Stop panicking and start protecting: What we can learn from recent cybersecurity breaches

What we can learn from recent cybersecurity breaches and how to better protect your business and position security to your customers

A series of high-profile cyber attacks against UK businesses have put cybersecurity firmly in the spotlight over the last year or so. From M&S, Co-op and Harrods to the latest incident affecting ASOS, these attacks have resulted in operational disruption, data breaches, financial losses and reputational impact that can take months, or even years, to put right. 

The attacks on these businesses have taken different forms, but they have a lot in common. Ransomware, social engineering, compromised credentials and vulnerabilities in third-party platforms have all featured, demonstrating just how many potential routes there are into an organisation. 

The financial impact of the M&S attack alone ran into hundreds of millions of pounds, bringing the risks of cyber vulnerabilities firmly back to the front of mind for business owners and organisations of all sizes. 

The latest ASOS incident, just last week, provides another useful example. An unauthorised party gained access to an employee account after impersonating a trusted contact and obtaining login credentials. Those credentials were then used to access information on third-party platforms used by ASOS. It's a useful reminder that you don't need a ransomware attack or major system outage to see the impact of a cyber incident. 

But we’re not here to stoke fear about the attacks. We’re here to highlight the learning opportunities. The ‘good’ news is that these attacks highlight weaknesses in digital infrastructure, processes and human behaviour; vulnerabilities businesses can take practical steps to address. 

For Elevate Wholesale partners, these incidents are also a reminder of the importance of understanding the risks facing your own business and that of your customers. They provide an opportunity to have timely conversations about security, identify where additional protection may be needed and help customers make informed decisions about protecting their businesses.

In this blog we take a look at some of the key features of the recent attacks and provide practical guidance on protecting your and your customers business against them.

‍

‍Assessing the vulnerability: The attack surface

Let’s start with the attack surface. An ‘attack surface’ refers to the sum of all potential points where an unauthorised user (attacker) could gain access to a business's systems, network or applications. The smaller the attack surface, the less vulnerable your business is (conversely, the more devices, software, cloud services and third-party platforms a business relies on, the more potential entry points it needs to protect). Across these high-profile attacks, the attack surface (vulnerabilities) included: 

• Employee accounts and credentials: Attackers targeted staff accounts, especially those with privileged access, to obtain credentials, often by impersonating employees.
• IT helpdesks: Attackers focused on IT support processes, manipulating helpdesks by posing as legitimate users and then requesting the reset of credentials such as passwords in order to gain entry. 
• ‍Remote access tools: Once inside the network/platform, attackers used legitimate remote access and administration tools to move between systems, hiding in plain sight by blending in with regular activity.
• ‍Third-party vendors: The recent ASOS incident highlights the risks associated with external platforms and services. An employee account was reportedly compromised after an attacker impersonated a trusted contact to obtain login credentials, which were then used to access information through a third-party platform.
• ‍POS and online platforms: Retailers rely on connected systems for everything from payments and online ordering to click-and-collect. If these systems are compromised or disrupted, the impact can quickly spread to day-to-day operations, customer experience and revenue.

‍Offering a solution

Regular cyber risk assessments are critical to help identify and address vulnerabilities across systems, networks, user accounts and third-party connections. Critical systems like POS and back-office operations should be completely segmented from other networks and devices to help limit the impact if one area is compromised. 

It’s also important to securely configure and monitor connected devices and cloud services, keep systems up to date, and ensure that suppliers and other third-party partners meet appropriate security requirements.

For Elevate Wholesale partners, these are useful starting points for conversations with customers about where their vulnerabilities might lie, what protection they already have in place and where additional measures could help reduce risk.

‍

Assessing the vulnerability: Attack techniques

Knowing where the vulnerabilities are is one thing. Understanding how attackers exploit them is just as important.

A number of techniques have featured in high-profile cyberattacks against UK businesses. Recognising them can help you spot potential warning signs, strengthen your own security and have more informed conversations with customers about protecting their businesses.

• ‍Social engineering and phishing: Attackers use highly convincing phishing and social engineering techniques to trick staff into revealing credentials or enabling access. 
• ‍Helpdesk impersonation: By posing as legitimate employees or trusted contacts, attackers can manipulate IT support teams into resetting passwords or bypass multi-factor authentication.
• ‍Remote access via legitimate tools: After gaining credentials and access, attackers may use standard administration and remote access tools to navigate a network without immediately raising suspicion.
• ‍Ransomware deployment: Once access has been established, ransomware can be deployed to encrypt systems and steal sensitive data, after which attackers then demand payment / ransom for both decryption (restoring the information) and non-disclosure of stolen data (to prevent data being exposed). 
• ‍Supply chain exploitation: Attackers may choose to target third-party vendors, managed service providers and other connected platforms to gain access to systems or customer data beyond the original point of compromise; as opposed to targeting the business directly. 

Offering a solution 

These techniques highlight why cybersecurity isn't simply a technology problem. Human behaviour, identity and access processes, third-party relationships and the technology itself can all need to be considered as part of the wider security strategy.

‍Mitigating human fallibility: A robust security strategy should cover people, processes and technology, supported by a clear incident response plan. Third-party risk management is also important, particularly where suppliers and external platforms have access to business systems or data.

Regular, relevant staff training can help employees recognise phishing and social engineering attempts. Alongside this, businesses should implement multi-factor authentication (MFA) across employee, administrator and remote access accounts, strengthen identity checks for password resets and access requests, and regularly review and monitor third-party access.

Building protection into the tech: Deploying modern endpoint protection, automated threat detection and AI-assisted security tools can help businesses identify and respond to threats earlier.  Regularly updating and patching systems, including terminals and mobile devices, will also help close known vulnerabilities. 

Where possible, network-level patch management should be automated, to relieve the burden on IT teams and helping to spot security vulnerabilities faster and proactively. 

AI-powered network platforms like Juniper Mist automate firmware updates and security patches. This can be particularly beneficial in sectors like retail, or in businesses with multiple branches, where large numbers of devices are trying to access the network from multiple locations. Manual patching is error-prone and time-consuming; by automating it, you keep your infrastructure up to date and secure proactively.

As an Elevate Wholesale partner, understanding how these attacks happen can help you have more informed conversations with your customers about their own security. The next step is knowing what practical measures they can put in place to reduce the risks.

Lessons learned and key takeaways

As we pointed out at the beginning of this blog, the vulnerabilities behind these high profile attacks - whether that be as a result of the digital infrastructure in place or human error,  highlight just how many different routes attackers can take into a business.  And whilst no single measure can eliminate every risk, there are practical steps businesses can take to strengthen their security and be better prepared if an incident occurs. 

We have pulled together a list of key things to keep in mind when evolving your cybersecurity strategy and when speaking to your customers about theirs, in order to help protect against similar threats.

‍

• Protection through your people: most breaches began with the manipulation of people, not technology. Staff training and awareness are critical to foster a culture of awareness and alertness, and make security a shared responsibility.

• Strengthen access management: credential and access management is not a set and forget process. Robust controls on password resets, MFA, and privileged access are essential. Helpdesk processes must be hardened against impersonation attempts.
• Review remote access: Restrict and closely monitor the use of remote administration tools to prevent lateral movement by attackers.
• Secure the supply chain: Ensure third-party vendors adhere to strong security standards, as their compromise can directly impact your business.
• Prepare for incidents: Your crisis management plan should cover communications, logistics and customer service. Importantly, fast isolation of affected systems can limit damage, so ensure your network is well segmented - and consider automated monitoring and response tools that can identify potential issues and help your team respond faster.
• Always on audits: Regularly review and test security controls, patch vulnerabilities and simulate attacks to identify weaknesses before potential bad actors do.
• Offline protection: Maintain regular, offline backups of critical business data to enable swift restoration after a ransomware event. 

‍

Taking a Zero Trust approach to provide ultimate peace of mind

One approach businesses should strongly consider moving towards a Zero Trust model. With remote work, cloud services and mobile access now fundamental to how many businesses operate, the traditional security model, where everything inside the network is trusted, is outdated. 

A zero trust security model is an approach that assumes no user, device, or application is inherently trusted, regardless of whether they are inside or outside the network perimeter. That means that every user or device that attempts to connect to your network is always verified.

For businesses looking to strengthen their security, it can form an important part of a wider strategy — alongside staff training, regular updates, network protection and a clear plan for responding to incidents.

‍

Increase security without the huge overheads

A robust cyber security posture is key to protecting both revenue and reputation. But improving that posture means dedicating resources to acting against threats in real time, and knowing what’s coming next. 

Earning security accreditations such as Cyber Essentials Plus is an ideal way to demonstrate your commitment to good security practice, giving customers confidence that the right measures are in place. It also provides a recognised framework to help identify vulnerabilities and strengthen your defences. Combined with the right security solutions and expertise, accreditations can help you build a stronger security posture without having to manage every aspect alone.

‍

As an Elevate Wholesale partner

This is an opportunity to help your customers understand their security needs and find practical ways to address them. From strengthening access controls and keeping systems up to date to reviewing network security, there are different ways to help customers build a stronger defence. 

And where additional protection is needed, solutions such as managed firewalls can form part of a wider security strategy, helping you support your customers while growing your own security offering. 

Managed firewalls can help businesses control and monitor network traffic in line with their security requirements. Combined with measures such as multi-factor authentication, staff training, regular patching and incident response planning, they can help strengthen a business's wider security strategy.

We can also help you make security easier to sell, through helping you obtain your Cyber Essentials Plus accreditation. This industry standard accreditation enables you t clearly demonstrate your commitment to security and build customer confidence. We also offer the option for you to offer this accreditation to your customers, opening up opportunities and making it easier to introduce the topic of security into conversations.

We've also made it easier to bring connectivity and security together. When ordering connectivity through the Elevate Wholesale Partner Portal, you can easily add a managed firewall to your order, helping you build the right solution around your customer's needs. And coming soon, new packages inspired by partner feedback will make it simpler to bundle connectivity and security together.

Whether you're looking to strengthen your own security credentials, help customers work towards accreditation or build security into your connectivity offering, we're here to help you find practical ways to do it.

If you would like to discuss this in more detail, or require any further information, please don’t hesitate to contact your account manager or get in touch.