Tag: DR

Posted on

D is for…

Dark Web

Most of us are familiar with the Internet, and using search engines such as Google and Bing to find information we need. Those operate in a part of the World Wide Web that is often called the Surface Web. It seems like we can find a huge amount of data on the surface web, but in actual fact it’s only about 5% of all material that is available online. A large portion of the remaining data is found on the Deep Web – see below – but there’s a very murky area which is hidden away and can only be accessed by using special web browser software, the most well known being The Onion Router, or ToR. Most users will never have cause to visit this area, because it’s where various illegal web sites / services are found, including drugs, stolen goods, child abuse, false identity documents, counterfeit money etc. It’s therefore an area where criminals globally congregate to deal in and share their services.

Data Centre

A data centre is typically a large room – or set of rooms – with multiple servers in it. It can vary in size from one room with a few racks of servers, to a site with many thousands of servers. Typically they will have redundant power supplies, some form of backup solution, and will often provide services to multiple companies at the same time. Some organisations will run their own data centres, some will outsource their services to a Third Party, and some will operate a mix.

Data centres are typically where cloud services live. Companies such as Microsoft, Google and Amazon offer multiple data centres across most of the continents.

DDoS

Distributed Denial of Services (DDoS) are a method of attack on a company’s services (typically internet based, like web sites or file sharing). They are carried out by multiple internet connected devices including PCs, laptops and IoT machines, often using botnets. The word Distributed is used to signify that the devices are spreads around, possibly even al over the globe.

When a DDoS attack is carried out, the target is overwhelmed by multiple messages being sent from all the devices in the botnet, to the extent that it is rendered unusable.

A way of thinking of this is if you have a crowd of people trying to get through a door. If they move one at a time through the door, there’s no problem. If everyone tries to get through the door at the same time, it will become blocked and take time to become unblocked.

Deep Web

As mentioned above in Dark Web, the Deep Web makes up a huge proportion of the World Wide Web. The sites in this area are not indexed, which means they can’t be found by search engines like Google and Bing, but that doesn’t mean that they are providing illegal services.

Deep Web sites are typically where you can find information that isn’t really for public consumption, but which is used by special interest groups. This will include research groups, academic communities, file sharing sites etc. Users access the sites only if they know the exact address, but can use standard browsers such as Internet Explorer and Chrome – other browsers are available.

Decryption

Decryption is how cryptography makes messages readable again after they have been encrypted. Depending on how data is encrypted, decryption may happen automatically, or you may have to carry out a specific routine using special software.

Disaster Recovery

Disaster Recovery (DR) is most commonly seen as the provision of the IT part of a Business Continuity Plan. It’s about getting your IT systems back up and running within set timescales in order to enable key resources to work as normal.

For example, if you’ve planned to move to an alternate location in the event of an outage with your business, your DR solution will probably include appropriate network connections, having enough desktop or laptop devices available and having the relevant data and software available from the alternate location.

It’s not uncommon for businesses to run tabletop exercises to work out who would do what in the event of a problem, but it’s also a good idea to actually test that the plan works. For example, if your DR plan is to have 20 people up and running within 4 hours at the alternate site, but there are only 10 devices available for them to use at the site, then your plan will fail.

It’s important to note that when testing your plan, things not working are good things to find. It’s better to find that out during a test than when you actually need it.

DOS

Denial of Service (DOS) is similar to DDoS, but instead of being based on multiple devices acting concurrently, is based on a single device. That single device will send multiple messages consecutively at a very high rate, with the aim of overloading the target device.

Posted on

B is for…

Backup

I’ve talked about these in a previous post, but essentially backups are copies of your data or computer which you can use to replace files which are inadvertently deleted, or as an alternative to paying the ransom in a ransomware attack.

You should make backups on a regular basis, whether by simply copying your important files to another hard drive or perhaps a USB stick, or using specific software for backups. The really important bit is this though: once your backup is complete, disconnect the backup media from your computer. If your computer is encrypted in a ransomware attack and your backup media is still attached, your backup likely to be encrypted too.

When trying to decide what to backup, think about what files at most important to you, about those which you really can’t do without. That’ll probably be financial information, including mortgage and insurance, but think about your photos and videos too. Put another way, if your house was on fire what would you save first, once family and pets were safe?

Biometrics

Biometrics are used as a form of authentication. They sound really technical, but all they really mean is a physical part of your body which is unique to you. That means fingerprints, palm prints, scans of your retinas and other unique factors which you’ve probably seen in spy movies etc, like ear prints. Some mobile devices eg the latest iPhones already use fingerprint recognition, so it’s not entirely all Hollywood make believe!

Bitcoin

Probably the best known cryptocurrency, the value of Bitcoin soared towards the end of 2017, but many financial experts believe that this is a bubble which will burst soon. Created by someone called Satoshi Nakamoto – no-one knows who that really is – there can only ever be 21 million Bitcoins. Each Bitcoin can be split into 100 million units, known as a satoshi. The process of creating bitcoins is based on cryptography and maths, and is called mining.

Black Hat hacker

Taken from the old western movies, a black hat hacker is one of the bad guys. They’re the ones trying to break into systems without permission, probably either to steal data or to cause damage to the organisation. They’re the ones you are most likely to hear about in the news, often with a White Hat hacker talking about what they’ve done. (White Hats are the good guys, and there are also Grey Hats which we’ll cover later in the year.)

Block chain

Blockchain is the technology used to create cryptocurrency, but in future it will be used for much more. If you think of blockchain as a sort of bank account where every transaction is visible to everyone in the world, where it is possible to track the origin and path of every piece of currency since the currency began, but without knowing who owns each account, that’s pretty much the principle behind it.

The first ever transaction contained details of how much was spent and what account number (technically, which wallet) it went to, as well as the date and time, along with some other information. All the details were encrypted into one block.

The second transaction did much the same, but also which wallet the transaction originated in and where it ended up. When encrypted it also included the details from the first block.

The third transaction was the same, but on encryption it included the first and second block.

And so on – that’s how the blockchain was born.

One of the benefits of blockchain is that each transaction is validated by all other participants, so it is pretty much impossible to falsify a record: fraud is therefore unlikely, and provenance has an unbroken chain.

This is useful in cryptocurrency, but has many other uses too. For example:

  • When buying a house, wouldn’t it be great to have a complete list of every transaction ever carried out from land purchase to addition of a conservatory or work to fix a problem with rot, which could not be falsified.
  • When new drugs are created to treat specific illnesses and diseases, think about how beneficial it would be to hold details of all tests and their results as part of the proof that they work, and which cannot be tampered with.

Botnet

When a device has been compromised, it may be used to attack other computers over the Internet. When this is the case, it is said to be running as a bot (like a robot). When multiple bots are used to carry out a simultaneous attack, or to run in a similar way, this is called a botnet ie a network of robots.

Business Continuity

Often used almost synonymously with Disaster Recovery (DR), Business Continuity is all about making sure that your business can carry on working in the event of an issue eg power cut, loss of data, flooding. It’s not all about cyber, though cyber is a constituent part.

Most commonly people talk about Business Continuity Planning (BCP) which is all about determining, documenting and testing how you will react to something that affects your business. For example, you may have an alternate site for people to work from, or they may be able to work from home, but how do you tell people that’s what they need to do? How do you know that they will be able to access systems from the alternate location? How do you know they will have access to all the software and data they need from that alternate location?

A key part of BCP is understanding who your key assets are, and what they need to do their job. You also need to understand the impact to your business if various components are unavailable, and how long you can afford to not be working. For example, if your business only provides services through the internet, having no internet access for several days could kill your business: your BCP will set out what you will do to get back online quickly.

It’s not uncommon for businesses to run tabletop exercises to work out who would do what in the event of a problem, but it’s also a good idea to actually test that the plan works. For example, if your BC plan is to have 20 people up and running within 4 hours at the alternate site, but it takes more than 4 hours to travel to the site, then your plan will fail.

It’s important to note that when testing your plan, things not working are good things to find. It’s better to find that out during a test than when you actually need it.

Posted on

Business Continuity

This is a huge topic, one that spills out beyond the confines of cyber- and information security. Put simply, it’s all about making sure that your business can get back up and running and / or keep going in the event of some sort of disruption. 

That may be due to floods or other natural disasters, accidents eg power failure if the electricity supply is damaged by digging in the roads outside, deliberate attack eg theft of key equipment, terrorism etc. The list goes on – whatever it is that stops you getting into your offices / place of work and / or being able to work. 

Information security is based on three key tenets, namely the Confidentiality, Integrity and Availability of data. Business continuity is all about ensuring the Availability of data. 

Business continuity includes Disaster Recovery, which is generally seen as getting your IT back up and running. Business continuity also includes things like making sure your staff know where to go if they can’t get to your office, making sure key office space is available when you need it including desks and chairs, making sure that things like Health and Safety requirements at any alternate location are taken into account – and so on…

So what do we need to think about in terms of cyber security? Well, you may not have all staff working at an alternate site, and they may not be using equipment that is familiar to them. You may have had to rebuild networks and servers, but have you also made sure that users only have access to the systems and data they need access to? In your normal place of work, if you restricted access to removable media, are the same controls in place at your new location? What about physical access to your new premises? Is that controlled? If users are accessing systems using remote access solutions, have those solutions been tested to ensure data isn’t able to leak?  

Good practice would be to test your business continuity plans on a regular basis. This may be through some sort of tabletop exercise i.e. you get all interested / responsible parties together and talk through what would happen and how if there was disruption at your normal offices. This is a good thing to do, but if possible your should physically test your plans too. Try getting your staff to go to your alternate site, and see if they can do their jobs from there. That’s a great way of checking your IT and communications are in place and working as expected.

The most important thing to remember if you do test things out is that it’s OK to fail. In fact, expect to fail. It’s better to find out where any issues are at this stage rather than when you need them in anger.