• 36

    Phishing is on the rise – what should you be doing?

    This week we are looking at the rise of phishing attacks and what we should be doing to prevent them.  Let’s start with some scary stats!. Verizon’s 2017 data breach report indicated that: 3% of users who receive phishing emails fall for them (whether via a link or an opened attachment) 15% of all unique users […]

  • 35

    Corporate Governance, IT Governance and Information Governance

    In this week’s blog, we are going to look at governance.  We are regularly asked, ‘what do you mean by governance?’ or, ‘is information governance the same as IT governance?’  There seems to be a lot of confusion and mispositioning of governance, its role and the different forms.  In this blog, we will provide some […]

  • 33

    Gap Analysis or Risk Assessment?

    We are often asked ‘should I start my ISO 27001 programme with a gap analysis or is there a better starting point?’.  The answer depends on your goals and knowledge of your current position.  This blog will look at which is best and when. When it comes to determining your need for information security controls […]

  • 27

    Key success criteria for an information security awareness programme

    In one of our recent blogs, we identified the essential role that organisation-wide awareness programmes play in addressing user-related threats to information security.  As URM has been involved in reviewing and developing countless awareness programmes, we thought it will be useful to share our thoughts on what we see as the key success criteria (as […]

  • 31

    UK Cyber Attacks on the Increase – URM

    There are a number of annual information security/cyber security reports released throughout the year, providing us with an information security/cyber security ‘picture’.  The latest to be published is The Hiscox Cyber Readiness Report 2019.  This report is interesting as it is the third version, enabling us to look at changes year-on-year and comparing like with […]

  • 29

    What is business continuity – ISO 22301?

    In a number of recent blogs, we have looked to step back and revert to ‘first principles’ on a range of subjects before deep diving into the detail.  That’s what we’re going to do here with the topic of business continuity. Let’s start by defining what is meant by business continuity: ISO 22301, the International […]

  • 26

    Information security awareness – Are the people failing the process or is the process failing the people?

    Broadly speaking, information security is held up by three pillars – People, Process and Technology.  As threats to our information security (and particularly cyber-related threats) continue to emerge and evolve, we constantly look to technological solutions to help combat these threats, e.g. firewalls, encryption, antivirus, intrusion detection systems, etc.   However, it is important to not […]

  • 23

    What to expect from the 2019 update of ISO 22301

    At the start of January this year, a draft updated version of the international business continuity management standard, namely ISO/DIS 22301 was issued.  Although international standards are updated on a regular basis, you could be forgiven for wondering why ISO 22301 and what changes are we likely to see?  ISO 22301 was the first standard […]

  • 24

    Information risk assessments – Benefits and implementation tips

    At URM, we are big advocates of adopting a risk-based approach when looking at ways in which to improve information security.  The cornerstone of this is conducting a risk assessment. There are many benefits attached to conducting risk assessments, most of which are focused around business efficiency, prioritising and targeting.  For example, the risk assessment […]

  • 22

    Magento attacks – How to avoid and recover

    With the latest attack on Magento-based web applications (JavaScript sniffing software), it is not the first time the platform has been exploited by malicious individuals.  In a previous blog, we looked at some of the past attacks on Magento and offered some advice on what organisations can do to protect their online payment pages.  Here, […]