Category: Insights

During a time of rapid digital transformation, new forms of cyber threats constantly emerge. One such threat increasing in the world of cyber security is known as ‘quishing,’ a term derived from QR codes and phishing.

What is quishing?

Similar to classic phishing strategies, quishing exploits Quick Response (QR) codes to deceive individuals into divulging sensitive information or downloading malicious software.

It involves scammers creating these two-dimensional barcodes, that when scanned, lead unsuspecting users to fraudulent websites or prompts the download of malware directly onto your device.

This form of scam capitalises on the QR code’s popularity, convenience, and the public’s growing comfort with using them for everything from restaurant menus to payment systems.

The rise in QR code related scams

The BBC recently reported that QR code related scams are continuing to rise, with instances up 14-fold over five years.

These scams are primarily orchestrated by organised crime groups and have seen a sharp increase from 100 reports in 2019 to 1,386 in the previous year, as recorded by the national fraud reporting centre, Action Fraud.

The consequences of these scams can be severe, with victims sometimes losing substantial amounts of money, which in turn finances further criminal activities. Scammers have diversified their methods, using QR codes on printed flyers, in emails, and on social media, duping people into handing over sensitive information like bank details.

There are concerns that this type of scam is underreported, and figures could be even higher. This is because people scammed out of smaller amounts of money are less likely to report. However, money may not be the sole target, with further risks of sensitive data being lifted from devices then sold on or used for more complex fraud later down the line.

How to spot and prevent quishing

To protect yourself from quishing scams, here is what to look for and preventive measures to take:

Examine the URL: Before scanning a QR code, make sure the surrounding context seems legitimate. If you can, preview the link that the QR code will direct you to. This feature is available on some smartphones and third-party QR code scanning apps.

Look for tampering: A legitimate-looking sticker or code might be placed over the original one, directing you to a malicious site. Stay vigilant about where you find these codes.

Avoid downloading apps directly: If a QR code prompts you to download an application, it is safer to go through the official app store on your device.

Use trusted QR scanners: Some apps check the safety of a website before opening it and can offer an additional layer of security.

Employ cybersecurity tools: For businesses, it’s crucial to have cyber security systems in place that can detect and block malicious web content.

Given the rise in both the use of QR codes and the sophistication of scammers, quishing is expected to become a more significant threat. Awareness campaigns are crucial, as informed users are the first line of defence against these types of scams.

Individuals need to remain cautious, especially as scammers continue to target mobile devices with QR codes in ever more cunning ways. A recent example involved fraudulent parking meter codes, an industry where QR codes are utilised frequently, leading users to pay parking fees via a fraudster’s account.

For businesses, the consequences of quishing scams can be serious, leading to data breaches, financial loss, reputational damages and eroded customer trust. As such, it remains essential for organisations to educate employees on the dangers of QR code scams and to implement systems like Web Application Firewalls (WAFs) and Secure Email Gateways (SEGs) that help in sifting out phishing attempts.

Quishing is just one of the many dangers in the cyber landscape, and both individuals and businesses must take proactive steps to guard against such deceptive practices.

By staying informed, sceptical, and utilising security tools, we can fend off the malicious intent hidden behind those seemingly innocuous pixilated squares.

Cyber security support from ESA Risk

At ESA Risk, we offer a broad range of cyber security services that can help you secure systems and data, become more cyber-aware, identify breaches, and prepare for and respond to attacks.

For advice and support on making your business cyber secure please contact us at advice@esarisk.com, on +44 (0)343 515 8686 or via our contact form.

As Black Friday 2024 approaches, the excitement for massive discounts and unbeatable deals is natural. However, it’s important to be aware that this shopping bonanza also brings an increased risk of cyber scams and fraud.

With cyber threats becoming more sophisticated, it’s crucial that shoppers stay informed and protect their personal and financial information.

According to a recent statement from the UK’s Cyber Security Chief, Richard Horne, the festive sales period now experiences a noticeable spike in cyber incidents, dubbing the event a “prime time for cyber criminals, who exploit bargain hunters with increasingly sophisticated scams”.

With victims of shopping scams losing over £11m between November 2023 and January 2024, according to reports from the GCHQ’s National Cyber Security Centre (NCSC) and Action Fraud, the importance of remaining vigilant during this period cannot be understated.

Cyber criminals continue to employ ever more ruthless tactics to exploit consumers’ enthusiasm and lowered guard during these sales.  Utilising AI platforms allows them to develop increasingly convincing scams and makes fraudulent offers even harder to detect.

Though many of these scams include fake listings for products on social media sites, the evolution of AI means whole websites can be created to list fraudulent products and steal financial information.

However, there are steps you can take to protect yourself this Black Friday:

1. Use secure connections only

Always use secure, private Wi-Fi connections when making online purchases.  You never know who might have access to your information when you use a public Wi-Fi network.

2. Update your software

Ensure your devices, including smartphones and laptops, have the latest security updates and antivirus programs installed.

3. Create strong, unique passwords

Use strong and unique passwords for all different retail sites. Consider using a password manager to keep track of them securely.

4. Employ two-factor authentication

Enabling two-factor authentication (2FA) adds an extra layer of security, making it harder for cybercriminals to access your accounts, even if they are able to access your password.

5. Beware of phishing scams

Be sceptical of emails or messages that demand urgent action, such as providing personal information or clicking on unknown links. In 2024, phishing attacks have grown more cunning, blending seamlessly into regular communications. Be wary of clicking links and downloading files.

6. Shop wise, pay safe

Be cautious of deals that seem too good to be true or with merchants demanding payment through unconventional methods like direct bank transfers or cryptocurrency. Official retailer websites and trusted payment systems offer more security.

7. Do your research

Ensure you’re shopping on reputable websites or stores. Look up reviews, ratings, and feedback from previous customers. Compare prices across different platforms to ensure “discounts” aren’t inflated prices reduced to appear like a deal.

Black Friday is an exciting time for both shoppers and retailers, by following cyber security best practices and maintaining a degree of scepticism towards online offers, you can protect yourself from becoming a statistic.

Stay alert, keep your software updated, and prioritise security over convenience to ensure a safe and enjoyable shopping experience. If you find yourself the victim of a cyber incident, ESA Risk can help you with your response to the attack and to make you cyber-secure in the future, through the design and execution of a strong cyber security plan. Contact Ben Brown, Cyber Security Consultant at ben.brown@esarisk.com, on +44 (0)343 515 8686 or via our contact form.

As cyber attacks grow more sophisticated, the need for robust security measures has never been more critical. Penetration testing, also known as pen testing or ethical hacking, is a proactive approach to uncovering vulnerabilities in IT systems and software. By simulating a cyber attack against computer systems, applications and networks, pen testers can identify and rectify security weaknesses before malicious hackers can exploit them.

Understanding penetration testing

Penetration testing delves into the assessment of computers, networks, and web applications to discover potential vulnerabilities that could be exploited by attackers. By executing controlled attacks in a safe environment, organisations can better understand the effectiveness of their existing security policies and mechanisms.

This form of testing can be conducted from within the network (internal testing) or from outside (external testing) to simulate various methods of cyber attack.

Cyber security penetration techniques

At ESA Risk, we offer a range of penetration testing services tailored to your unique needs and requirements.

One of our newest consultants, and experienced cyber security professional, Ben Brown, leverages his knowledge of advanced tools, techniques and methodologies to conduct thorough assessments and provide actionable recommendations for improving your security posture.

Our penetration testing services include:

Internal network penetration testing

Our network penetration testing services involve a comprehensive evaluation of your organisation’s network infrastructure, servers and endpoints. By emulating real-world cyber attacks, we identify vulnerabilities such as misconfigurations, weak passwords, unpatched systems, and insecure network protocols that could be exploited by threat actors.

We meticulously analyse network traffic, conduct port scanning, and assess firewall rules to identify potential security weaknesses.

Web application penetration testing

Web applications are a common target for cyber attacks due to their exposure to the internet and the complexity of their code. Our web application penetration testing services focus on identifying vulnerabilities in web applications, APIs and other web-based assets. Using a combination of automated tools and manual techniques, our experts assess the security of web applications, uncovering flaws such as SQL injection, cross-site scripting (XSS) and insecure direct object references. By conducting thorough assessments, we help you secure your web applications and protect sensitive data from unauthorised access.

Social engineering testing

Social engineering remains a prevalent tactic used by threat actors to exploit human vulnerabilities and manipulate individuals into disclosing sensitive information.

Our social engineering testing services evaluate an organisation’s susceptibility to social engineering attacks and phishing attempts. By simulating phishing campaigns, pretexting scenarios and physical intrusion attempts, we assess the awareness and response capabilities of employees at all levels to social engineering tactics. This testing helps you enhance employee training programmes, implement security awareness initiatives, and strengthen defences against social engineering threats.

Benefits of penetration testing for businesses

• Proactive defence: One of the primary benefits of penetration testing is its proactive nature, allowing businesses to identify and fix vulnerabilities before they are exploited. This can prevent severe data breaches and the associated financial and reputational damages.
• Compliance with regulatory requirements: Many industries have strict regulatory requirements that include cyber security assessments. Penetration testing helps ensure compliance with standards such as GDPR, thereby avoiding significant fines and legal implications.
• Preservation of corporate image and customer trust: By ensuring that data breaches are less likely, companies maintain their reputation and build trust with their clients. In the digital age, consumer trust is as valuable as the tangible services or products offered.
• Cost-effective security: While penetration testing requires upfront investment, it is considerably less expensive than the costs associated with a data breach, which can include legal fees, compensation, and the intangible costs of lost consumer trust and brand devaluation.

The changing landscape of cyber security

As technology evolves, so does the cyber security landscape. New vulnerabilities and methods of attack are constantly developed. With the integrating IoT, cloud computing, and other emerging technologies into daily business processes, organisations face an ever-expanding risk landscape. Today’s security systems need to be dynamic and responsive, which makes the role of regular penetration testing critical.

Staying informed on cyber risks

Cyber security is not a one-time achievement but a continuous process. Staying informed is crucial. Regular updates to security protocols, frequent penetration testing, and staying abreast of the latest cyber threats are essential practices. Businesses must invest in continuous learning and the development of IT staff to handle new and evolving security challenges effectively.

Penetration testing plays a vital role in the cyber security strategy of any business. By allowing you to identify, manage and mitigate vulnerabilities proactively, it not only protects you against attacks but also saves you from potential financial and reputational damage in the future. With the cyber security landscape continuously changing, tools like penetration testing that can adapt and evolve are priceless. Any company looking to safeguard their future in the increasingly digital world should consider penetration testing an essential tool in their cyber security arsenal.

Cyber security support from ESA Risk

At ESA Risk, we offer a broad range of cyber security services that can help you secure systems and data, become more cyber-aware, identify breaches, and prepare for and respond to attacks.

For advice and support on making your business cyber secure, including penetration testing please contact us at advice@esarisk.com, on +44 (0)343 515 8686 or via our contact form.

The landscape of cyber threats is ever-evolving – reflecting the current dominance of digital advancements (AI, anyone?) in our work and personal lives. With reports of ransomware attacks and data breaches becoming more and more common, how concerned should you be about your business’s cyber security?

Motivations behind cyber crime

There are differing motivations behind cyber attacks, though among ‘black hat’ hackers – your stereotypical cyber criminals who work to break into personal networks and devices to steal sensitive data – financial gain is the most common. A Verizon study from 2023 involving multiple countries, including the UK, revealed that the majority of data breaches (97%) were money driven.

With online hacking groups focusing their efforts where they can cause the most damage , law firms are among those considered a valuable target due to the abundance of sensitive data and privileged information stored in their networks. Once such data is obtained, it can be held for ransom and/or sold on the dark web. Sensitive data can often be lucrative in the virtual underworld.

Other motives include reputation. For some cyber criminals, it’s all about the thrill of overcoming security measures and infiltrating systems. These individuals frequently target high-profile organisations, deeming a successful breach a personal triumph. However, the consequences of these breaches can be severe, compromising customer trust and damaging a business’ reputation.

An example of this is the 2014 cyber-attack on Sony Pictures Entertainment, a breach that exposed sensitive employee data, private email exchanges and unreleased films. As a result, Sony Pictures faced extensive reputational damage, as well as significant financial loss.

More recent examples include Royal Mail, who were targeted by ransomware group ‘Lockbit’ last January, and ‘magic circle’ law firm Allen and Overy later the same year. With the hacking group taking credit for the latter attack on their website, clearly keen to claim the high-profile breach, this suggests media coverage and notoriety among cyber criminals may be another motivational factor.

Does size matter?

Though the rewards of targeting sizeable organisations are greater if successful, smaller firms are also at risk.

Cyber threats don’t discriminate by company size. In fact, smaller businesses are often seen as softer targets by cybercriminals because they assume security might not be as robust.

One of the biggest challenges companies face now comes with the interconnectedness of modern supply chains. Cyber criminals can exploit weaknesses in these supply chains to compromise multiple entities simultaneously, meaning the security of every link in the chain becomes crucial, requiring strict vetting processes and a collaborative approach.

Reducing your risks of a cyber attack

To reduce risk, companies need to implement multiple layers of security. Cyber security is not a one-size-fits-all solution. In order to create a robust defence system, you need an in-depth defence strategy, including firewalls, antivirus software, intrusion detection systems and regular security audits. This multifaceted approach ensures that any vulnerabilities are addressed at various levels, rather than ‘divide and conquer’ think ‘divide and defend’. The challenges lie in both trying to prevent these attacks, but also devising effective recovery strategies should your network and data be targeted or compromised.

While emphasis is often placed on the implementation of robust technology, cyber threats can also be largely mitigated through training, education and awareness. A proactive approach to cyber security will always be the best way to minimise your company’s susceptibility to threats from cyber criminals.

Cyber security support from ESA Risk

If you need advice or support on anything cyber security-related, contact Ben Brown, Cyber Security Consultant at ben.brown@esarisk.com, on +44 (0)343 515 8686 or via our contact form.

This article was originally published by IFSEC Insider.

Based on insights from over 5,500 physical security leaders globally, the research showed that while organisations are putting in place new processes to protect themselves, the level of concern about potential cyber threats continues to increase.

Close to a third (31%) of end-user respondents indicated that their organisation was targeted by cyber threat actors in 2023. Some sectors were far more affected than others. 73% of respondents in the intelligence and national security sector and 46% in the banking and finance sector said were the victims of cyber-attacks compared 21% in the retail sector.

In August, British perimeter security company, Zaun Ltd, was breached by the LockBit group. Despite only accessing a small fraction of the company’s internal network, the hackers appeared to have leaked sensitive documents relating to the physical security of agencies in the UK Ministry of Defence.

A top challenge faced

Cybersecurity vulnerabilities were identified by 36% of end-user respondents as a top challenge facing their organisations in 2023. In the healthcare sector, cybersecurity vulnerabilities were identified by a higher percentage of respondents than any other challenge (43%).

Organisations are, however, being more proactive with 42% of end-user respondents indicating that their organisations are deploying cybersecurity-related tools in their physical security environments. This is a significant increase compared to last year when only 27% said they had put in place processes to protect themselves.

“It is reassuring to see growing awareness of the cybersecurity of physical security systems,” Mathieu Chevalier, Principal Security Architect at Genetec said: “As more organisations look to implement enhanced cybersecurity measures, they need to look for manufacturers who are committed to cybersecurity and building tools that help them streamline the maintenance and updates of their systems.”

Cyber security support from ESA Risk

If you need advice or support on anything cyber security-related, contact us at advice@esarisk.com, on +44 (0)343 515 8686 or via our contact form.