InfoSec / Cyber

Be cyber aware in orange text on a blue background above a blue mobile phone, blue key store, blue key and a blue shield with a green tick inside it.

: Tammy Buchanan; Information/Cyber Security; 03 November 2023

Top Ten Cyber Security Misconfigurations

The NSA and CISA Red and Blue teams recently shared the top ten cyber security misconfigurations. The schools we have worked with that have suffered a cyber attack often find that there are configurations, upgrades or user access controls that were missed. This advisory highlights all of those and more - these are not in-depth configurations, but often ones that are set up incorrectly and then not checked or updated as time goes by. Although the advisory is aimed at larger organisations, we think it applied to all and will help towards becoming more cyber resilient.

: Tammy Buchanan; Information/Cyber Security; 01 November 2023

ICO Reprimand: company suffered a ransomware attack

Recently the ICO reprimanded a company that suffered a ransomware attack. The attack resulted in a data breach - learning lessons from real-life incidents is a valuable way to promote knowledge sharing and improve.

Childrens hands showing their palms each with a letter from the word 'Safety'. Blue text: "Online Safety Act Becomes Law"

: Tammy Buchanan; Information/Cyber Security; 30 October 2023

The UK Online Safety Bill becomes an Act (Law)

The UK Online Safety Bill became law on Thursday 26th October. The UK Government says the Online Safety Act will protect people, particularly children, on the internet. The Act should make social media companies keep the internet safe for children and give adults more choice over what they see online. Ofcom will immediately begin work on tackling illegal content and protecting children's safety.

Be cyber aware in blue text on blue mobile phone with key

: Tammy Buchanan; Information/Cyber Security; 29 September 2023

The importance of software updates (PaperCut vulnerability and Rhysida ransomware)

We previously reported on some schools that had sufferred ransomware attacks, namely Thomas Hardye in Dorset. It has since been discovered the attack was by the hacker group that goes by the name "Rhysida".
The attack methodology used was by exploiting a known vulnerability in PaperCut. Other schools have reportedly suffered the same attack from the group.

Be Cyber aware in orange text on a blue background. Blue mobile phone, a blue shield and blue key and lock

: Tammy Buchanan; Information/Cyber Security; 22 September 2023

Ransomware, extortion and the cyber crime ecosystem

As we have seen an increase in the number of cyber attacks on schools we wanted to highlight a white paper that has been produced by the National Cyber Security Centre (NCSC), part of GCHQ and the National Crime Agencey (NCA). The UK is currently a high value target for cyber criminals, not just in terms of business but against the UK citizens as well.

Cyber in blue text, resilience in orange text on a comnputer screen with all things cyber related around

: Tammy Buchanan; Information/Cyber Security; 08 September 2023

Cyber Resource: The Cyber Resilience Centre Group

We wanted to highlight an organisation called the National Cyber Resilience Centre Group which consists of nine regional centres in the UK that were set up to strenghten the reach of cyber resilience across the business community.

A coalitiion of police, government, large employers and organisations and academia are supporting the growth of the Cyber Resilience Centre Network.

: Tammy Buchanan; Information/Cyber Security; 04 September 2023

Email and Security: ICO recent guidance

The ICO has recently published new guidance about bulk email communications following a number of data breaches caused by the incorrect usage of CC and BCC (carbon copy and blind carbon copy).

Emails sent to the wrong person or emails copied rather than blind copied to customers/parents are the most common data breaches seen and are often because someone is rushing or under pressure.

Cyber attack in red text on a computer screen with blue text

: Tammy Buchanan; Information/Cyber Security; 09 August 2023

What to do in the event of a Cyber Attack

We've produced a document to provide help and guidance in the event of a cyber attack. The document is part of our Information and Cyber Security Best Practice Area and covers:

This document gives a list of who to contact and what to do just after a cyber attack. It covers:

Robot pointing their finger on a computer screen in blue

: Tammy Buchanan; Information/Cyber Security; 17 July 2023

Cyber Crime: AI Generated Phishing Attacks

For those outside the computing world, it feels as though AI (Artificial Intelligence) has suddenly appeared and having a huge impact on the rest of the world. Artificial intelligence is intelligence demonstrated by computers, as opposed to human or animal intelligence. 'Intelligence' encompasses the ability to learn to reason, to generalise and to infer meaning.

Cyber attack in red text on a computer screen

: Tammy Buchanan; Information/Cyber Security; 04 July 2023

Cyber Attack: Exam Boards

Surrey Police are investigating a fraud and computer misuse allegation at AQA, England's largest exam board which follows the recent data breach reported by Cambridgeshire Policy into a data breach with the exam boards at OCR and Pearson. Full article: AQA also hit by exam paper cyber attack.

: James England; Information/Cyber Security; 03 July 2023

VICE SOCIETY - Ransomware attacks on schools

This article was originally published in January 2023, but has been updated with some additional information, following further ransomware attacks on schools in the UK. Highly confidential documents from 14 schools in the UK have been leaked online by hackers. The Vice Society has been behind a high-profile string of attacks on schools across the UK and the USA in recent months.

: Tammy Buchanan; Information/Cyber Security; 26 June 2023

Be Cyber Aware: USB Sticks

This article is one in a series of articles about raising cyber awareness in an organisation. We visit a number of organisations through our data walks and often discuss the use of USB sticks with staff and are told that they are not allowed. Yet we will see them in use during the walk. A verbal/written policy is not the same as prevention and detection. This article will discuss methods for detection and why.

Search