having a minor, intermediate and major response plan could be a starting point since it would be impossible to develop a response plan specific to every potential scenario. Each tier would then dictate a different level of response and perhaps even a different approach to the incident.
Triage
When there are indications that an incident has or is occurring, the incident management team need to convene and begin understanding the scope of the incident they are looking at, its nature and decide which level of response is most appropriate – this could be determined by one or several factors such as the number of customers affected, the number of users affected, have mission critical services been affected – the criteria will likely depend on what is most important to your business’ operation.
Often the Triage phase will dictate which of the incident management plans will be invoked, part of the process would then be to set the response team off conducting the analysis phase, whilst the incident management team brief the business on the initial situation, provide notification of outages or disseminate preventative action they wish users to take.
Analyse
The purpose of the analyse phase is to understand exactly what is going on as quickly as possible, this phase is to help plan for the next phase but it’s also an opportunity to verify any assumptions were correct with regard to the scope of the incident – e.g. what looked like a minor incident may prove to be more serious once investigation is underway and the incident management team need to be briefed and take action accordingly.
Contain/Mitigate
Once analysis has been concluded there should be a good understanding of what is happening in the environment and steps can be initiated to stop the problem getting worse. The specific response is going to depend entirely on the nature of the incident but the intent of this phase to prevent the incident escalating further and to limit the damage to services and infrastructure. This phase may also extend to damage control to the business from a reputation perspective through the use of press releases to demonstrate honesty.
Remediate/Eradicate
Once the incident is controlled and is not worsening, the task of rectifying the issue or removing the threat that caused the incident begins, again the structure and processes of this phase depend on the nature of the incident as different cyber incidents will have different responses.
Recover
With the Cyber Incident now dealt with the focus needs to be on restoring business-as-usual operation and this is the recovery phase, i.e. getting the environment/business from the post incident state back to the point where normal operations can be resumed. This phase is made immeasurably easier if you had robust backup processes in place as restoring system services and data becomes a question of how long instead of how do we do it!
Read blog post: Recover from a cyber attack | CyberLab®
Review
The review phase is exactly what it sounds like, an after action debrief of what has happened, what did we do well, what could have been done better, did any part of the process not work, why didn’t it work and how to we make sure it works next time.
Review is almost as vital as any other area of the response plans as it means you will be better equipped next time to deal with the problem.
Training
One last section that isn’t part of the NCSC plan, but is recommended, is security training. Running desktop exercises should be conducted quarterly to ensure there is familiarity with the processes but it can also contribute to the Review section to help improve processes and increase the efficiency and speed of the response.
Want to test your incident response plan? The NCSC provide a great tool: Exercise in a Box – NCSC.GOV.UK
In Conclusion
Incident management processes deliver several benefits to your business:
- Effective incident management lessens the impact of a cyber incident.
- A practised plan will help you make good decisions under the pressure of a real incident.
- A well-managed response, with clear communication throughout, builds trust with shareholders and customers.
- Learning from incidents identifies gaps and issues with your response capability.
If you haven’t done so already, our Posture Assessment tool is a quick-and-easy way to identify your strengths and weaknesses, and get a better picture of your overall security posture.
We have put together a page of recommendations for improving your Incident Management, and which tools can help, which you can read here.
If you’d like to learn more about how to secure your organisation and keep your data secure, book a consultation with one of our experts.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
Cyber Security Essentials for Websites and Applications: Safeguarding E-Commerce
Safeguarding E-Commerce Success
With e-commerce thriving as a cornerstone of retail, securing websites and applications has never been more critical. Cyber criminals target vulnerabilities in commercial platforms and websites to exploit sensitive customer data and disrupt operations.
This month, we explore the cyber threats and implications facing online retail and e-commerce, as well as delving into some best practices and frameworks like OWASP, and secure development methodologies, to help organisations stay secure online.
Why Application Security Matters for E-Commerce
Threat Landscape
Cyber crime targeting e-commerce platforms remains a top concern, according to the NCSC, 50% of UK businesses experienced a cyber attack in 2023 alone. 18% of breaches that were reported in 2023 to the Information Commissioner’s Office (ICO) were in the retail sector.
Rising Threats
Cyber crime targeting online businesses in the UK is being driven by increasingly sophisticated attacks, with the number of affected businesses only set to increase year on year. Common threats include SQL injection, cross-site scripting (XSS), and API breaches.
Impact
A single breach can result in financial loss, reputational damage, and even regulatory penalties. For example, Magecart’s attacks on British Airways showcased the devastating impact of compromised third-party integrations, resulting in the flag carrier airline having to pay a £20m data protection fine. [source: The Register]
Trust and Loyalty
Ensuring robust security builds customer trust, enhances brand reputation, and protects critical data like payment information and personal details.
The Rise of API Breaches and the Importance of Secure Third-Party Integrations
APIs (Application Programming Interfaces) are the backbone of modern web applications, enabling integration between systems, other applications, and services. According to Business Wire, a survey in 2022 found that 97% of enterprise business leaders agree that successfully executing an API strategy is essential to secure organisations’ future revenue and growth.
However, their rapid adoption has also made them a prime target for attackers. In 2021, Gartner predicted that APIs would become the top attack vector used to target applications.
Fast forward to 2024 and there have already been some notable breaches…
Peloton API Breach (2021)
Hackers exploited a vulnerability in Peloton’s API that enabled users to make an unauthenticated request for account data to the API without the API first verifying if that user has authorisation to access said data.
The API enables the end users’ bikes to capture and upload data back to Peloton’s servers. Sensitive user data for around 3 million individuals was exposed due to insecure API configurations.
This included personal details such as names, emails, and workout statistics. Peloton’s inadequate authentication and authorisation measures highlighted the critical need for robust API security protocols. [source: Threatpost]
Facebook Data Breach (2021)
An API misconfiguration in Facebook’s (Meta’s) contact importer feature was exploited by malicious actors, exposing the personal data of approximately 533 million users from 106 countries.
Personal data such as phone numbers, full names, and locations were leaked, with the issue originally stemming from scraping public profiles before the vulnerability was patched in 2019. [source: Twingate]
Tales from the CyberLab: Cyber Security for Websites & Apps Explained
Best Practices for Web Application Security
Penetration Testing
Penetration testing is a cornerstone of application security, especially for retail and e-commerce businesses handling vast amounts sensitive customer data and requiring 24/7 availability online.
While large enterprises like Amazon may have the capacity to conduct internal pen testing, most organisations in this space face cost and resource constraints that make outsourcing these services more practical and effective. Partnering with external cyber security experts provides access to specialised skills, tools, and up-to-date threat intelligence that many internal teams simply can’t maintain.
Moreover, hiring third-party testers eliminates the bias that might come with in-house testing and ensures that vulnerabilities are approached with a fresh perspective. The cost of penetration testing is often outweighed by the potential financial and reputational damage of a breach, particularly in high-stakes industries like retail.
Independent testing not only provides peace of mind but also aligns with compliance requirements and industry best practices, ensuring businesses are well-protected against the ever-evolving threat landscape.
Code Reviews
Code reviews are an essential part of any secure development process, ensuring that security vulnerabilities are caught early in the development lifecycle. This practice involves systematically examining source code to identify flaws, errors, or opportunities for improvement, with a strong focus on maintaining high security standards.
For retail and e-commerce businesses, where customer trust is paramount, code reviews play a vital role in protecting sensitive user data and ensuring seamless functionality. Conducting thorough code reviews:
- Identifies Common Vulnerabilities: Helps uncover issues such as injection flaws, insecure data handling, and authentication weaknesses, which align with risks highlighted in the OWASP Top 10.
- Enhances Collaboration: Encourages teamwork among developers, fostering a culture of accountability and shared responsibility for secure coding practices.
- Reduces Costs: Fixing security vulnerabilities during development is significantly less expensive than addressing them after deployment or following a breach.
Given the fast pace of the e-commerce sector, it may be tempting to bypass code reviews to save time. However, the long-term risks far outweigh the short-term gains. Engaging third-party experts or employing tools like static application security testing (SAST) solutions can streamline this process, providing an additional layer of confidence before your code goes live.
Ultimately, code reviews are more than just a quality check – they are a proactive defence against cyber threats, reinforcing the integrity of your applications from the very foundation.
Open Web Application Security Project (OWASP)
Top 10 Vulnerabilities
OWASP (Open Web Application Security Project) offers a globally recognised framework for understanding the most common and prevalent risks facing open web and mobile applications.
Here’s a snapshot of the OWASP Top 10 vulnerabilities every e-commerce platform must address:
- Broken Access Control: Unrestricted access to sensitive functionalities or files.
- Cryptographic Failures: Insufficient cryptographic mechanisms leading to compromise of sensitive data.
- Injection: Exploiting input fields to manipulate databases or applications (e.g., SQL Injection).
- Insecure Design: A broad category representing different weaknesses, expressed as “missing or ineffective control design”.
- Security Misconfiguration: Default settings or unpatched software creating vulnerabilities.
- Vulnerable and Outdated Components: Relying on outdated libraries and frameworks, or application technologies with known vulnerabilities.
- Identification and Authentication Failures: Weak authentication and authorisation processes enabling unauthorised access.
- Software and Data Integrity Failures: Code and infrastructure that does not sufficiently protect against integrity violations
- Security Logging and Monitoring Failures: Insufficient logging, detection, monitoring, and active response, enabling unnoticed breaches. The application cannot detect, escalate, or alert for active attacks in real-time or near real-time.
- Server-Side Request Forgery (SSRF): SSRF flaws occur whenever a web application is fetching a remote resource without validating the user-supplied URL. It allows an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall, VPN, or another type of network access control list (ACL). This is increasingly common in modern web applications.
Secure Development Life Cycle (SDLC)
SDLC emphasises embedding security into every stage of the development process, from ideation to deployment. Key steps include:
- Planning: Identify security requirements early.
- Design: Threat modelling to anticipate potential attack vectors.
- Implementation: Use secure coding practices and tools to detect vulnerabilities in real time.
- Testing: Conduct automated and manual tests, including code reviews and penetration testing.
- Deployment: Monitor applications continuously and ensure robust change management.
- Maintenance: Regularly update, patch, and audit systems post-launch.
More information about SDLC practices can be found here.
Tools and Resources for Strengthening Security
- HackRisk: Streamline vulnerability management and automate security updates.
- CyberLab Penetration Testing Services: Get peace of mind that your applications and customer data are secure with CREST accredited penetration testing and code reviews.
- OWASP ZAP: Open-source tool for identifying web application vulnerabilities.
- Gartner’s Market Guide for API Protection: This guide can help you understand which specialised products can assist in securing your organisation’s APIs.
- NCSC’s Small Business Guide: Practical steps for protecting your digital storefront.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
Important Contracting Company Update: Legal Entity Name Change
Changes to your Contracting Company
We’re making changes to your contracting company.
This transition is part of our ongoing commitment to making life easier for our customers and our people, and reflects our values of simplicity, quality, and passion.
What is changing?
From 2 January 2026, if your contracting company is currently Armadillo Sec Limited or Cyberlab Consulting Limited, this will change. From this date, all quotes will be issued from Chess Cybersecurity Limited (company number 02962709).
On the 1 July 2026, Chess Cybersecurity Limited will change its name to CyberLab Security Limited.
These changes will not affect our standard terms and conditions, pricing, or the level of service you receive.
What do you need to do?
You will need to onboard Chess Cybersecurity as a supplier, with the bank details listed above. If you already have Chess Cybersecurity onboarded as a supplier, no further action is required.
Our team is here to support you with any questions or additional fraud checks you may require.
You can contact your Sales Account Manager, or reach our Finance Team on 0333 050 8120 (Option 3) or at [email protected].
Understanding Incident Management: Your Cyber Safety Net
Incident Response Essentials for Every Team
The importance of safeguarding your organisation’s assets, brand, and reputation against cyber threats cannot be overstated, and so goes the saying “prevention is always cheaper than the cure”, but what about when the worst has already happened?
This month we are focusing on Incident Response, which is often shortened to IR and is a part of Incident Management. We’re deep diving into IR services, and why all organisations need access to IR expertise and support. Discover how to contain and put out the fires that cyber incidents inevitably create with practical strategies for strengthening your organisation’s cyber safety net.
What is Incident Response?
Incident response is a structured approach to addressing and managing the immediate aftermath of a cyber attack or data breach. The incident response process often involves various stages including detection, containment, eradication, remediation, recovery, and lessons learned.
Tales from the CyberLab: Ransomware Response Explained
Incident Response Retainers: Are They Really Necessary?
Incident response retainer services offer organisations proactive support and expertise in handling cyber incidents effectively. These retainer services provide organisations with access to a team of dedicated cyber security professionals who can rapidly respond to incidents when needed. These experts conduct forensic investigations, compromise assessments, and other critical tasks to minimise potential damage and mitigate risks. Additionally, they may offer guidance on handling fallout and media coverage of incidents, ensuring that organisations maintain transparency and effectively manage public perception.
While incident response retainers may initially seem like an additional expense burdening already stringent budgets, their value cannot be overstated. In fact, investing in an incident response retainer can potentially save organisations from incurring staggering costs in the aftermath of a cyber attack.
The reality is that cyber threats are becoming increasingly sophisticated and pervasive, making it not a matter of if, but when, an organisation will face a cyber incident. When such incidents occur, the financial and reputational consequences can be devastating. From the costs associated with downtime, data loss, and recovery efforts to the damage inflicted on brand reputation and customer trust, the fallout of a cyber-attack can be significant.
Furthermore, as we touched on in Reducing Your Cyber Insurance Premiums blog, having an incident response retainer in place can also demonstrate to cyber insurance providers that the organisation is taking proactive steps to manage and mitigate cyber risks, potentially leading to reduced insurance premiums. In essence, incident response retainers serve as a crucial safety net, offering peace of mind and financial protection in the face of evolving cyber threats.
Fail to Prepare; Prepare to Fail
Real-world incidents serve as poignant reminders of the critical importance of robust incident response capabilities. Take, for instance, the notorious NotPetya cyber-attack on Maersk in 2017. Detailed in The Daily Swig, this incident underscored the need for resilience and preparedness in mitigating the impact of cyber threats.
Furthermore, insights from Ship Technology shed light on the vulnerabilities exposed by the Maersk cyber-attack. A study by Futurenautics revealed that 44% of ship operators at the time did not believe that their companies’ cyber security defence capabilities were sufficient enough to repel cyber-attacks, and that 39% had experienced a cyber-attack in the last 12 months. These findings emphasised the urgent need for under-prepared industries to fortify their cyber security posture and adapt to the ever-changing threat landscape.
It was not just the maritime industry that demonstrated the need for industry-wide, incident response readiness. In the same year as the Maersk incident, the infamous WannaCry ransomware attack wreaked havoc on various organisations around the world, particularly the National Health Service (NHS). The WannaCry attack exploited vulnerabilities in outdated software systems, leading to widespread disruption of NHS services, including cancelled appointments, delayed surgeries, and compromised patient care. According to a “Lessons Learned” report by NHS England following the incident, The attack led to the disruption of services in one third of hospital trusts in England, with 80 out of 236 trusts effected.
A recent report conducted by Pheonix Software and the National Housing Federation (NHF) titled “The State of Cyber Security in Housing 2023’ found that just 4% of UK housing associations feel sector is fully prepared for ransomware attack.
It’s not just specific industries that are underprepared, as research found that 73% of surveyed organisations across the U.S., EMEA and APAC countries suffered a ransomware attack in 2022, with 38% being attacked more than once. (source: PR Newswire).
Conclusion
Facing a rapidly changing threat landscape; Ransomware attacks becoming more advanced and frequent, the emergence of AI in cyber attacks, geo-political tensions and increasing concerns about threats to national infrastructure, organisations across all sectors must take proactive steps to enhance their incident response capabilities. Initiatives like Red Teaming and Penetration Testing offer valuable opportunities for organisations to test and refine their incident response procedures through simulated scenarios, ensuring readiness to effectively mitigate cyber attacks.
Leveraging specialised incident response services, from providers like Sophos, can provide organisations with expert guidance and support in navigating cyber incidents. By investing in comprehensive incident response solutions, regularly revising incident response plans, and actively participating in training and exercises, organisations can bolster their resilience against cyber threats and minimise the potential impact of security incidents.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
The Cost of Cyber Security: The CFO's Handbook to Cyber Security Costs
The CFO's Handbook
Tom Davies, CFO at CyberLab, explains why investing in cyber security should be a key priority for CFOs and Finance Directors.
He covers:
- Investing in cyber security to protect your business
- Optimising cyber security budgets
- Cyber security support
Failing to Invest in Cyber Security: A Key Risk to Your Business Survival
Cyber criminals are constantly scanning the internet for vulnerable targets and businesses are often lucrative targets for cyber criminals.
The UK Gov Cyber Breaches Survey for 2024 found that half of businesses (50%) have experienced some form of cyber security breach or attack in the last 12 months. This is much higher for medium sized businesses (70%) and large businesses (74%).
75% of domains identified breaches with Dark Web Monitor
Source: HackRisk, 2025
Failing to invest adequately in cyber security can lead to a breach that jeopardises the survival of your business.
The Cost of Downtime
The average downtime caused by ransomware attacks has risen dramatically, indicates the number of UK victims appearing on ransomware data leak sites doubling since 2022.
Organisations face on average 26 days of downtime following a ransomware attack. Could your organisation afford such a significant disruption?
Optimising Cyber Security Budgets: Balancing Flexibility and Long-Term Savings
Multiyear Licensing vs. Monthly Subscriptions
When planning your cyber security investment, choosing the right funding model is essential, especially when considering your organisation’s cash flow dynamics.
For enterprise-level organisations, multiyear licensing agreements often present a cost-saving opportunity. These agreements typically come with significant discounts, offering a more budget-friendly option over the long term. However, they require an upfront payment, which may strain cash flows depending on your financial situation.
Alternatively, organisations aiming to maintain greater flexibility and preserve cash flow can explore monthly subscription models. While these plans provide a more manageable month-to-month payment structure, they generally come at a higher total cost over the full duration of the agreement.
In-House vs. Outsourced Cyber Security
For enterprise-level organisations, building and maintaining an in-house cyber security team can be a cost-viable option. However, many organisations are struggling to attract and retain the specialised talent required to support such teams effectively. The ongoing global skills shortage in cyber security makes it increasingly difficult to recruit qualified professionals, often leading to overstretched teams and heightened vulnerabilities.
Retaining high-quality talent is critical. Without a well-staffed and adequately trained team, the risk of missing red flags grows significantly.
Outsourced Cyber Security: A Scalable Solution
Ultimately, the choice between in-house and outsourced cyber security comes down to organisational needs, size, and resources. Enterprise-level businesses with larger budgets and established IT infrastructures may benefit from in-house teams, provided they can recruit and retain the necessary talent.
For other organisations, outsourcing provides a cost-effective, scalable, and reliable way to ensure comprehensive cyber protection.
Outsourcing allows organisations to:
- Access top-tier cyber security expertise without the challenges of recruitment and retention.
- Ensure round-the-clock coverage that would otherwise require significant investment in staff and resources.
- Scale protection to meet evolving threats, leveraging advanced tools and technologies provided by managed service providers.
CyberLab Control Services
Simple, secure, reliable managed security services designed to protect your organisation. Get help when you need it most and improve your cyber security posture.
We provide that extra layer to supplement your existing operation and complement vendor support, an easy way to outsource and address the complex, specialised issues. Select the level of service to suit your needs and budget. Our experts, contactable by both phone and email, can detect the problem, protect your organisation, and support your team.
7.3% average compromise rate with Phishing Simulator
Source: HackRisk, 2025
The Financial Cost
As of 2024, the average cost for each data breach in the United Kingdom was £4.4 million, with the annual predicted cost of overall cyber crime in the UK for 2025 soaring to £524 billion.
Data breaches can result in hefty fines from regulatory bodies such as the Information Commissioner’s Office (ICO) and these fines can reach up to £17.5 million or 4% of your annual turnover, whichever is higher.
Beyond fines, organisations face escalating costs for investigation, remediation, and rebuilding their IT infrastructure. Add to this the growing expense of cyber insurance premiums, and it becomes clear how financially draining an incident can be.
The Reputational Cost
The costs of a cyber incident extend beyond immediate financial losses. Long-term brand damage is another critical consideration. According to the Cisco 2022 Consumer Privacy Survey, 76% of consumers stated they would not purchase from a company they do not trust with their data.
The erosion of trust not only results in lost customers but can also damage relationships with business partners and stakeholders. Rebuilding this trust and regaining market confidence can take years, costing your organisation not just money but growth opportunities.
Cyber Insurance Explained
Cyber risk is an evolving threat that requires proactive management, and this episode explores the complexities of cyber insurance, how it protects organisations, and the costs associated with cyber incidents.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
Your Cyber Security Questions Answered: Questions Every Business & IT Leader Asks
Top Questions Every Business & IT Leader Asks
Security is now a core business risk, not just an IT concern.
Cloud adoption, hybrid work and a fast‑moving threat landscape mean leaders need simple, practical answers to three recurring questions:
- Has security really changed that much in the past few years?
- Am I using the best‑in‑class security vendors today?
- Do I have the right skills and time in‑house to manage these solutions?
CyberLab addresses each question and outlines a pragmatic way forward.
Has Security Really Changed That Much?
Yes. The perimeter has shifted, and so have attacker methods and business expectations.
- Hybrid work and SaaS sprawl
People, devices and data now operate beyond the office. Access happens from anywhere, often to third‑party applications. Security must follow identity and data, not only networks. - Identity is the new control point
Strong authentication, conditional access and least privilege are now essential. Compromised credentials remain one of the most common root causes of incidents. - Cloud as default
Security needs to be built for cloud platforms and APIs. Posture management, workload protection and secure configuration now sit alongside traditional controls. - Detection, response and resilience
Prevention is vital, but it is not enough on its own. Organisations need visibility, rapid response and tested recovery. Backups, restore testing and incident playbooks are part of core security. - Supply chain and third parties
Vendors, partners and integrators can introduce risk. Contracts, minimum controls and periodic assurance need to be part of the operating model.
The model to aim for is identity‑first, least privilege, assume breach, with layered controls that prevent, detect, respond and recover.
Are We Using Best‑In‑Class Security Vendors Today?
“Best” depends on outcomes, integration and operational fit, not just features. Many estates grew into a patchwork of point products. Consolidation around fewer, well‑integrated platforms often improves security and reduces effort.
What good looks like in a modern stack
- Identity and access
Enterprise identity provider, phishing‑resistant MFA, conditional access, privileged access management, lifecycle governance. - Endpoint and server security
EDR or XDR with behaviour‑based detection, central policy, and response tooling. Coverage for Windows, macOS, Linux and mobile. - Email, web and DNS security
Advanced phishing protection, attachment sandboxing, impersonation and brand spoofing controls, safe link handling and DNS filtering. - Cloud and SaaS posture
Cloud security posture management for IaaS and PaaS, and configuration governance for SaaS. Guardrails and continuous checks. - Network security
Secure web gateway, ZTNA for private apps, and segmentation. Where appropriate, an SSE or SASE approach to apply consistent policy from anywhere. - Data protection and backup
Classification, DLP, encryption and secure, isolated backups with regular restore tests. - Vulnerability and patch management
Accurate asset inventory, regular scanning, prioritised remediation and clear service levels. - Logging and monitoring
Centralised log collection, correlation, detection content mapped to common frameworks, and alert triage.
Selection principles that help
- Prioritise integration and coverage over feature checklists.
- Favour open standards and proven interoperability.
- Demand outcome measures, not only demos.
- Consider operational cost. The best tool is one the team can run well.
Common anti‑patterns to avoid
- Buying duplicate tools that overlap.
- Deploying without hardening defaults.
- Ignoring decommissioning, leaving legacy exposure.
- Running security in silos that do not share telemetry or policy.
Do We Have The Right Skills And Time In‑House?
Many incidents are caused by misconfiguration rather than missing tools. Operating security well is a discipline that combines people, process and technology.
Operate to a plan, not heroics
- Define standards and baselines for identity, endpoint, cloud and data.
- Use automation for onboarding, patching, certificate and key management.
- Maintain runbooks and playbooks for detection and response.
- Track metrics such as mean time to detect and recover, patch compliance and simulation results.
When to consider managed services
- You need 24×7 detection and response but cannot staff it continuously.
- You want co‑managed operations, where a partner handles monitoring and escalation while your team owns design decisions.
- You have gaps in specialist skills such as cloud security engineering, incident response or penetration testing.
Roles and responsibilities that matter
- Risk owner to align controls with business priorities.
- Security engineering to design and harden platforms.
- Operations for monitoring, patching and access governance.
- Incident response with clear authority to act.
Building an In-House Security Team vs Outsourced Security Support
A Practical 90‑Day Action Plan
- Baseline your posture
Inventory identities, devices, critical apps, internet‑facing assets and third parties. - Close the high‑impact gaps
Enforce MFA everywhere feasible. Disable legacy protocols. Review and tighten privileged access. - Harden endpoints
Deploy EDR or XDR to all supported devices. Remove unsupported operating systems where possible. - Improve email defences
Enable advanced phishing controls. Publish and monitor SPF, DKIM and DMARC with alignment. - Patch with purpose
Implement a clear patch cadence and fast‑track critical updates for internet‑facing systems. - Secure backups and test restores
Maintain immutable or isolated copies. Prove you can restore key services within business‑agreed times. - Scan for vulnerabilities
Run internal and external scans. Prioritise based on exploitability and business impact. - Strengthen cloud configuration
Apply baseline policies, guardrails and automated checks in cloud platforms and key SaaS. - Train and test people
Short, regular awareness modules and varied phishing simulations with friendly feedback and easy reporting. - Prepare to respond
Document playbooks, define roles and run a tabletop exercise for a realistic scenario such as business email compromise.
How CyberLab Helps
CyberLab supports organisations with a practical, outcome‑focused approach:
- Posture assessments and roadmaps aligned to recognised frameworks.
- Testing and assurance including vulnerability assessments and penetration tests by accredited specialists.
- Managed detection and response with actionable reporting and co‑managed models.
- Identity, email and endpoint hardening to raise the baseline quickly.
- Awareness and simulation programmes that build positive security culture.
- Certification support for standards such as Cyber Essentials and similar schemes.
If your organisation would like a clear view of current risk and a right‑sized plan to improve, we are available for an initial discussion to align goals, constraints and next steps.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
The True Cost of a Cyber Incident and How It Impacts Your Business
Security Lessons from M&S, Co-op, and Jaguar Land Rover
Data breaches remain one of the most expensive risks organisations face today. IBM’s latest Cost of a Data Breach Report reveals that the global average cost has reached $4.44 million. Though, for the first time in five years, that figure is trending downward thanks to faster containment driven by AI-powered defences.
Closer to home, the United Kingdom sits near the global average, with the typical breach costing £3.29 million (around $4.14 million).
These numbers are more than statistics. They highlight why robust security strategies, rapid response capabilities, and investment in advanced technologies are essential.
In this edition, we explore the trends shaping cyber security and what they mean for your organisation. One thing is clear: the cost of inaction is far greater than the cost of prevention.
The High Price of Disruption: Recent UK Case Studies
Jaguar Land Rover: The Most Expensive Cyber Attack in UK History
In late August, Jaguar Land Rover (JLR) suffered a crippling cyber attack that forced a month-long shutdown of its internal systems and production lines. The estimated cost? At least £1.9 billion ($2.5 billion), making it the most economically damaging cyber event ever recorded in the UK.
The attack halted production at multiple sites, affected over 5,000 organisations in the supply chain, and required a £1.5 billion government loan guarantee to stabilise operations.
JLR’s wholesale deliveries dropped nearly 25% year-on-year, and the full recovery is not expected until early 2026. Analysts estimate JLR was losing around £50 million per week during the shutdown. (source: BBC)
Marks & Spencer and Co-op: Retailers Under Siege
Earlier this year, Marks & Spencer (M&S) and Co-op were hit by cyber-attacks that, while less costly than JLR’s, still resulted in staggering losses. The M&S breach, which shut down online services for two months, is estimated to have cost the retailer £300 million. (source: Sky News)
The attack exploited social engineering tactics, manipulating IT helpdesk staff into resetting passwords and bypassing security controls. Co-op and Harrods also suffered significant incidents, with the combined financial impact of the retail sector attacks estimated between £270 million and £440 million. (source: msn.com)
Why Are the Costs So High?
Operational Downtime: For JLR, every day of halted production meant lost vehicle sales, supply chain disruption, and financial strain on thousands of partner businesses.
Supply Chain Ripple Effects: The JLR attack affected over 5,000 organisations, with some suppliers facing collapse due to delayed or cancelled orders.
Reputational Damage: Retailers like M&S faced public scrutiny, parliamentary investigations, and the need to sever long-standing IT partnerships in the wake of the breach.
Regulatory and Legal Costs: UK GDPR and Data Protection Act violations can result in fines up to £17.6 million or 4% of global turnover, not to mention the cost of remediation and customer notification.
Lessons Learned: What These Incidents Teach Us
Cyber Security is Economic Security
As highlighted by the National Cyber Security Centre (NCSC), the scale of these incidents means that cyber resilience is now a matter of national economic security, not just IT hygiene. With 4 major incidents being reported per day in the UK, and a 50% increase from last year in ‘nationally significant’ attacks, UK businesses that fail to prepare for such events risk putting serious strain on the nation’s economy and increase our collective exposure to such events. (source: NCSC)
“Improving cyber resilience is a shared responsibility. Government, businesses, and service providers each have a role to play.”
– Gavin Wood, CEO
Attackers Exploit the Basics
Many breaches still begin with social engineering, weak access controls, or poor digital hygiene. This serves as a reminder that foundational security practices remain critical.
Preparation and Response Matter
The ability to rapidly detect, contain, and recover from incidents can dramatically reduce costs. Incident response retainers and robust playbooks are essential investments.
Best Practices for Mitigating the Cost of a Breach
No organisation is immune to cyber incidents or data breaches. Experiencing one is a matter of when, not if. While absolute, around-the-clock security appears unattainable in a constantly evolving threat landscape, adopting proven best practices can make a significant difference. By implementing these steps below businesses and organisations can greatly reduce the impact and financial burden of inevitable cyber events:
Invest in Resilience
Regularly review and test incident response plans. Ensure board-level oversight of cyber risk.
Implement Multi-Factor Authentication (MFA)
Require MFA or two-factor authentication (2FA) for all users, especially for accessing sensitive systems, to provide a crucial layer of security beyond the password.
Supply Chain Security
Assess and support the cyber resilience of key suppliers. Proactively manage your third-party risk, monitor vendor posture, and strengthen your supply chain security with HackRisk’s Supply Chain Security tools.
Cyber Insurance
While insurance can offset some costs, most policies only cover a portion of total losses. Understand your coverage and its limitations.
Continuous Dark Web Monitoring
Employ tools or services such as HackRisk AI to monitor for compromised credentials on the dark web, allowing for swift response if employee or organisational data is found in breach dumps.
Comprehensive Staff Training
Deliver regular cyber security awareness training for all employees, with a focus on recognising phishing attempts, the importance of password hygiene, and how to respond to suspicious activity.
Ongoing Policy Review and Enforcement
Routinely review and update password and authentication policies to adapt to emerging threats and ensure enforcement with automated checks wherever possible.
Final Thoughts: Reducing Risk
The financial consequences of a cyber incident can be devastating and, in some cases, fatal for organisations, as demonstrated by the experiences of companies such as JLR, M&S, and Co-op. These cases underscore how quickly costs can escalate, cascading far beyond initial estimates and affecting multiple facets of a business.
Given the severity of potential losses, it is essential for organisations to recognise cyber security as an integral business risk in order to preserve not just brand and reputation but ultimately business survival.
Treating cyber security with the same level of attention as other core business risks ensures that appropriate resources are allocated to mitigation and preparedness, potentially reducing the harm caused by cyber incidents and also the penalties or fines that may be imposed.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.