Categories
Cyber security

Certificate, protocol & cipher management

Online services and remote access platforms have become common place, with more and more sensitive information being made accessible via these tools, it is more important than ever to protect these services from interception, manipulation and impersonation; the primary control in this space is ensuring only services intended for public use are exposed to the […]

Categories
Cyber security

GEANT courses on client privacy and security

Later this month GEANT will be running a series of five webinars which are open to all of Jisc’s members. These are particularly relevant to systems and network administrators, but may be of general interest to a wider audience. Web browsers Security & Privacy – secure surfing with less traces: 21/09/2020 Email Security & Privacy […]

Categories
Cyber security

A morning in the life of a Cyber Essentials assessor

Grabbing my morning coffee, I log in to the Jisc Cyber Essentials Pervade portal and see I have 3 Cyber Essentials assessments to mark today https://www.jisc.ac.uk/cyber-essentials. That shouldn’t take me too long, if the applicants have been clear and detailed in their responses. I need to have a good understanding of their estate to award […]

Categories
Cyber security

Hitting DMARC! Phishing emails can easily spoof University and College domains: DMARC and NCSC Mail Check are here to help

Guest post by Tom S Academia lead – The Mail Check Team NCSC Active Cyber Defence Cyber security is improving in many areas, but the adoption of DMARC anti-spoofing is still too low. NCSC tools and tips gathered from around the community can help as this guest post from Tom S, Academia lead in NCSC’s Active […]

Categories
Cyber security

Ransomware in the Education Sector

Throughout 2020 we have seen different types of ransomware utilising various attack methods and operational techniques to infiltrate networks. The types seen include: RYUK, Ouroboros, Cryakl, rEvil, Mapo and Corona-lock. One common initial infection vector has been malware such as TrickBot (commonly seen within a triple threat vector alongside Emotet and RYUK). While infection via […]

Categories
Cyber security

Electronic Signatures

Electronic signatures, or e-signatures, are a means of signing documents in the same way that documents and agreements are signed using a written signature on hardcopy documents. Electronic signatures can come in any form that the parties to a contract agree on, but in general fall into three distinct categories. Simple e-signatures These are direct […]

Categories
Cyber security

Tips on Zoom safety

The Janet Computer Security Incident Response Team (CSIRT) would like to bring to your attention some recent reports in relation to Online Video Conferencing Platforms we have seen. Due to the restrictions related to Covid-19, the use of online video conferencing has seen a significant increase and understandably, organisations are trying to facilitate as many […]

Categories
Cyber security

Culture, Media and Sport Committee Enquiry into Cybersecurity

Shortly after the recent attacks on TalkTalk the Culture, Media and Sport Committee decided to hold an inquiry into the circumstances surrounding the data breach, but also the wider implications for telecoms and internet service providers. This raised a number of issues around the premature speculation around the causes of the incident, cybersecurity within the telecoms industry, and the […]

Categories
Cyber security

TalkTalk and Encryption

In the week since the TalkTalk breach there’s been commentary on encryption of data, particularly with their CEO’s comments that they were not legally required to encrypt data. Of course encrypting the storage of data at rest is a common sense control against a range of threats such as physical theft or loss of the […]

Categories
Cyber security

Incorporating Cyber Essentials into your ISO 27001 ISMS

A brief post this time on my thoughts as to how best integrate certification to the Government’s Cyber Essentials scheme into an ISO 27001 ISMS. I’m going to intentionally stay away from how to achieve certification to Cyber Essentials, and just focus on how it might sit within your ISMS. Assuming that you’ve identified a good business […]