Cyber Security Monitor: October 2024

Stay one step ahead of cyber criminals with our regular news and tips

October marked Cyber Security Awareness Month – an initiative started by America’s Cyber Defense Agency and now observed globally. It emphasises the fundamentals of cyber security, which apply to organisations and individuals alike.

These are simple actions that we can all take to stay safe online. Our blog has a good summary.

And, as this month’s lead story shows, there can be devastating consequences when these basic cyber security principles are ignored.

Lax Sellafield nuclear waste cybersecurity leaves plant with £400k fine, reputation in tatters and national security exposed

As far as cyber attack targets go, this one ticks all the boxes. Sellafield is the world’s largest nuclear waste facility housing the world’s largest store of plutonium.

It had IT systems that were so poorly guarded that external contractors could plug in memory sticks without anyone noticing. And a whopping 75% of its computer systems were susceptible to cyber attacks.

This is the worrying picture that has emerged after Sellafield Ltd, a state-owned nuclear waste processing facility on the Cumbrian coastline, was fined almost £400,000 for its shockingly poor cyber security.

The criminal charges were brought by the Office for Nuclear Regulation. The chief magistrate said the case was in a category “bordering on negligence” and a “dereliction of responsibilities”.

The ONS investigation revealed that “Sellafield Ltd failed to meet the standards, procedures and arrangements, set out in its own approved plan for cyber security and for protecting sensitive nuclear information.”

A Guardian investigation last year alleged that groups close to China and Russia had used malware to hack into the plant’s systems as far back as 2015.

The ONS investigation however did not find any evidence that these vulnerabilities had been exploited.

Internet archive hacked; 31 million user details stolen

Web enthusiasts have been mourning the hacking of The Internet Archive, the world’s largest library of the internet.

This digital archive is a time machine that makes it possible to look back at snapshots of websites, digitised documents, images and books from the early days of the web right up to present times.

Created in 1996 by IT specialist Brewster Kahle, the library is popular not just with website owners but also researchers, journalists and historians.

This month saw multiple attacks on the archive, the most serious resulting in the breach of 31 million accounts. The website and its open-source catalogue of digitised books were also forced offline in a distributed denial of service (DDoS) attack. The archive was also breached on its Zendesk email support platform.

The Internet Archive is the world’s only archive of all websites ever created and there are concerns that losing it would mean that vast tracts of historical snapshots of the internet would be lost forever.

Users have been advised to immediately change their passwords to ensure they are long, strong and randomly generated.

The archive was back online at the time of writing.

We are NIS2 compliant

NIS2 is the European Union’s Network and Information Security Directive. It came into force earlier this month and aims to bolster the cyber security and resilience of European organisations that have a role in critical national infrastructure.

This European law was brought in to standardise requirements across EU countries. While the law applies mainly to the EU region, many UK businesses could also be affected.

This is because NIS2 looks more closely at organisations’ supply chains and their data security. So, UK businesses with EU partners – particularly in the fields of critical national infrastructure – could be directly affected.

Our latest blog post on NIS2 offers a good overview of the requirements and scope of this new law.

We are NIS2 compliant and our IS0 27001 and Cyber Essentials Plus certifications further underscore our commitment to robust information security compliance.

Microsoft closing the shutters on Windows 10, users advised to upgrade asap

The clock is running down on one of the world’s most popular operating systems.

Windows 10 from Microsoft will no longer be supported after 14 October 2025. This means that after this date, Microsoft will stop releasing security updates or providing technical support for its hugely popular software.

So, if you’re a Windows 10 user, these are your options:

Use the latest version of Windows 10 — version 22H2 for continued support through 2024 and until 14 October 2025.
If you still want to keep using Windows 10 after the end of support (EOS) date, you can pay for subscription-based security updates for up to three years from Microsoft.
Upgrade to Windows 11 to ensure your OS is protected with the latest security updates.
Move to a different OS such as Linux or Chrome.