MC Infographic_UPDATED_09_02_2023

At our recent Cyber Resilience event, we emphasised the famous boxing quote, “everyone has a plan until you are punched in the face,” highlighting the importance of readiness in dealing with cyber incidents.

In the same way athletes train and prepare for major sporting events, organisations need to be ready for their own “big event” in the form of a cyber incident. Achieving true cyber resilience requires a cohesive team and strategy to tackle the challenges posed by skilled adversaries, going beyond the notion of “letting IT deal with it.” This involves being prepared for the technical, organisational, and psychological aspects of incidents like ransomware attacks or data theft.

With the increasing reliance on technology, cyber-attacks have become all too common in today’s world, making it crucial for organisations to assess the impact of such incidents and determine how to contain the threat and expel the intruder from their networks. To ensure effective response capabilities, organisations must invest in resources and skills. This involves creating a comprehensive recovery plan based on best practices, employing the right personnel, and establishing fail-safe processes that can function even when key participants are unavailable. It’s important to understand that cyber resilience is not solely reliant on technological solutions – it requires a holistic approach encompassing people, processes, and technology.

However, being prepared is just the first step. To validate the effectiveness of your cyber resilience strategy, it is vital to have an intimate understanding of your business, its critical components, and how to restore them in the aftermath of an attack. To achieve this level of understanding, it is recommended to regularly and rigorously test your recovery plan. This testing helps to identify any gaps in the plan and ensure a smoother recovery process.

One highly effective method for enhancing the necessary skills and capabilities to achieve resilience is by conducting a cyber tabletop exercise. A cyber tabletop exercise is a simulated scenario that enables organisations to test and evaluate their preparedness and response capabilities in the event of a cyber incident or breach. It serves as a training tool for key stakeholders involved in managing and responding to cybersecurity incidents, including IT staff, executives, legal teams, and public relations representatives. The exercise takes place in a conference room or virtual environment and is based on realistic threats or previous incidents to provide a relevant and meaningful experience for the participating organisation.

During the exercise, participants assume specific roles and responsibilities, such as incident responders, incident commanders, legal advisors or media relations representatives. They are presented with a simulated event that unfolds gradually, and they must collaborate, make decisions, and take appropriate actions to respond to the evolving situation and adapt to new challenges that arise in a fast-moving environment.

The tabletop exercise serves several purposes:

1. Testing response plans: By simulating real-world scenarios, organisations can identify gaps, weaknesses, and areas for improvement in their response strategies.
2. Enhancing communication and coordination: The exercise promotes communication and coordination among different teams and stakeholders involved in incident response. It enables participants to understand each other’s roles, responsibilities, and decision-making processes, fostering better collaboration and coordination during a real incident.
3. Identifying strengths and weaknesses: Through the exercise, organisations can identify their strengths, areas of expertise, vulnerabilities, and limitations in their incident response capabilities. This knowledge allows them to prioritise investments in training, external resources, and improvements to enhance their overall cybersecurity posture.
4. Practicing decision-making: The exercise provides a safe environment for participants to practice making critical decisions under pressure. They can explore different response strategies, evaluate the potential consequences of their actions, and learn from their mistakes without real-world repercussions. It is better to fail during the exercise than in a real incident.
5. Building familiarity with procedures: Tabletop exercises help participants become familiar with the incident response procedures, protocols, and tools that would be utilised during an actual cyber incident. This familiarity improves efficiency and effectiveness during a real incident, as responders are better prepared and more confident in their actions. It also helps external resources understand the organisation’s procedures and be better prepared to assist in an incident. This process strengthens the organisation’s cybersecurity posture and preparedness to handle real-world cyber threats.

Being aware of the latest cyber threats is a fundamental aspect of a good cyber resilience strategy. Understanding these threats enables organisations to better predict, detect, and respond to them. Conducting a tabletop exercise to test the ability to respond is critical for maintaining a high standard of cyber hygiene and informing the cybersecurity strategy.

A mature cybersecurity strategy that encompasses all aspects of threat identification, impact mitigation, and service recovery is essential. The current landscape in most organisations is characterised by technical dependency, and the rise of hybrid working models has blurred the boundaries of an organisation’s perimeter, making it harder to secure. The days of heavily investing in preventive security measures with the aim of blocking threat actors are no longer sufficient.

A paradigm shift is occurring in cybersecurity, with organisations embracing strategies such as “zero trust” that prioritise resiliency in the face of inevitable incidents. This shift necessitates partnering with strong cybersecurity providers who have the necessary technologies and knowledge to prevent or mitigate incidents while also understanding the organisation’s business context.

Ultimately, cyber resilience must be an integral aspect of a contemporary business strategy. With the increasing threats and sophistication of cyber-attacks, understanding your business’s assets, how technology supports business objectives, managing technology risk, focusing on recovery, and staying abreast of the latest threats are non-negotiable aspects.

Furthermore, it is essential to remember that a cyber resilience strategy is only as strong as its weakest link. Regular testing and investment in resources are paramount to ensure that your organisation remains strong in the face of cyber threats.

Every day, there are 65,000 attempts to hack SMEs and among these, phishing attacks has emerged as the predominant method employed by malicious actors to illicitly obtain data, information, or funds.

 Understanding Phishing

Phishing refers to deceptive tactics where perpetrators employ various platforms (such as emails, mobile messages, social media, phone calls, and texts) to mislead individuals into performing certain actions. These actions could be as simple as clicking a link, but they can lead to significant security breaches, allowing the attacker unauthorised access, theft of data, or even holding a company at ransom.

 Strategies to Enhance Cybersecurity

To bolster defences against such intrusions, businesses can adopt several proactive measures:

1. Training: Engage in continuous staff training and security awareness programs. This can be done in-house or via trusted IT partners, with the inclusion of regular simulated phishing tests.
2. Anti-Virus Software: Ensure the use of reliable and frequently updated Anti-Virus solutions.
3. Firewalls: Deploy both Desktop and Network Firewalls that are expertly set up and maintained.
4. Browser Security: Always update browsers to incorporate the latest security patches, sealing any potential vulnerabilities.
5. Pop-Ups: Always scrutinise pop-ups, even those that appear genuine.
6. Site Security: Before interacting with a site, confirm its security credentials.
7. Personal Information: Limit the amount of personal data shared online.
8. Passwords: Adhere to robust password protocols, emphasising complexity and using combinations of random words.
9. MFA (Multi-Factor Authentication): This should be a fundamental security provision.
10. Think Before Clicking: If a message urges immediate action, pause and reflect. Feeling rushed often indicates potential deceit.

Remember, human error is inevitable. While these strategies offer substantial protection, it’s crucial to anticipate potential breaches. Thus, having a predefined response plan is indispensable. This ensures that in the event of a breach, appropriate actions are executed promptly, minimising further risks and disruptions.

To find out more about ways you can assess your vulnerabilities and improve your cyber security readiness email info@osgroup.co.uk 

In today’s age of digital transformation, cyber security threats have become a major concern for businesses. With an alarming number of cyber-attacks and data breaches, many companies have been turning to cyber insurance to protect themselves financially in the event of an attack. However, whilst cyber insurance can help businesses get back on their feet should a cyber-attack occur, it will not solve any security concerns a business may have nor prevent a data breach. And, as always with insurance of any kind, the question is whether it will pay out at all?

The cost of cyber insurance can vary depending on the size and type of business, as well as the level of coverage. But it can be a big investment, particularly for larger companies. Before investing in cyber insurance, it is worth taking time to figure out what financial impact a cyber-attack could have on your business and how you would be covered with your insurance. Some insurance policies do not cover some common cyber-attack incidents such as money lost through business email compromise fraud or a new type of cyber-attack that does not already exist on your insurance. Insurance companies are also putting in place a very high bar – some would say impossibly high – to meet the requirements of cyber insurance. Indeed, we are seeing more and more examples of insurance companies failing to pay out in the instance of cyber-attack on the basis that the customer hadn’t met some of the (often obscure) requirements.

Cyber insurance does have a role to play. But our advice is that rather than relying solely on cyber insurance, businesses should of course put in place a comprehensive cyber security strategy and continue to invest in it to protect themselves from attack as best they can in the first place.

Having certified cyber security in place not only helps to prevent cyber-attacks but reassures customers that you are working to secure your IT against this and could attract new business with the promise of having this in place. This would ideally include both preventative measures and incident response plans. It is important to invest in cyber security infrastructure such as firewalls, intrusion detection systems and incident response software. Immutable back-ups are also key to storing data and mitigating against ransomware attacks as once saved, data cannot be changed, overwritten or deleted.  A company should carry out several cyber security protocols which could include reviewing email security, setting up a multi – factor authentication, protecting virtual meetings and creating a private cloud management software. In some instances, organisations working in sensitive areas will invest in the services of a SOC (security operations centre) to monitor their IT on an ongoing basis to pick up any potential attacks at a very early stage.

Hackers also rely on human error and if a company has not brought their employees up to speed on cyber security, it is only a matter of time before they regret this decision. Investing in training and education for employees on how to identify and prevent cyber-attacks is crucial. With the rise of remote and hybrid working of course providing an increased risk of data-breach, cyber security training for employees has become more important than ever.

There is no doubt about it, cyber attackers will continue proliferating the digital world. Attacks will become more frequent and more sophisticated. Whilst cyber insurance can provide some level of financial protection for businesses, it should not be viewed as a substitute for investing in robust cyber security measures including cyber security infrastructure, employee education and incident response plans. By investing in robust cyber security measures, businesses can not only reduce their risk of a cyber incident but also save money long-term by avoiding costly incidents in the first place.

Avoiding rather than just insuring is the way to beat the hackers – The Irish News

In today’s digital age, businesses heavily rely on their IT systems to carry business as usual operations. From customer data to financial records, we all store and rely on vast amounts of critical information and systems that must be protected at all costs. However, disasters and unforeseen events can and do happen, potentially causing significant disruptions to your IT infrastructure and consequently your BAU operations.

An IT DR plan is a comprehensive strategy that outlines how you will respond and recover from a wide range of IT-related disasters, including natural disasters, cyberattacks, hardware failures, or human errors. Let’s delve into the importance of having an IT DR plan:

1. Minimising Downtime: Time is money, and prolonged IT system downtime can result in significant financial losses.  A DR plan helps minimize downtime by providing a roadmap for recovery. By outlining the necessary steps and procedures, businesses can restore their IT systems efficiently, reducing the impact on operations and enabling a faster return to BAU.
2. Protecting Business Continuity: Disruptions to IT systems can halt critical business processes, jeopardising productivity, customer service and reputation, and revenue generation. Having a plan ensures that essential operations can continue, even in the face of, and during, a disaster. By having resilient infrastructure, data redundancy, and backup internet connections, businesses can maintain continuity and provide uninterrupted services to its customers.
3. Safeguarding Data: Data is the lifeblood of modern businesses, and its loss or compromise can have severe consequences.  Effective DR plans includes data backup and recovery strategies that protect valuable information from permanent loss. Regular backups and secure offsite storage ensure that data can be recovered and restored, minimizing the impact of a disaster on crucial business assets.
4. Enhancing Security: Cybersecurity threats continue to evolve, posing significant risks to businesses. It’s critical to ensure that any DR plan incorporates security measures and protocols that address potential vulnerabilities and mitigate the impact of cyberattacks. By proactively planning for such events, you can minimize the damage, protect sensitive data, and enhance your overall security posture.
5. Meeting Regulatory Compliance: Depending on the industry, businesses may be subject to various regulatory requirements regarding data protection and business continuity. Having a DR plan ensures compliance and potentially mitigates penalties or legal repercussions that could otherwise arise.

In answer to the opening question, then YES.  It absolutely does.   An IT DR plan is an essential component of modern business operations. It provides a structured approach to navigate through disasters and recover from IT-related disruptions efficiently by effectively managing IT-related risks and giving your business the best chances for long-term success.

There are three kinds of organisations in the world;

• Those who have been hacked,
• Those that are next in line or, worst of all,
• Those that don’t know they’ve already been hacked.

“Why would someone want to hack my business ?” is probably the most common mistake most businesses make. But hackers don’t discriminate – ALL businesses are targets and subject to ransomware and other cyber attacks.

When your staff navigate through the digital world they leave digital breadcrumbs. Every time they register at a website or sign up for an event, they use a username and password.

Cybercriminals are constantly, and successfully, attacking these websites and other user input points to harvest this login information which becomes the first piece in a larger, more elaborate digital jigsaw, which they piece together to create a profile and your business becomes the target.

RECOMMENDED BEST PRACTICE
The National Institute of Standards and Technology (NIST) produced its Cybersecurity framework (CSF), that sets out 5 best practice functions.

IDENTIFY: Know what you have, where you have it and the value of every single resource individually plus the value all resources combined.

PROTECT: Develop and implement appropriate safeguards to ensure critical infrastructure service delivery and proactively support your ability to limit or contain the impact of a potential cybersecurity event.

DETECT: The faster a cyber event is detected, the faster the repercussions can be mitigated. The early discovery of cybersecurity events is a critical step to a robust cyber program.

RESPOND: Develop appropriate techniques and actions to take when a cybersecurity incident has been detected. The faster and more effectively you respond to a possible detection of a cyber incident, the faster you can stop the threat in its tracks or mitigate its damage and reduce any potential financial impact.

RECOVER: Maintain appropriate plans that can be implemented to restore any impaired capabilities or disrupted services due to a cybersecurity event. Timely recovery to normal operations reduces the impact of a cybersecurity event.

Outsource and OSG Cloud both partner with the word’s leading backup and recovery technology solution providers and as NI’s only Veeam Gold Partner, Cloud and Service Provider, are best placed to support your business in ensuring you are best placed to deal with an attack and to recover after one.

We can help review your current security posture and build and implement comprehensive and robust cybersecurity program that guarantees the security and protection of your digital estate.

Don’t wait until after an event, take some pro-active steps today and make CYBER-SECURITY a priority for your business.

Get in touch for more information: info@osgroup.co.uk

#cybersecurity #security #informationsecurity #cloudsecurity

At our recent Cyber Resilience event, we emphasised the famous boxing quote, “everyone has a plan until you are punched in the face,” highlighting the importance of readiness in dealing with cyber incidents.

In the same way athletes train and prepare for major sporting events, organisations need to be ready for their own “big event” in the form of a cyber incident. Achieving true cyber resilience requires a cohesive team and strategy to tackle the challenges posed by skilled adversaries, going beyond the notion of “letting IT deal with it.” This involves being prepared for the technical, organisational, and psychological aspects of incidents like ransomware attacks or data theft.

With the increasing reliance on technology, cyber-attacks have become all too common in today’s world, making it crucial for organisations to assess the impact of such incidents and determine how to contain the threat and expel the intruder from their networks. To ensure effective response capabilities, organisations must invest in resources and skills. This involves creating a comprehensive recovery plan based on best practices, employing the right personnel, and establishing fail-safe processes that can function even when key participants are unavailable. It’s important to understand that cyber resilience is not solely reliant on technological solutions – it requires a holistic approach encompassing people, processes, and technology.

However, being prepared is just the first step. To validate the effectiveness of your cyber resilience strategy, it is vital to have an intimate understanding of your business, its critical components, and how to restore them in the aftermath of an attack. To achieve this level of understanding, it is recommended to regularly and rigorously test your recovery plan. This testing helps to identify any gaps in the plan and ensure a smoother recovery process.

One highly effective method for enhancing the necessary skills and capabilities to achieve resilience is by conducting a cyber tabletop exercise. A cyber tabletop exercise is a simulated scenario that enables organisations to test and evaluate their preparedness and response capabilities in the event of a cyber incident or breach. It serves as a training tool for key stakeholders involved in managing and responding to cybersecurity incidents, including IT staff, executives, legal teams, and public relations representatives. The exercise takes place in a conference room or virtual environment and is based on realistic threats or previous incidents to provide a relevant and meaningful experience for the participating organisation.

During the exercise, participants assume specific roles and responsibilities, such as incident responders, incident commanders, legal advisors or media relations representatives. They are presented with a simulated event that unfolds gradually, and they must collaborate, make decisions, and take appropriate actions to respond to the evolving situation and adapt to new challenges that arise in a fast-moving environment.

The tabletop exercise serves several purposes:

1. Testing response plans: By simulating real-world scenarios, organisations can identify gaps, weaknesses, and areas for improvement in their response strategies.
2. Enhancing communication and coordination: The exercise promotes communication and coordination among different teams and stakeholders involved in incident response. It enables participants to understand each other’s roles, responsibilities, and decision-making processes, fostering better collaboration and coordination during a real incident.
3. Identifying strengths and weaknesses: Through the exercise, organisations can identify their strengths, areas of expertise, vulnerabilities, and limitations in their incident response capabilities. This knowledge allows them to prioritise investments in training, external resources, and improvements to enhance their overall cybersecurity posture.
4. Practicing decision-making: The exercise provides a safe environment for participants to practice making critical decisions under pressure. They can explore different response strategies, evaluate the potential consequences of their actions, and learn from their mistakes without real-world repercussions. It is better to fail during the exercise than in a real incident.
5. Building familiarity with procedures: Tabletop exercises help participants become familiar with the incident response procedures, protocols, and tools that would be utilised during an actual cyber incident. This familiarity improves efficiency and effectiveness during a real incident, as responders are better prepared and more confident in their actions. It also helps external resources understand the organisation’s procedures and be better prepared to assist in an incident. This process strengthens the organisation’s cybersecurity posture and preparedness to handle real-world cyber threats.

Being aware of the latest cyber threats is a fundamental aspect of a good cyber resilience strategy. Understanding these threats enables organisations to better predict, detect, and respond to them. Conducting a tabletop exercise to test the ability to respond is critical for maintaining a high standard of cyber hygiene and informing the cybersecurity strategy.

A mature cybersecurity strategy that encompasses all aspects of threat identification, impact mitigation, and service recovery is essential. The current landscape in most organisations is characterised by technical dependency, and the rise of hybrid working models has blurred the boundaries of an organisation’s perimeter, making it harder to secure. The days of heavily investing in preventive security measures with the aim of blocking threat actors are no longer sufficient.

A paradigm shift is occurring in cybersecurity, with organisations embracing strategies such as “zero trust” that prioritise resiliency in the face of inevitable incidents. This shift necessitates partnering with strong cybersecurity providers who have the necessary technologies and knowledge to prevent or mitigate incidents while also understanding the organisation’s business context.

Ultimately, cyber resilience must be an integral aspect of a contemporary business strategy. With the increasing threats and sophistication of cyber-attacks, understanding your business’s assets, how technology supports business objectives, managing technology risk, focusing on recovery, and staying abreast of the latest threats are non-negotiable aspects.

Furthermore, it is essential to remember that a cyber resilience strategy is only as strong as its weakest link. Regular testing and investment in resources are paramount to ensure that your organisation remains strong in the face of cyber threats.

Engaging a cloud provider to provide and ensure immutable backups is a significant strategic decision. Not all providers are the same, nor are they universally suitable for every business. There are several considerations that come in to play when evaluating the most appropriate cloud provider and its services should reflect your unique business requirements and closely align to your strategic objectives.

Consider the scalability and flexibility of the service. Your should be able to adapt, evolve and grow your business without any unnecessary disruptions or needing substantial resources to manage and migrate data.

Pay attention to security standards. You want a provider who places a high priority on data security, using strong encryption protocols, and adheres to the highest compliance standards. Remember, with immutable backups, the cloud provider essentially holds the key to your business’s existence.

Review and continually assess and challenge the provider’s reliability and disaster recovery plan. How fast and effective is the recovery process in the event of data loss? Your business continuity depends on this. The cost of downtime can quickly add up, so choosing a cloud provider that can provide a robust and reliable recovery plan is crucial.

Customer support, service level agreements (SLAs) and contractual obligations are essential. A provider with a 24/7 support system and clear, favourable and guaranteed SLAs delivers better return for your investment.

Consider the provider’s reputation. Look for demonstrable track records and customer testimonials to ensure they are trustworthy and reliable.

Remember, choosing a cloud provider isn’t just about finding a place to store your data. It’s about aligning with a partner that supports your business strategy, understands your needs, and offers the right services that’s fit and appropriate to help you grow and succeed.  Carefully evaluating your own requirements and mapping them against the offerings of prospective providers will ensure that you select a partner that provides not just storage, but also long-term value and security for your business.

In essence, the cloud provider you chose for your immutable backups is a fundamental extension of your business. Much more than just a vendor; it’s a strategic partner integral to your overall success. Select wisely, because your business’s future may depend on it.

Outsource Group’s Cloud offering provides comprehensive solutions tailored to meet any requirements for frequency, retention, RPO (Recovery Point Objective), and RTO (Recovery Time Objective), along with the crucial aspect of immutable copies of data guaranteeing the ability to recover. By documenting and contractually committing to your recovery expectations, Outsource Group instils confidence and assurance. This level of business protection becomes even more critical in the current landscape of increasing ransomware and cybersecurity threats.

If you have any concerns or would like to hear more about how Outsource Group can help your business, please get in touch info@osgroup.co.uk

Microsoft has officially announced the end of support for Windows Server 2012 and 2012 R2. While it might feel a little like saying goodbye to an old friend, this necessary evolution is a crucial part of maintaining a healthy, secure, and efficient IT infrastructure.

What Does End of Support Mean?

Microsoft’s product lifecycle typically includes a period of mainstream support, followed by extended support, and then reaches the end of support. During the mainstream phase, users receive free updates, patches, and can access warranty claims. Once a product enters the extended support phase, users can still receive security updates, but other types of updates cease, and warranty claims are no longer available.

Now that Windows Server 2012 and 2012 R2 have reached the end of support, no further security updates, patches, or support assistance will be available from Microsoft. Essentially, you’re on your own.

The Risks of Running Unsupported Software

Running outdated and unsupported software exposes your infrastructure to significant risks, including:

• Security Vulnerabilities: Without ongoing security patches, your system becomes increasingly vulnerable to cyber threats. This could lead to data breaches, ransomware attacks, and other cybercrime that could severely damage your organisation’s reputation and finances.
• Non-compliance: Depending on your industry, running unsupported software might breach regulatory compliance standards, leading to hefty fines and potential legal consequences.
• Software Incompatibility: New applications and software are optimised for the latest operating systems. As a result, you might find that new software won’t run correctly on your outdated server – or won’t run at all.
• Hardware Compatibility Issues: Similarly, as hardware technology advances, older operating systems may not fully support new hardware, leading to inefficiencies or system failures.
• Increased Operational Costs: Unsupported software typically requires more maintenance and troubleshooting, resulting in higher operational costs over time.

Why You Should Upgrade or Migrate

The end of support for Windows Server 2012 and 2012 R2 signifies it’s time for businesses to upgrade or migrate to newer, supported versions such as Windows Server 2016, 2019, or take the leap into the future with Windows Server 2022. Migrating to a newer server OS provides several benefits:

• Enhanced Security: Newer versions have advanced security features that can better protect your business against evolving cyber threats.
• Improved Performance: You’ll enjoy the latest innovations in speed, efficiency, and usability with a new server operating system.
• Better Compatibility: Updated server operating systems are designed to work seamlessly with the latest software and hardware.
• Scalability and Flexibility: Advanced versions offer better options for scalability and hybrid capabilities, including seamless integration with cloud services.
• Extended Support: You’ll have peace of mind knowing that your server OS is backed by ongoing security updates, patches, and support from Microsoft.

In conclusion, while saying goodbye to Windows Server 2012 and 2012 R2, it’s a necessary step to ensure the ongoing security, efficiency, and scalability of your IT infrastructure. The risks of clinging onto unsupported software far outweigh the investment in upgrading or migrating. Embrace the future and enjoy the benefits that the latest server technology has to offer. If you have any concerns, Outsource Group can help support with inventory management, creating an upgrade plan, implementation and ongoing monitoring. Don’t be left behind and together we can help safeguard your business from potential vulnerabilities.

In today’s digital age, harnessing the power of cloud computing is no longer just an option, but a strategic necessity for businesses of all sizes. However, with an overwhelming number of cloud providers available, making the right choice can be a daunting task.

Key factors to consider when selecting the best and most appropriate cloud infrastructure:

1. Reliability and Performance: Ensure that the cloud provider has a proven track record of uptime and can deliver and guarantee the performance your business demands..
2. Security and Compliance: Protecting sensitive data is paramount. Look for providers that offer strong security measures, with external validation around their technical controls and information management systems.
3. Scalability and Flexibility: As your business grows, so will your cloud needs. Select a provider that offers scalability, allowing you to easily expand your resources without disruption. Flexibility is equally important, as it enables you to choose the services and features that align with your unique requirements.
4. Cost-effectiveness: While cost should not be the deciding factor, it is crucial to evaluate the pricing structure and compare it against the value delivered. Consider factors like storage costs, data transfer fees, and pricing models to ensure you are getting the most bang for your buck.
5. Support and Service Level Agreements (SLAs): Look for providers with a responsive support team and robust SLAs. Your cloud provider should be a reliable partner, offering timely assistance, advise and resolutions during any incidents.

Choosing the right cloud provider is a strategic decision that can shape the future of your business. By considering reliability, security, scalability, cost-effectiveness, and support, you can make an informed choice that aligns with your organisation’s unique goals and paves the way for success in the digital era. Remember, the cloud is not just a technology; it’s a catalyst for innovation and growth.

#CloudComputing #DigitalTransformation #BusinessSuccess #protection #security #recovery #backup

The cloud has long been hyped as the future of computing, offering unparalleled flexibility, scalability, and cost savings to businesses of all sizes, with the hyperscalers such as Microsoft Azure, AWS and GCP being the go-to option.

Businesses have recently been reconsidering their cloud strategies, with many opting to move workloads away from the hyperscalers. This trend of cloud repatriation is driven by a variety of factors, including security concerns, rising costs, and a need for greater control over data and infrastructure.

Data Sovereignty: Concerns about where data is being stored and who has access to it. This is particularly true for businesses operating in highly regulated industries where data privacy and security are extremely important. By repatriating workloads, businesses can have complete certainty of where data is stored and who has access to it.

Costs: While hyperscalers offer a range of flexible and consumption-based pricing models, the reality is that the costs of using public clouds can quickly add up, particularly for businesses with large data sets or complex applications. Most businesses have found that the cost savings promised early on by the hyperscalers have not been realised, mainly due to the many hidden and utilisation-based costs that are difficult to understand let alone predict.

Control: Many businesses are also moving away from the hyperscalers because they want greater control over their infrastructure and data. By bringing their workloads to their own infrastructure (physical or virtual), they have complete visibility and control over their IT environment, which can be particularly important for those with complex or unique IT requirements.

Of course, cloud repatriation from hyperscalers is not without its challenges. Moving workloads from a hyperscaler can be a complex and potentially time-consuming process. Additionally, businesses may find that they are dependent on hyperscalers for certain workloads, due to geographic reach or scale, or because they have heavily developed applications using proprietary tools and services, that simply cannot be moved away.

Despite these challenges cloud repatriation is likely to continue to grow in popularity in the coming years, as businesses seek to balance the benefits of the cloud with the need for greater control, security, and cost savings. It’s important to carefully evaluate your cloud strategy and consider a multi-cloud model that best your unique business and needs.

If you have concerns on your cloud journey, where your data is stored and how transparent your cost model is, please get in touch and we can help demystify any challenges your business faces. info@osgroup.co.uk

In today’s age of digital transformation, cyber security threats have become a major concern for businesses. With an alarming number of cyber-attacks and data breaches, many companies have been turning to cyber insurance to protect themselves financially in the event of an attack. However, whilst cyber insurance can help businesses get back on their feet should a cyber-attack occur, it will not solve any security concerns a business may have nor prevent a data breach. And, as always with insurance of any kind, the question is whether it will pay out at all?

The cost of cyber insurance can vary depending on the size and type of business, as well as the level of coverage. But it can be a big investment, particularly for larger companies. Before investing in cyber insurance, it is worth taking time to figure out what financial impact a cyber-attack could have on your business and how you would be covered with your insurance. Some insurance policies do not cover some common cyber-attack incidents such as money lost through business email compromise fraud or a new type of cyber-attack that does not already exist on your insurance. Insurance companies are also putting in place a very high bar – some would say impossibly high – to meet the requirements of cyber insurance. Indeed, we are seeing more and more examples of insurance companies failing to pay out in the instance of cyber-attack on the basis that the customer hadn’t met some of the (often obscure) requirements.

Cyber insurance does have a role to play. But our advice is that rather than relying solely on cyber insurance, businesses should of course put in place a comprehensive cyber security strategy and continue to invest in it to protect themselves from attack as best they can in the first place.

Having certified cyber security in place not only helps to prevent cyber-attacks but reassures customers that you are working to secure your IT against this and could attract new business with the promise of having this in place. This would ideally include both preventative measures and incident response plans. It is important to invest in cyber security infrastructure such as firewalls, intrusion detection systems and incident response software. Immutable back-ups are also key to storing data and mitigating against ransomware attacks as once saved, data cannot be changed, overwritten or deleted.  A company should carry out several cyber security protocols which could include reviewing email security, setting up a multi – factor authentication, protecting virtual meetings and creating a private cloud management software. In some instances, organisations working in sensitive areas will invest in the services of a SOC (security operations centre) to monitor their IT on an ongoing basis to pick up any potential attacks at a very early stage.

Hackers also rely on human error and if a company has not brought their employees up to speed on cyber security, it is only a matter of time before they regret this decision. Investing in training and education for employees on how to identify and prevent cyber-attacks is crucial. With the rise of remote and hybrid working of course providing an increased risk of data-breach, cyber security training for employees has become more important than ever.

There is no doubt about it, cyber attackers will continue proliferating the digital world. Attacks will become more frequent and more sophisticated. Whilst cyber insurance can provide some level of financial protection for businesses, it should not be viewed as a substitute for investing in robust cyber security measures including cyber security infrastructure, employee education and incident response plans. By investing in robust cyber security measures, businesses can not only reduce their risk of a cyber incident but also save money long-term by avoiding costly incidents in the first place.

Avoiding rather than just insuring is the way to beat the hackers – The Irish News

Hear from MD, Eamonn Bunting DipIoD, on his thoughts around investing to prevent a cyber security breach.

Information security and cyber security have long been seen as related but not identical subjects – information security being about protecting information in all its forms and cyber security being about protecting electronic data, with a focus on computers, networks, servers, mobile devices and so on. But such has been the rapid rate of digital transformation in recent times that information security has effectively now been absorbed into cyber security. And the instances of cyber security attacks have risen rapidly and are set to increase further in the years ahead.

By 2025, according to Gartner Inc, 30 percent of critical infrastructure organisations will experience a security breach that will result in the halting of an operations or mission-critical system. Organisations have become far more vulnerable to cyber threats because digital information and technology are now so heavily integrated into day-to-day work. The attacks themselves, which target both information and critical infrastructure, are also becoming far more sophisticated.

The fact that the European Commission recently proposed a cyber defence policy in response to Europe’s “deteriorating security environment” since Russia illegally invaded Ukraine earlier this year, shows how high up the agenda cyber security is. The Commission – citing recent cyber-attacks on energy networks, transportation infrastructure and space assets – called on member states to “significantly increase” investments in cyber security capabilities.

But cyber security can be managed, and the threat lowered. And this could potentially save your organisation millions of pounds.

Technology solutions are just a small part of the picture, and an audit is critical to an effective risk management strategy. It’s something we have significant expertise in through ANSEC AI, which became part of Outsource Group this year, and the highly specialised ANSEC team.

Our approach to cyber in the audit requires us to look at security from two different perspectives. Firstly, as a standards and regulatory driven approach where the baseline is pre-defined, and secondly as an event and risk driven approach where risks are constantly changing and the means of attack evolving.

In the aftermath of a cyber or data related incident, we very often see things that could have been identified and predicted by strong governance and audit programmes. It is therefore important to integrate cyber into any risk management and audit programme. It is also important to align organisational and technical risk.

Following a data related incident, the first question we ask is around the sensitivity of the data processed and stored on the IT applications and network used to deliver services.

According to the Information Commissioners Office (ICO), a key principle of the UK GDPR is that you process personal data securely by means of ‘appropriate technical and organisational measures’ – this is known as the ‘security principle.’

Meeting the security principle requires organisations to consider things like risk analysis, organisational policies, and physical and technical measures. They must also consider additional requirements about the security of processing activities. The ICO states that, “you can consider the state of the art and costs of implementation when deciding what measures to take – but they must be appropriate both to your circumstances and the risk your processing poses.”

The measures must also enable an organisation ‘to restore access and availability to personal data in a timely manner in the event of a physical or technical incident.’ To provide confidence in the ability to do this, ‘organisations also need to ensure that they have appropriate processes in place to test the effectiveness of the measures and undertake any required improvements.’

Identifying what is required involves understanding the link between ‘organisational and technical measures.’ Technology risks should be recorded and aligned with managing the organisational view of risk. This organisational view of control can then be independently reviewed by audit, providing an independent opinion on their operational effectiveness before an adverse event occurs.

And preventing an adverse event is key. The cost of suffering a cyber security breach can be extremely high. IBM Security research suggests that the average total cost of a data breach is almost $4million. But the effects aren’t just direct monetary costs. The impact on reputation, confidence and credibility can also be very costly. Well-managed organisations will invest to stop breaches from happening in the first place and ensure they have a recovery plan to prevent data loss.

Responding to and securing the future By Michael McCann, ANSEC IA 

What is clear is that we are moving to a more integrated digital landscape. The need for cyber security is therefore more important than ever before. And it is something in which everyone must play their part, and with the rate of cyber-attacks on the rise, we all need to be prepared. Ensuring that systems are properly configured and regularly patched is absolutely critical. 

For context, the Cyber Security Breaches Survey 2022 report from UK National Cyber Security Centre (NCSC) results show that in the last 12 months, 39% of UK businesses identified a cyber-attack. The survey also found that enhanced cyber security leads to higher identification of attacks, suggesting that less cyber mature organisations in this space may be underreporting. 

Of the 39% of UK businesses who identified an attack, the most common threat was phishing attempts (83%). Of the 39%, around one in five (21%) identified a more sophisticated attack type such as a denial of service, malware, or ransomware attack. Despite its low prevalence, organisations cited ransomware as a major threat, with 56% of businesses having a policy not to pay ransoms. 

At ANSEC, cyber response is what we do, and we see an ever-increasing sophistication in cyber threats. Organisations must work diligently to stay ahead. As a business, understanding the risk to your organisation is the first step in your defence. Many companies are investing in the latest technologies and solutions in order to improve their own automation. This includes artificial intelligence and machine learning, to better detect, prevent and respond to threats. Solutions such as Extended Detection and Response (XDR) and Security Orchestration Automation and Response (SOAR) are being used to analyse patterns in digital activity and flag potential threats. These automated processes lead to faster response times which have proven invaluable in halting a cyber-attack before it escalates. 

Some larger organisations are investigating the use of tools such as ‘honeypots’  – a virtual trap to lure attackers which means that businesses can study techniques and indicators of compromise to improve security policies and processes. 

So, what can SMEs do? 

Understanding and testing plans across all areas of business  – not just those controlled by IT -continues to be extremely important. In addressing the possible repercussions of security incidents, it is vital to ensure that all business stakeholders understand how to: 

• invoke the plan; 
• utilise the platform on which it will operate; 
• have a clear understanding of the steps needed to support mitigation. 

Simulating common breaches increases corporate cognitive ‘muscle memory’ and sharpens the skills needed to execute response playbooks and runbooks, should a breach occur.  Learnings from such exercises help to improve the security and the posture of any organisation, large or small.   

Many cyber-attacks are successfully launched due to user error. Educating users and leadership boards provides a key foundation in preventing attacks from being able to progress through cyber security best practice, such as:   

• using secure passwords; 
• multi factor authentication; 
• avoiding suspicious links or attachments. 

By investing in the right technologies, anticipating incidents, educating users, and better leveraging existing security assets to defend against attacks, organisations can ensure that they remain secure in the face of the ever-evolving cyber threat landscape. 

A lot of companies are looking at Cyber Insurance, however, the article from ‘Zurich Insurance CEO: Cyber Attacks will be ‘Unisurable’  indicates there is a thought that a cyberattack may be become uninsurable, why is that? Hear from Kevin Lyons, 3rd Line Engineer, at Outsource Group talk about how to mitigate against this and limit your attack surface.

Besides potential loss of data there are days of lost or disrupted productivity investigating, restoring and rebuilding the system.

I have worked with some great people in the cybersecurity field and concluded no system can ever be completely protected; all you can do is make your attack surface as small as possible and put up as many defences as possible and hope that the potential attackers move on or a breach is limited. How do you do this?

1. Limit where company data can be accessed – if a user has three devices it is a bigger attack surface than a user having one device.

2. Think seriously about BYOD – are users accessing data with devices that have at least equivalent security to your company devices?

3. Are all systems as up to date as they can be – how do you patch Microsoft products, well generally through Windows update but what about other applications on your systems?

4. Are you running out of date systems because of out of date applications? – a company’s key system maybe does not run on the latest version of Windows so the older version of Windows is sometimes at the heart of their network potentially exposing every other connected system.

5. Do you have proper segregation in place, do external people come in and connect to your corporate Wi-Fi? – there is no feeling what their device has on it and how it could potentially interact with your systems.

6. Do you setup and review security groups for folders and applications? – if a user does not need access to a share file share/application then them having it increases the attack surface.

7. Last but not least are your users aware of the threat out there? – users sometimes think that IT is there to stop them doing something because they don’t like it; the problem is sometimes the user’s ‘solution’ actually creates a bigger security hole as they don’t understand why access is being restricted. Talk to the users and let them know what you are up against.

If there are any questions then please ask us Outsource Group or ANSEC IA LTD

#cybersecurity #segregation #cyberattack #updates #domain #userexperience #awarenesstraining #byod

Much research has been conducted into the energy efficiency of cloud computing. Most of it was done a few years ago. But it’s even more relevant now, as energy costs for businesses have spiralled to levels that even the gloomiest wouldn’t have predicted.

Microsoft’s efforts, conducted in conjunction with WSP Global Inc, concluded that cloud computing is 93 percent more energy-efficient and has 98 percent lower greenhouse gas emissions than on-premises data centres.

AWS (one of the other ‘Big 3’ public cloud providers) used its billions to deduce through research that businesses can reduce energy use by nearly 80 percent when they run their applications on the cloud instead of operating their own data centres.

In today’s price terms, that’s a very significant monetary saving for a business. Some estimates suggest that businesses in NI are paying vastly more for their energy now than they were in 2020.

The AWS report found that compared to the computing resources of the average European company, cloud servers are roughly three times more energy efficient and that migrating compute workloads to the cloud across Europe could decrease greenhouse gas emissions equal to the footprint of millions of households.

Collaborative research by Berkeley Lab and Northwestern University and funded by Google (the other part of the big tripartite) found that cloud computing can cut energy consumption by 87 percent. The report noted that the saved energy in the US alone could power Los Angeles for a year. The survey affirmed that organisations could save between 60 percent and 85 percent in energy costs when they shift to cloud-based services.

As much as we compete with AWS, Microsoft Azure and Google through our OSG Cloud platform, we agree with their findings about the energy efficiency of cloud.

That’s because modern, purpose-built data centres are designed to run as efficiently as possible. Commercial cloud services can operate more economically than smaller on-premises operations, with large-scale dynamic provisioning and multitenant architecture.

Cloud data centres are also efficient because cloud providers focus on sustainability across their entire operation. In contrast, most businesses don’t prioritise their data centre infrastructure sustainability, because digital infrastructure is not their core business.

Cloud providers focus on efficiency as a best practice. They operate servers at much higher utilisation rates and design facilities to use less energy and water.

This helps reduce overall energy consumption and associated costs, but equally importantly, delivers good corporate responsibility by continuously focusing on improvement to further help reduce carbon footprints and ultimately achieve sustainability. Demand for consolidated electricity by commercial cloud providers creates the potential for large-scale purchases of green energy that would otherwise be unfeasible.

OSG Cloud for instance uses 100 percent renewable energy and by providing a multi-tenanted cloud platform to its customers further maximises these efficiencies, resulting in an overall reduction in aggregate energy consumption when compared to customers running the equivalent server footprint on-premise.

We’ve been encouraging customers to consider a move to the cloud for years. Now more than ever, with energy costs so high, businesses really need look into whether doing so could save them large sums of money as well as improve their IT infrastructure.

In the Blog post below, Network Engineer Kevin Lyons talks about the threat of 3rd party access rights over applications.

Over the years, I have come across third parties which will insist on Domain Admin rights, just to install a piece of software on a server and a few workstations. I have worked with a company where the third party would not give a date for install without granting Domain Admin rights. The reasons given where not justified – such as ‘because it prevents issues during the install’ and ‘because that is required’. As an Network Engineer, I have dealt with a third party company who wanted to add users to the Domain Admin groups to prevent issues and it is the access needed to run in order to execute on the elevation. In this case and usually if planned properly, the correct access to a key folder was sufficient.

What can be insisted on are generally Domain Admin accounts which also run services and have non-expiring weak passwords.

Whenever a company comes on board with Outsource Group, one of the first things we do is check who are members of the Admin groups in Active Directory; the record so far was 75 accounts (a combination third party accounts and users) to run a certain piece of software, the reason given was ‘because it is needed when there is an update to the software’. On investigation the users required ‘modify’ access to a sub-folder of the program files directory.

The concerning part is users had no idea what power they wield as one mis-click could authorise an encryption of an entire domain. When thinking about the insider threat, intentional or not we have to consider what permissions our application support companies request for both themselves and the users of their system and why.

If there are any questions then please ask us at Outsource Group

#cybersecurity #microsoft #credentials #adminrights  #insiderthreat #permissions #security #mssp #whensecuritymatters

OSG Cloud is a relatively new entrant to the market.  With our first 12 months of operations and trading now under our belt, we’ve onboarded 50 new customers, revenues in excess of £1M+ (the lion’s share of this once went to Microsoft’s Azure!), and achieved a 100% success rate with every customer that put the platform to the test through trial workloads, now committing fully to OSG.

How?

Being Better, Faster, and More Affordable.

Better: We’ve invested in the best technologies and partnered with the best vendors available enabling us to stand over all elements of the service; not just the underpinning infrastructure, but all the way up the service delivery and management stack.  All backed by robust SLAs and KPIs for application availability, security, management and governance.

Faster: Application and IT performance is key to improving the end users’ experience, business efficiencies and results.   OSG Cloud is designed exclusively for Enterprise IT workloads, focused on one class of service that guarantees to outperform any On-premise, Public, or Private Cloud infrastructure.

More Affordable: On average, our service is 15% more cost effective when compared spec-for-spec against the big Hyperscalers and we can prove it.  More importantly, we also offer complete budget certainly with predictable and transparent pricing.  No more ‘bill shock’ or being penalised for trying to improve your users experience, applications and business performance.

If you’re currently, or considering, running your enterprise IT on cloud infrastructure, then please give us a shout at info@osgroup.co.uk.  We can help you understand the true cost of Public Cloud, as well architect the most appropriate cloud solution and IT operating model.

We know that just using passwords is a security threat and we should all use 2FA. Or MFA, as it is now known.

But what is MFA and why is it so important?

MFA is comprised of 3 areas.

• Something you know: This could be a PIN or a password
• Something you have: This could be an Authenticator App.
• Something you are: This could be a fingerprint or face scan.

If you have a combination of two or more of the above, it is classed as MFA. If you have two of one area, for example a password and a PIN, then it is not classed as MFA.

But did you know not all MFA systems are equal? Older MFA systems are being ‘defeated’ by hackers.

Text message systems are no longer advised as ‘secure’, as it has been demonstrated that SMS text messages are often the weakest link in two-step logins. It is possible for hackers to sometimes hijack the SMS messages meant to keep you safe. Or even sim-swapping which means your authorisation code text message may arrive at a different or duplicate phone.

Whenever possible, it’s worth taking a minute to switch to a better system such as an Authenticator App.

Thinking of systems, no matter how strong they are, the weakest link is generally the user. Recent studies show that if a particular account is attacked multiple times and a user gets multiple prompts on their Authenticator, they are likely to hit ‘Approve’ at some point to stop the annoyance.

Before implementing MFA into an organisation, users on all levels should be fully engaged and educated on their responsibilities. They should know that if they are getting multiple prompts or unexpected prompts then they should be investigated.

Get in touch with our team at Outsource Group to discuss MFA and how we can implement it to keep your organisation secure –  info@osgroup.co.uk

Not many businesses have the luxury of dedicated inhouse cloud specialists to configure, manage and monitor their public cloud environments, to allow them to extract maximum performance and cost efficiencies from their current cloud provider.

Our service is designed to not only deliver market beating performance, but to provide a high standard of manged services to those businesses that do not have the time, resources, or funds to make the levels of commitment required to fully exploit cloud technologies.

We take ownership and responsibility for migrating, monitoring and managing your applications in the cloud. To date, every business that has trialled a free workload has made a business decision to partner with us and embrace a cloud operating model.  If requirements dictate specific types of cloud services, tools, reach etc, we can leverage tier 1 public cloud infrastructures and services, integrating seamlessly to deliver a truly hybrid cloud solution; allowing business to cherry pick the best bits of all the available options.

We remove price uncertainty and offer guaranteed fixed pricing, enabling businesses to understand, plan and control budgets better.

Why not get in touch to see how we can help your business?
#business #cloud

By now, most of us will have digested Microsoft’s recent licensing / price changes.  As difficult as they can be to swallow, the fact remains that there really is limited choice, other than to simply choke it down.

Of course, it does trigger the need to review your license base and ensure you are licensing your users, devices, and services in the most cost-effective way.  Unfortunately, the outcome is always the same, and the vendor related spend keeps going up.

As a cloud service provider, we’re often stuck in the middle and typically end up being the bearer of bad news when vendors unilaterally decide to impose these charges.

However, we fully understand the bad taste that this can leave.  So instead of punishing customer loyalty, we want to reward it by not passing price increases through to our existing customers.  The rate card you have today for your cloud services, will always be your rate card.  So anytime a vendor pushes out an increase to its license costs, we will absorb those costs; essentially passing that on as a de facto discount or reward for your loyalty.

If your cloud bills are considerably more today than what you had originally planned and budgeted for, then get in touch.  We can help get your cloud costs under control and provide a guaranteed fixed price, whilst delivering better performance, for your cloud server estate.

There are three kinds of organisations in the world;

• Those who have been hacked,
• Those that are next in line or, worst of all,
• Those that don’t know they’ve already been hacked.

“Why would someone want to hack my business ?” is probably the most common mistake most businesses make. But hackers don’t discriminate – ALL businesses are targets and subject to ransomware and other cyber attacks.

When your staff navigate through the digital world they leave digital breadcrumbs. Every time they register at a website or sign up for an event, they use a username and password.

Cybercriminals are constantly, and successfully, attacking these websites and other user input points to harvest this login information which becomes the first piece in a larger, more elaborate digital jigsaw, which they piece together to create a profile and your business becomes the target.

RECOMMENDED BEST PRACTICE
The National Institute of Standards and Technology (NIST) produced its Cybersecurity framework (CSF), that sets out 5 best practice functions.

IDENTIFY: Know what you have, where you have it and the value of every single resource individually plus the value all resources combined.

PROTECT: Develop and implement appropriate safeguards to ensure critical infrastructure service delivery and proactively support your ability to limit or contain the impact of a potential cybersecurity event.

DETECT: The faster a cyber event is detected, the faster the repercussions can be mitigated. The early discovery of cybersecurity events is a critical step to a robust cyber program.

RESPOND: Develop appropriate techniques and actions to take when a cybersecurity incident has been detected. The faster and more effectively you respond to a possible detection of a cyber incident, the faster you can stop the threat in its tracks or mitigate its damage and reduce any potential financial impact.

RECOVER: Maintain appropriate plans that can be implemented to restore any impaired capabilities or disrupted services due to a cybersecurity event. Timely recovery to normal operations reduces the impact of a cybersecurity event.

Outsource and OSG Cloud both partner with the word’s leading backup and recovery technology solution providers and as NI’s only Veeam Gold Partner, Cloud and Service Provider, are best placed to support your business in ensuring you are best placed to deal with an attack and to recover after one.

We can help review your current security posture and build and implement comprehensive and robust cybersecurity program that guarantees the security and protection of your digital estate.

Don’t wait until after an event, take some pro-active steps today and make CYBER-SECURITY a priority for your business.

Get in touch for more information: info@osgroup.co.uk

#cybersecurity #security #informationsecurity #cloudsecurity

Fishing, already one of the world’s top participation sports, has again grown in popularity since the onset of Covid but unfortunately pales into insignificance compared to the unprecedented rise of Phishing Attacks on businesses during the same period.

Recent UK Government statistics tell us 65% of businesses have experienced a cyber security breach or attack in the last 12 months, with Phishing Attacks the stand out weapon of choice for criminals to steal data/information or extort money.

What is Phishing ?
Phishing is where attackers use multiple attack routes (email, mobile, social media, telephones, text message etc) to trick users into taking an action eg click a link for example, which provides them with the opportunity to steal, corrupt or hold a company to randsom.

Steps to Mitigate and Minimise  ?
Following some basic steps will give your business some greater protection, including;

1.    TRAINING – Implement staff training and security awareness programmes. In-House or trusted IT partners can provide staff ongoing training included regular unannounced simulated phishing exercises.
2.    ANTI-VIRUS SOFTWARE – Use reputable and up to date Anti-Virus software
3.    FIREWALLS – Use Desktop and Network Firewalls – have professionally configured and managed.
4.    BROWSER – Keep it up to date with all new security patches to ensure newly identified loopholes are closed.
5.    POP UPS – Remain vigilant of ALL pop-ups, even if they look legitimate.
6.    SITE SECURITY – verify the security of a site before you use it.
7.    PERSONAL INFORMATION – where possible share as little personal information on the internet you can.
8.    PASSWORDS – implement and follow password security guidelines (complex / three random words)
9.    MFA – a basic security requirement (no caveats)
10.  THINK BEFORE YOU CLICK – “act in haste repent at leisure” – any time you feel under pressure to act or respond quickly should be considered a red flag to take a breath.

Finally, where people are involved we will always be subject to human error and so when all else fails and in anticipation of a successful breach – HAVE A PLAN, PREPARED IN ADVANCE, so you can take the right actions, in a timely manner, to minimise losses and disruption.

To find out more about ways you can assess your vulnerabilities and improve your cyber security readiness get in touch. 

Multifactor Authentication (MFA) is a BASELINE security requirement for your Business. It is no longer considered an option if you value the security of your business.

To underpin the point, President Biden has recently signed an Executive Order making MFA a non-negotiable requirement for all US government agencies, with immediate effect

Outsource recommend businesses continue to maintain a robust security stance using group policies to ensure staff avoid the use of simple, non-complex passwords. The National Cyber Security Centre’s current recommendation for a strong password is to use three random memorable words, “ RedPantsTrees4! ”.Longer and complex alpha numeric passwords also remain acceptable.

However even complex passwords remain vulnerable to exploit. The IT security community believe the incorporation of the additional layer of MFA security is a must to help maintain the integrity and safety of your business networks. It simply provides an additional layer of security, a safety net, when for whatever reason a password has been compromised. It just requires a user to present two pieces of evidence as verification before they can gain access.

MFA is not new and you will already use it in your own personal life. From the moment you swipe your bank card at the ATM and need to verify by a PIN number to your online purchase where you are then required to enter a numeric code sent to your phone/e-mail address.

In order to verify users MFA offers a range of options falling into one of the following three primary categories:

– Something you know (like a password or PIN)
– Something you have (like a smart card/one-off code/clicking – – Approve on an authenticator)
– Something you are (like your fingerprint/face ID).

As technology evolves and security threats continue to increase expect to see the increasing use of more specific security measures such as Adaptive MFA. This will further increase your security stance by tailoring verification to user roles, security levels, approved permissions, location, log in behaviour etc. These variables when chosen will all feed into each individual users specific log in requirements. However for today the minimum requirement as confirmed by all reputable Security experts must be the deployment of MFA.

If the importance of MFA has not been stressed enough by your existing IT provider or your internal IT team you need to ask why and if required seek advice from another reputable Security adviser.

For the effective protection of your Network and your Users it is time to ask yourself “why do we not already have MFA in our business ?”

Get in touch to discuss how the Outsource Group can support your Cyber Security and IT needs, for today and tomorrow.

There are three kinds of organisations in the world — those who have been hacked, those that are next in line or, worst of all, those that don’t know they’ve already been hacked.

Thinking that you and your business won’t be a target, or that you don’t have any valuable or interesting data, is a false sense of security and the most common mistake most people make.

As you navigate through the digital world, you leave digital traces behind like digital breadcrumbs. Every time you register at a website, or even simply sign up for an event, you use a username and password.  The username is usually your email address and the password is, for 60 % of people, a re-used password.

Cybercriminals are constantly, and successfully, attacking these websites to harvest login information like email addresses, login names, domain names and any other information they can retrieve. This is just the first piece in a larger, more elaborate digital jigsaw. The data they retrieve will be placed in cloud caches, analysed and enriched with other data sources like a social media post, LinkedIn profiles and multiple other telling pieces of information that is readily available.

As soon as cybercriminals establish relationships between these digital jigsaw pieces, they create a profile and you become a target.   Armed with this digital profile, they have the keys and further opportunities to gain access to newer, larger and more sensitive data sources.  Every piece of additional information they gather, brings them many strides closer to successfully hacking you personally, and worse still, your extremely valuable corporate IT systems.

The National Institute of Standards and Technology (NIST)  produced its Cybersecurity framework (CSF), that sets out 5 best practice functions that are widely considered to be the default standard for building a robust cybersecurity program.  They are applicable to organisations of all sizes, and all industries, whether you’re just getting started in establishing a cybersecurity program, or if you’re already running a mature program.

1. Identify: Know what you have, where you have it and the value is of every single resource individually plus the value all resources combined.
2. Protect: Develop and implement appropriate safeguards to ensure critical infrastructure service delivery and proactively support your ability to limit or contain the impact of a potential cybersecurity event.
3. Detect: The faster a cyber event is detected, the faster the repercussions can be mitigated.  The early discovery of cybersecurity events is a critical step to a robust cyber program
4. Respond: Develop appropriate techniques and actions to take when a cybersecurity incident has been detected.  The faster and more effectively you respond to a possible detection of a cyber incident, the faster you can stop the threat in its tracks or mitigate its damage and reduce any potential financial impact.
5. Recover: Maintain appropriate plans that can be implemented to restore any impaired capabilities or disrupted services due to a cybersecurity event. Timely recovery to normal operations reduces the impact of a cybersecurity event.

OSG partners with industry leading backup and recovery technology solution providers.  We can help review your current security posture and build and implement comprehensive and robust cybersecurity program that guarantees the security and protection of your digital estate.

Importantly, we provide you with the absolute confidence, backed by contractual commitments and SLAs, that your business can recover from any incident within an acceptable, defined and predictable timeframe.

Don’t wait until after an event, take some pro-active steps today and make security a priority for your business.

It’s that season again where sport is dominating the headlines and screens are filled with athletes competing and pushing themselves to achieve their absolute best on the world stage of the Olympics. Everyone is striving to attain the top performing gold medal and make their home country proud

Like Paul O’Donovan and Fintan McCarthy, who won Ireland’s first gold medal of the Tokyo Olympics on Thursday with a stunning victory in the lightweight men’s double sculls. Hours on the water and years of training paid off.

In a humorous interview with the BBC, asked how being an Olympic gold medal-winning athlete sounded, O’Donovan said: “It’s alright, yeah. You can’t complain about it really. I wouldn’t go around introducing myself like that though.”

He seems fully aware and not at all bothered that the Olympic coverage will fade over time and will likely be happy to get back on the water and “do what we always do, the best we can.”

Some similarities could be drawn to the initial hype around Public Cloud. When first launched over a decade ago it promised infinite scale, global reach, on-demand flexibility, rapid deployment, super low unit cost and consumption based ‘only pay for what you use’ billing.

Public Cloud has delivered on all these areas.  In most cases exceeding expectations. The exception to this is costs – the reality of the super low unit cost and consumption-based billing model, is increased costs.  Not the savings everyone expected.

There is no doubt that if time is spent using cost calculators available (note: these are sales and marketing tools), the numbers always look favourable.  However, the unit-based costs are allocated to absolutely everything – including things that happen ‘under the hood’ on the platform that most people don’t understand, let alone know how to translate their own requirements and use cases to.

This is in absolutely no way a failing or misrepresentation by Public Cloud providers.  They’ve been upfront and honest with their transparent pricing and low unit costs.  It’s simple misunderstanding, people getting carried away with all the hype, that has led most businesses to expect to achieve considerable cost savings, by moving to Public Cloud.

There will always be examples of companies that have achieved reduced costs.  However, organisations that are heavy users of IT or applications, or just have heavy applications, often, will have realised considerably higher costs post move.

In addition to increased costs, another unexpected or undesired realisation is lack of certainty or predictability around monthly costs.  Cloud infrastructure and resources are not consumed in a uniform or consistent way, leading to variables that are difficult to predict, manage, and in some cases impossible to control, leaving budget holders with an unenviable task.

Public Cloud does, and will, always have its place. 

However, companies that have embraced these platforms should begin to review their longer-term strategies; and consider a multi-cloud operating model which is becoming ever more prevalent.  Which involves moving those applications that don’t necessarily need global reach or hyper scale whilst still having access to all the other goodness that Cloud offers. Including typically high levels of performance, that can be delivered close to their end users

No matter where you are on your journey, it’s important to review and assess regularly to make sure you are embracing the technologies and platforms that allows you to evolve and adapt, and not be locked in to any one vendor or platform.

Not all clouds are created equally.   

No one size fits all.  It will take a hybrid and multi cloud approach and operating model to best fit all your requirements (known and unknown).  That may include public cloud, but most likely will incorporate specialist private and hybrid cloud platforms managed by trusted partners and delivered closer to home, and importantly closer to your end users.

OSG provides an enterprise grade private and hybrid cloud platform, with guaranteed performance, recoverability, with predictable commercials.

For us it will never be about the hype but doing the best we can with the technology available to ensure your business can always access gold medal standard cloud services and solutions.

Get in touch to discuss how we can help your business leverage cloud.

Having a disaster recovery plan for your business is prudent, it’s a de facto insurance policy for your business.

Getting to that point of having a policy in place that is fit for purpose and appropriate for your business (and allows you to sleep easy at night) can be a journey in itself.  It may seem daunting from the outset, but choosing the right partner to help you navigate your way through the process is essential and can help underwrite the entire service when you come to rely on it the most.

The 5 essential things to identify are:

1. Scope – what should be included in your recovery plan

• Review your users, systems and data, and identify what you rely and depend on the most and evaluate the impact should they become unavailable either temporarily or permanently.

2. Recovery Time Objective (RTO)

• Once you’ve identified all the relevant components that need to be considered as part of any recovery activities, you should then prioritise each – those that need to be recovered first, second and so on.  This will inform the recovery plan, and defines the recovery time objectives (RTO) for your IT services and users.

3. Recovery Point Objective (RPO)

• Next you need to establish what your tolerance, if any,  is to partial and / or complete data loss.  This will determine your recovery point objectives (RPO) – the point in time that if you recovered to, you could comfortably continue in an almost business as usual way, without any material impact P&L, productivity, services, customers, and suppliers.

4. What are the scenarios that might trigger a recovery event?

• Completing some scenario and ‘what if’ planning will help shape the plan, as you will quickly understand the ramifications of different types of events, as well as the practicalities of what the recovery would or needs to look like.  This, along with your scope, RTO and RPO will underpin your DR plan and identify any extra resources or services that need to be in place to facilitate it.

5. Pick the right partner and technology.

• Most importantly you need to engage a partner that you can trust, and you know will be by your side through out what could be one of the darkest and most stressful times your business has faced.  It’s no good picking a vendor to install a solution and then walk away.   Over time, systems, people, priorities will change, so it’s important that the recovery solution is regularly reviewed for appropriateness, as well as fully tested and verified against the plan.  Your chosen partner needs to be contractually retained to fully assist in a recovery event, so that they are responsible and accountable for the solution.

There are different technologies, services, approaches and methods for recovery, and it’s likely that the right plan for you will have some combination of these. 

If, at a minimum, you nail 1 to 5 then you can take comfort that when you come to rely on your DR plan the most, your expectations will be fully met with no surprises when you execute your plan.

We provide a full suite of recovery options, ranging from

• Back-up as a Service,
• Disaster Recovery as a Service
• And, recently launched ‘World First’, Failover as a Service.

If you don’t yet have a suitable DR or recovery plan, or are lacking complete confidence with what you have, then get in touch. Let our expert team design the best solution for you, that we will 100% stand over and underwrite.

Recovery has been talked about a lot over the last few months, as we look forward to the new post-pandemic world. Without doubt everything has changed and our way of living and working will be different.  Some good, some bad.

Perhaps now we all understand better how important recovery is across every aspect of our lives, businesses, and worlds.  It’s a common thread that exists across almost everything: economies, environment, sport, health, relationships, a good night out; the list is endless!

The principles of recovery are common:

• It’s about getting back on your feet;
• And recovering to at least the position you were before, or a better one.

Recovery can be approached in two ways: reactively or proactively.  Most of us take a reactive approach, we roll with the punches, re-evaluate, and cut our cloth accordingly.  That’s absolutely fine for the majority of things that we face personally.

However, for the really important things that have the potential to impact populations, industries, our businesses and our livelihoods; we must be pro-active.  That means, everyone needs to plan for the worse case scenario, and be sure those plans can stand up to the test when they are needed the most.

Before the event, it’s very difficult to conceive how real the risk of the worst happening actually is.

• Pre 9/11 no one could have imagined those horrific events unfolding;
• Pre 2008 no one could have predicted just how quick and deep the financial impact would hit;
• Pre 2020 and Covid, enough said…

With the benefit of hindsight and our newfound experiences of these events; looking back it was almost, inevitable.  Simply a matter of time.

It’s important that we learn from history, and make sure that we’re always prepared for the worst.  There is no need to try and foresee every possible eventuality or categorise every tiny conceivable risk that might trigger an event.  However , we do need to think about the impact and the potential “what ifs” of an event itself.

In the context of IT and recovery, it should not be about all the things that could cause an availability issue, a security breach, or corruption (or even worse crypto locking) of data.  The cause is irrelevant (in the context of recovery – prevention and mitigation, well that’s one for another day).  Instead, the focus should be on what the impact of the event is to our business, and make sure that we have a plan, tried, tested and continually verified;  that can be executed, when needed, that will enable the business to get back as quickly as possible to at least the same position it was previously.

The ugly truth of recent months is that the worst does and will happen. 

Only you can decide how impactful or disastrous that might be to your business, and if it deserves a reactive or proactive response.

Want to know more about what you can do right now to put your business in the best position? 

Get in touch with one of our team to find out more. Take action today.

OSG Cloud are proud to be recognised as the first, and only, Dell Cloud Provider in Northern Ireland

For over 20 years Outsource have enabled businesses across the UK and Ireland to solve tomorrow’s problems today. We take care of our customers’ technology needs and make life better so they can focus on what is really important, their people, business and customers.

Our team of experts have been collaborating with the team at Dell Technologies to create, design and deliver world class cloud services  to enable us to rapidly deploy scalable infrastructure for our customers. OSG Cloud delivers scalable, secure, high performing solutions to maximise the agility needed by business to drive success and enable growth in our rapidly changing digital world.

The hybrid cloud infrastructure on Dell’s VxRail and Unity platforms, powered by Intel and VMWare provides us with exactly what we need to deliver guaranteed performance, security and availability to our customers.

OSG Cloud removes the barriers and complexities of cloud enablement to allow businesses to choose an IT delivery model that fully meets their exact needs.

Check out our video gallery to hear more from Jason Ward, VP Dell Technologies, Terry Moore and Brian McCrory on what they think about this achievement.

Businesses are justifiably nervous, the security threat to every business is growing, the risk is real. Every organisation recognises the consequences of inadequate security, compliance and reliability in communications systems.

• Data breaches make headlines and affect reputations.
• Privacy violations put companies at legal risks.
• Downtime results in lost revenue.
• Recovering from hacking or fraud is costly and a distraction from where management want to focus attention.

We Take Security Seriously.

We talk plainly about it because we can provide secure, compliant and reliable services.

Talk to us to find out more about how we can deliver secure voice, cloud communication solutions for your business with our telecoms partner 8×8.

Achieve your security and compliance goals.

From physical security to data at rest or in motion, 8×8 is protecting your business using the highest levels of security and compliance policies and procedures – verified by 3rd party security and compliance certifications including:

• HIPAA
• NIST/FISMA
• Privacy Shield Framework
• ISO 27001 and 9001
• PCI
• Skyhigh CloudTrust and the Cloud Security Alliance Star Compliance
• GDPR
• U.K. Government G-Cloud
• Cyber Essentials Plus

8×8 offer one platform for voice, video and chat. Services are developed with privacy and security in mind, they own their technology stack allowing them to prioritise our customers’ PCI compliance needs.  Infrastructure is developed to keep up with evolving standards. When changes are needed, everything can be quickly adapted and transparently communicated with customers without waiting on third party technology providers to modify their components.

Ready to Learn More?

Contact our Telecoms Solutions Expert to learn more about how together with 8×8 we can help enhance security and compliance for your business through one system of engagement that integrates voice, video, chat and contact centre capabilities.

Get in touch today.

Poor Connectivity can cripple business productivity.  Not surprisingly then, many businesses are looking at leased line connectivity as a solution and an alternative to broadband.  Effectively, a leased line is a dedicated Ethernet connection direct to the Internet.

How much does a leased line cost?

Frustratingly, there isn’t a simple, easy answer. The reason? Leased line costs depend on a number of business-specific variables:

Location. A leased line involves creating a direct fibre optic connection between your business and the nearest ‘Point of Presence’, this is usually an exchange or carrier datacentre, which can be up to 35km away. The longer that connection, the greater the cost.

Bandwidth. Basically, the faster the connection, and the greater the amount of traffic that it has to carry, then the higher the cost. A business simply wanting a fast and reliable connection for 20 people, say, is therefore going to pay a lot less than a 200-employee business with heavy cloud-computing and enterprise systems workloads.

Contract length. From a leased line provider’s point of view, there are a lot of fixed costs involved in setting up a leased line connection. The longer you’re prepared to be a customer, the lower your monthly payment.

Required levels of customer service, latency, resilience, and uptime provisions. As always, you tend to get what you pay for. And as with consumer broadband offerings, cut-price business connectivity can often mean compromises on performance and service.

Make Informed Decisions

It is important to really understand what your bandwidth requirement is going to be, as not every leased line provider will offer an ability to flex your leased line’s bandwidth as your needs evolve. Bandwidth calculations aren’t easy, technology evolves at a rapid pace which may increase your business demands.

Different leased line providers will have different leased line infrastructure in place to serve businesses’ differing location and bandwidth situations. It really does pay to shop around—especially if your business is located a little off the beaten track: cities and busy business parks are better served than more rural locations.

Getting The Best  Solution

It is a complex marketplace, thanks to those differing leased line infrastructure footprints, and differing service and uptime provisions.  To ensure you get the best prices and the most appropriate leased line capability, we obtain a  ‘whole of market’ comparison with our connectivity partner Aspire, who work with all leased line providers including Virgin Media, Sky, Openreach, Talk Talk Business and CityFibre, to ensure your business benefits from the best solution to match your needs.  They also provide a 24/7 support service dedicated 24/7 monitoring and support and a customer portal for bandwidth usage reporting and incident management.

Our Dedicated Leased Lines offer ultrafast speeds which are dedicated to your business, meaning you don’t share the bandwidth with anyone else, ensuring that you can always rely on your connection.

Click the link below to read more about their features and benefits.

Features and Benefits – Dedicated Leased Lines

Are you looking for help in working out which leased line option best suits your business? 

Get in touch, talk to one of our expert telecoms solutions team who develop best in class solutions solutions in collaboration with a range of highly regarded and proven global partners.

General fundraising has been hit very hard by the COVID-19 pandemic. Thousands of fundraising events have been cancelled and many charities, are struggling to maintain services because of this huge reduction in income.

We believe that mental health is important as physical health and our charity champions have launched a TEAM CHALLENGE with a personal target, to raise funds and support our charity partner Action Mental Health.

This September everyone involved has agreed to complete 5k a day. The minimum distance will be covered by a variety of activities including walking, swimming, cycling and running.

Statistics on mental illness in Northern Ireland can be shocking, and experts believe they will be on the rise because of the impact of the recent pandemic.

Did you know?

• One in five adults in Northern Ireland will show signs of a mental illness
• NI had the 2nd highest rates of mental ill-health, when matched to 17 other countries.

Stress is a major factor and AMH have recently launched a tool to help people build resilience and get through difficult times. To find our more about the four A’s of Avoid, Alter, Adapt and Accept check out the guide to relieve stress and regain control:  Steps to relieve pressure and regain control

Our team are committed to doing what we can to help support the vital work of the charity across Northern Ireland. Who offer a range of support services including:

• Mental Health Awareness
• Education & Training Schools Programs
• Young People Personal Development & Support
• Eating Disorders Learning, Disability Mental Health in the Workplace
• Advice Counselling and much more.

Help us to support the vital work of all at AMH by visiting our JustGiving Page and making a donation today.

All support and donations are greatly appreciated.

Ongoing restrictions impact our ability to live the life we knew a few months ago. But with change there is always opportunity.

How and when we communicate has been transformed and many companies have responded to change by implementing technology to enable their staff to adapt quickly to more remote or hybrid ways of working.

Effective communication is essential for success and growth of every organisation.

Is it time for you to get curious about technology?

We believe in strength in partnership and are proud to work with a range of global technology suppliers to ensure our customers have access a range of collaboration tools and technology services which can streamline the employee and customer experience.  These include two of the biggest technology companies in the communication and collaboration marketplace, 8×8 and Microsoft.

Did you know?

• Your employees can collaborate on any device, across the entire organisation, even when they are on the move or scattered across the globe.
• You can have peace of mind with the highest level of security and compliance requirements in place.
• Your teams can connect and collaborate as if they were in the same room using HD video conferencing.
• You can decide which is best for you. There are video, voice and chat options available to allow you to empower your customers and employees to communicate however they want.

During this time of massive upheaval and constant change, people want to work with and for business’ they can trust. Communication within teams and customers provides reassurance in tough times.

Remote working has become a bigger motivator for staff during the past five years. All signs suggest this trend will only continue to grow and that remote teams are the future of work.

With almost half of the UK population already working remotely stats would suggest that many would like it to continue, or at least have the option of some days at home.

A Gallup study of US workers found that 59% of those surveyed would like to continue working remotely.

This means a new kind of communications and approach is required to ensure employees benefit from better work life balance and do not feel disengaged or isolated. In turn the business will benefit from increased productivity, a reduction in employee turnover rates and decrease in overhead costs.

Technology can help promote meaningful interactions internally and externally.

Customers expectations are at an all time high and business communication is vital, as a positive customer experience is immensely reliant on communication.

IT is personal, every business has different needs and it is important to ensure you work with a technology partner you can trust to help you find the right solutions to assist your business to perform beyond expectations and communicate effectively.

Get in touch today to talk to one of our expert team about the range of technology services and solutions we offer. We are here and would be happy to help. Or check out this video of a short break out session hosted at our recent virtual event which focused on communications to find out more.

A recent project by our team for Kingspan Water & Energy Limited involved unifying communications to improve their customer experience and employee engagement, read more about their experience with our team by clicking here

In the age of Covid-19, Device Maintenance is on many business’s minds. IT Performance, Data Recovery and Data Security are just a few of things that business leaders could be concerned about in the current situation.

Legacy infrastructure lacks the modern technologies required to support the demands of the ever-changing technologies, increased traffic, distributed data, complicated security and compliance needs, and other necessities for effective IT infrastructures.

They are also placing game-changing demands on existing networks.

Network transformation isn’t just needed: it’s inevitable. But the capital outlay required for a network overhaul causes many organisations to think it’s impossible. However, based on our experience with our customers, we can always find a way to help. Our range of services can be tailor-made to ensure they offer the best fit solution for your business needs.

The longer you wait, the less you gain

Delaying inevitable projects, such as the provisioning of Data Security, Disaster Recovery and Device Management, means your business waits longer to realise the value of transformation, and that value shrinks in the interim.

You don’t have to build your network transformation alone

We’re dedicated to helping our customers overcome any of challenges brought by the recent pandemic, our certified teams are innovative in their approach. To meet our customer needs we develop best in class solutions using a diverse range of highly regarded and proven global partners, to ensure our customers have access to the most advanced range of services and solutions available.

Whilst there is a lot of uncertainty of what the future will look like researchers believe the COVID-19 crisis is likely to significantly accelerate the shift to digital and fundamentally shake up the business landscape.

We are here and ready to help you build a transformation road map for your business that will deliver positive results.

Click here to check out a video of a breakout session at our recent RE:IMAGINE virtual event, hosted by Jonny & Barry. Watch and listen as the guys discuss ideas and share information on how technology could help improve your overall business performance.

Get in touch to discuss your business needs with one of our expert team today.

Digitalisation puts Information Technology at the centre of business growth. Now is the perfect time for business’ to respond to changes, forced by the recent pandemic, with technology solutions.

Along with recovery it is imperative that companies think bigger, beyond the current situations and reinvent or re:imagine a new way forward. Senior business leaders must address company pain points and frustrations by encouraging open dialogue and listening to their teams.

Then respond by working with an IT Consultant and IT company they can trust.

Together they can develop a business relationship to ensure everyone involved has a complete understanding of current business objectives and future plans. To allow expert teams involved in creating business transformation options and ideas to deliver best fit technology solutions from a range of local and Global Partners.

Cloud, VoiP, SaaS, VPN, MFA , the list of services can be mind numbing.  The tech world is full of acronyms and a range of services that are vast and different, one size does not fit all. But the correct technology solution, created with your business in mind can:

• Enable innovation
• Secure Information
• Inspire customer confidence
• Create a next-generation workforce
• Facilitate collaboration
• Support flexibility
• Accelerate Growth

Technology is an enabler, working with the right IT provider is critical to your business success.  Our expert teams are made up of the best people ready to engage in dialogue, create ideas, develop solutions, implement services and deliver results that will MAKE LIFE BETTER for you and your business.

Get in touch. 

Talk to us about how we can help you begin, develop or expand your business transformation journey.