October the 23rd saw the inaugural Isle of Man Government Cyber Security Conference – ‘CyberIsle 2019‘, where our CEO David Stubley was invited to speak on the subject of Business Email Compromise (BEC).

The talk covered the motivations for malicious actors looking to conduct such attacks, the anatomy of a successful attack and then three case studies based upon real life incidents that the team here at 7 Elements have managed for our clients.

The talk finished with mitigation advice that can be deployed by any organisation to reduce the risk of a successful compromise. The following document provides an overview of BEC and the core content from the presentation:

Anatomy of a BEC Attack – Release

The talk also looked at how malicious actors can gain credentials via attacks against externally facing infrastructure, such as Virtual Private Network (VPN) devices. More information on this can be found here: http://www.7elements.co.uk/resources/research/exploit-script-cve-2018-13379/

If you would like to discuss how to gain assurance over cloud based email solutions such as Office 365 then please get in touch with the team.

CYBERISLE 2019 is the Isle of Man government’s flagship cyber security event.

Hosted by the Office of Cyber Security & Information Assurance (OCSIA), CYBERISLE 2019 features world-class speakers, solutions and opportunities for interaction between the public and private sectors. The event is free to attend and will be at the Royal Hall, Villa Marina, Douglas, Isle of Man on the 23rd October 2019.

As part of the event, our CEO, Dave Stubley will deliver a talk on Protecting the Enterprise: Business Email Compromise.

Talk Introduction:

What does a successful compromise of an organisations email system look like and what can we do to protect ourselves?

A recent study by the U.S. Treasury Department revealed that business email compromise scams were costing U.S. companies more than $300 million a month, and the FBI warned that the total financial loss globally due to BEC attacks is at least $12.5 billion. Closer to home: UK’s National Cyber Security Centre (NCSC) reported that BEC attacks cost UK businesses £32 million (in 2017/18).

This talk will use real-life case studies from recent incidents to dissect the anatomy of a modern Business Email Compromise (BEC) attack, from current attack trends to mailbox manipulation and exfiltration of sensitive data through to onward compromise of new mailboxes. Building on this knowledge we will then explore easy to implement mitigation strategies.

For more information about CYBERISLE 2019 and to register, please visit the events page here.

7 Elements shortlisted in DL100 Cyber Resilience Innovation of the Year category for second year!

7 Elements are delighted that our Incident Response Partnership has been shortlisted for the second year in a row in the DL100 Cyber Resilience Innovation of the Year category. We are very proud of our incident response service and are excited by the external recognition we are gaining from our peers!

What makes our approach different? In short, no up-front costs and establishing a robust partnership model that delivers when needed. Our partnership clients only ever pay for effort that they use and based on agreed upfront costs, so that there are no unwelcome surprises.

David Stubley, CEO 7 Elements

Positive and robust cyber resilience is now a fundamental business enabler. The ability of organised criminal gangs and motivated attackers to target organisations via the Internet has increased to a level where they are capable of executing attacks with little financial outlay, that can result in huge financial gain for them, while causing both financial loss and reputational damage for the targeted organisation. Even non-targeted attacks can have catastrophic consequences and result in down time and financial loss. Having a robust approach to incident response that is both flexible and proportional is now a key requirement for any organisation doing business online. Our incident response partnership is designed to give SME’s access to the same level of incident response services as Blue-chip companies without the high costs.

Recent feedback from one of our clients dealing with a breach that resulted in financial loss:

We engaged 7 Elements to help us while dealing with a recent security issue. We found them to be extremely responsive and able to present their findings with real clarity, together with a comprehensive step by step plan. Which on implementation, allowed us to give confidence to our Board and shareholders that the issues were not only understood but that all measures had been taken to ensure that there would be no repeat in future. We would recommend anyone not to rely solely on their IT provider, but to obtain advice on security from an expert, as prevention is the best cure and compromising on cybersecurity can prove extremely costly. We continue to work with David and his team at 7 Elements and cannot recommend them highly enough.

CFO, Commercial Property Developer

If you would like to know more and get on the front foot when dealing with cyber security incidents, then get in touch with the team.

As of the 12^th April 2018, voting has now opened for each of the DL100 categories and we would like to take this opportunity to ask for your vote.

The DL100 winners will be announced at the awards dinner on the 21^st June at the Sheraton Grand in London.

More information on our Incident Response Partnership can be found here.

International Conference of Big Data in Cyber Security

Our CEO, David Stubley will be speaking in Edinburgh at the International Conference on Big Data in Cyber Security on the 31^st May 2018 at Napier University. With the threats to organisations increasing day by day, many organisations are moving towards SIEM (Secure Incident Event Management) to detect malicious activity. SIEM is now being applied in many different processes across the industry including security monitoring, incident response and cyber crime investigation.

The big data conference brings together industry, academia and law enforcement to share insights, ideas, expertise and resources in responding to current security challenges, and to look at the opportunities and challenges in managing and using big data in a cyber security context. The conference also aims to showcase a good practice in industry and network investigations.

The conference hopes to cover the following areas:

• insights into current high-profile security incidents, their impact, and how they are reported.
• impact of GDPR.
• key threats and risks associated with losing business critical data.
• leading tools, techniques and insights in network threat analysis, detection and investigation.
• best practice in implementing SIEM strategy.
• developing and testing effective incident response.
• evolution of the Security Operations Centre (SOC) and its emerging future requirements.
• the need for skills, knowledge and awareness across an organisation.
• latest research and innovation around threat discovery, machine learning, and data analysis.

David Stubley will be discussing ‘threat hunting in the Office 365 ecosystem’ at 2 pm in the Lindsay Stewart Theatre.

If you would like to know more about how we approach incident response, then please get in touch with our team.