Sam T.

Help your small business prevent or survive a cyber attack with this 1‑page cheat sheet covering: 👉 The most common attacks 👉 How they work 👉 How to help prevent them 👉 What to do after an attack 👉 UK‑specific guidance for ICO, Action Fraud and NCSC reporting

5

2 Comments

Fears of AI-induced armageddon are overdone; applying basic security principles would go a long way to fixing problems... Economist Article by Ciaran Martin, former CEO of Britain's National Cyber Security Centre. P2/3 - links in comments If the world lets AI agents run riot without supervision or accountability, cyber-attacks will be among the lesser of the ensuing problems. The second reason for calm lies in understanding hackers. The reports about Mythos and the agents relate to artificial testing conditions. Using agents for hacking in the real world means bypassing guardrails and incurring extremely heavy computing costs. These constraints matter: several years into the age of AI, evidence that malicious hackers are using advanced AI hacking techniques remains remarkably scant. Last year a working paper from MIT Sloan, written with an AI security vendor, claimed that 80% of ransomware incidents (the most harmful form of cyber crime) were AI-driven. Marketing departments seized on the finding. Respected publications amplified it. But the paper was withdrawn after critics noticed it had counted, among other things, WannaCry—the attack in 2017 in which misfiring North Korean hackers wreaked havoc in more than 150 countries—as AI-powered. One of the people who spotted this nonsensical claim was Marcus Hutchins, a British cyber expert credited with stopping WannaCry. Now based in America, Mr Hutchins despairs of the “freakout over Mythos”, given that the “local water treatment plant runs [on] Windows XP”, a Microsoft product already obsolete when WannaCry struck, and “the protocol that routes internet traffic is secured by everyone just agreeing that hijacking it would be uncool.” Both points are crucial. Mudge and others warned in 1998 that fundamental parts of the internet’s architecture were wildly insecure. Some of them still are. The reason nobody has brought down the internet is that there is no reason for any capable hacker other than a total nihilist to do it, and whoever did could expect severe consequences. That has been, and remains, the uneasy basis of modern digital life. Mr Hutchins’s point about critical infrastructure is more timely still. As the media gawped at AI testing failures, in the real world hackers were hitting water facilities in a dozen American states. Whoever they were—some say Iran, but President Donald Trump demurs—they were using crude techniques exploiting basic security failures, not advanced AI. Serious supply disruption was only avoided thanks to stored water, manual valves and observant staff. And there is the sting: underlying cyber-security is often so weak hackers have no need of expensive new techniques. AI doesn’t yet give most hackers magical new powers. But it can help them prepare, speed and scale up. That could make it likelier that security neglect will come back to haunt organisations. P2/3 - links in comments

ICO wins appeal. "The CoA… confirms that DSG was required to take appropriate security measures to protect #PersonalData from unauthorised access, regardless of whether people could be identified from the data exfiltrated by the hackers." #CyberSecurity

4

Dark Web Monitoring Policy: Staying Ahead of Hidden Threats The dark web is a hidden marketplace where stolen data, malicious tools, and emerging threats circulate. The Dark Web Monitoring Policy equips your organisation with the tools and protocols needed to detect and mitigate risks lurking in these unregulated spaces. This policy outlines best practices for monitoring dark web activity, recovering compromised data, and responding to identified threats. By implementing it, your organisation can take a proactive approach to identifying risks early, whether it’s leaked credentials, unauthorised data sales, or plans targeting your systems. Waiting for a breach to act is no longer an option. By monitoring the dark web, you gain valuable intelligence to protect your organisation, its clients, and its reputation. Be proactive—purchase this essential policy today to safeguard your organisation. https://lnkd.in/dj2F3GU7 #cybersecuritypolicies #darkwebmonitoring #cyberprotection

2