Step 1 of a cyber attack: Recon

Our final episode for the season see us working through a framework for cyber security presenting a number of pragmatic tips for schools as to the basics which should be in place. Throughout we focus on the free or easy to implement solutions which schools or colleges can afford and put in place before we consider any of the more costly solutions. It has been a fun experience recording these podcasts, and hopefully listeners have found it interesting and useful, but with this episode marks the end of season 1.

Our penultimate episode for this series of episodes is aimed at providing some tips and content which can be used in developing user awareness. We will consider why we might be attacked along with what preventative measures we should all be using, whether we are IT staff, general support staff, teaching staff or part of the wider school community. This includes the use of strong passwords, Multifactor authentication, minimisation of online data and a number of other considerations.

This weeks episode focusses on user awareness development acknowledging the fact that users are part of the vast majority of cyber incident and therefore the need to continually develop awareness of the risks and how to remain safe and secure. So what are we hoping to achieve through awareness training and how might we measure that such training is working as it should, and how and when do we need to adjust our training approach or content?

Episode 7 continues on from last week looking at response and in particular at incident and recovery planning. How can we make sure we are as prepared as possible ahead of a cyber incident occurring? How can we create an appropriate incident response plan. We also discuss the broader issue of incident management and how those beyond the IT staff, especially at a senior level, are involved during the course of incident in managing the situation.

This episode examines detection and response in relation to cyber incidents. How do we know we have suffered from a cyber incident? Our discussion starts with a pragmatic look in relation to how a cyber incident will often start out looking like a "normal" IT issue before we finally realise it is something more, that it is a cyber incident. We will then examine how we might respond once a cyber incident has been identified.

This weeks episode looks at data governance.   Data is one of the key items which cyber criminals will want to access or destroy and through it gain a monetary gain, so it is important that we know what data we store, where it is stored as well as who has access and how it is used.   Data governance is about understanding what we are seeking to protect.   We also explore how the value of differing types of data varies and therefore how the measures we may put in place to protect may also differ.

In this weeks episode of In Our Humble Opinion we will start to look at the approaches cyber criminals might take in attacking schools and colleges.   We will consider some of the ways which they will actually get into a schools systems where they can then cause the damage to the organisation, its users, systems and data.   Social Engineering is therefore a significant part of the discussions.

This week the discussion moves from the passive recon towards the more active attacks where the organisation may be able to detect the attack, assuming they have the relevant resources looking at the logs and other data.   Having at least a basic understanding of what a active attack might look like will help in both defending and responding.

This episode we will be discussing the reconnaissance phase of cyber attacks, looking at how organisations, including schools, might become more aware of the information criminals might have access to as they seek to recon a target ahead of their attack.    This includes some discussion of OSINT (Open Source Intelligence).   Ultimately, by knowing what information is out there about us we can be a little bit more prepared to deal with attacks.

This first episode of In Our Humble Opinion starts at the beginning and considers ransomware and attacks on schools along with why schools might be attacked and why schools might be at risk from attack.   As Covey put it, we need to start with the "Why".