Call us now Email a specialist
+353 1 6420100 | info@ward.ie
  • Resources
  • Blogs
  • Insights

    Ward Solutions football competition

    They think it’s all over… it is now! Thanks to everyone who took part and who followed us on social media and subscribed to our newsletter.
    We hope you stay tuned for more competitions and especially, for more expert insight into information security and cybercrime.
    #COYBIG
    We’ll be cheering on Ireland during the following matches!
    Ireland V Poland – Sunday 29th March
    Ireland V England – Sunday 7th June
    Ireland V Scotland – Saturday 13th June
    Twitter
    LinkedIn
    Subscribe to our Newsletter

    Insights

    Win tickets to three Ireland matches at the Aviva

    Do you like winning incredible prizes? Do you like big sporting occasions where you can cheer wildly for your country? If you’re rapidly nodding your head in agreement, then read on!
    The very generous team at Ward Solutions is giving our social community the chance to win a truly amazing prize. We’re giving away a pair of premium level tickets to attend three upcoming Ireland matches taking place in the Aviva stadium.
    You and a friend could be part of the lucky crowd who gets to see the hat-trick of matches and cheer on the Irish team! Tickets are now sold-out so it’s an even more exclusive event!
    To enter, just follow/RT us on Twitter and LinkedIn and subscribe to our newsletter.
    Look for our #wardcoybig hashtag. Just three quick clicks and you could be going to three top football matches!
    The schedule is as follows:
    Ireland V Poland – Sunday 29th March
    Ireland V England – Sunday 7th June
    Ireland V Scotland – Saturday 13th June

    Closing date for entry is Wednesday 25th March. We will announce the winner on our website and on our social media channels at 12 noon so watch this space!
    Follow us now to enter!
    Twitter
    LinkedIn
    Subscribe to our Newsletter

    Insights

    Microsoft IE 11 security vulnerability: How to protect your…

    Lately, it seems as though we are dealing with new cyber-vulnerabilities and security weaknesses every couple of weeks. The latest of these hit news headlines when Microsoft publicly confirmed a security flaw in Windows 7 and Windows 8.1. This leaves Internet Explorer 11 users open to attack and makes websites vulnerable to hackers.
    The unpatched security vulnerability could be exploited in a number of ways and used to carry out malicious browser-based attacks. These include:

    • Phishing, by triggering users to access a website or click on a link
    • Hijacking a user’s browser
    • Steal sensitive information viewed by users on a website such as bank accounts, personal details, logins etc.
    • Pseudo defacement or faking damage to a website
    • Compromise of the user’s computer

    Here comes the science…
    There is a way to reduce the risk of data breach and loss of security. Website owners can carry this out by implementing “X-Frame-Options” headers on all pages of the domain. The same can be implemented for the trusted domain by choosing the “allow-from” option. The result: reduce the attack windows and mitigate the use of iframe.
    The X-Frame-Options HTTP response header can also be used to indicate whether or not a browser should be allowed to render a page in a <frame>,<iframe> or <object>.
    Protection for not so technical users..
    If you’re an end-user and are using Internet Explorer, the best way to be protected is to use another web browser, such as Firefox or Chrome, until Microsoft provides a patch.
    Stay one step ahead of vulnerabilities..
    This latest flaw is not the first and certainly won’t be the last weakness that could open up your organisation to potential harm. Our advice is to try to remain as proactive and vigilant as possible in safeguarding your business and your data against the latest threats. Feel free to contact us today to discuss how we can help you to remain protected at all times.

    Insights

    Solving new information security threats with Next Generation Firewall

    As well as the myriad of existing information security threats, many more are emerging from across the world. So on top of old threats, we also have new information security threats to be concerned about. Unfortunately, existing technologies can’t always cope with these new threats. In recent years, cybercrime has evolved and the level of sophistication of internet-based threats has increased dramatically. We believe that next generation security is the solution and below, we talk you through how it works.
    More and more frequently, hackers are preying on the vulnerabilities exposed through legitimate traffic and genuine users. Hackers are now aiming attacks at weaknesses found at the application layer in order to do some damage. Traditionally firewalls have a shortcoming in that they are network port-based, which means they have very little understanding of traffic at higher layers. They basically can’t “inspect” legitimate application traffic to see whether it is being used for normal purposes, or for an attack.
    However, new firewalls have gone up a gear in response to new threats. Known as Next Generation Firewalls, or NGFWs, these address shortcomings of previous firewalls, by providing additional functionality. This means the NGFWs can look deeper into the data that is carried by an application. This way, it can seek out known exploits, vulnerabilities and malware and find out if it is being used for an attack.
    Not only are NGFWs ready for sophisticated attacks, they are also very easy to use. NGFWs, such as those from Fortinet, are an integrated security platform. They operate at wire speed providing features like signature based intrusion prevention system. This feature uses “signatures” that match attack patterns. Other features include SSL (Secure Sockets Layer) inspection, application awareness and control. NGFWs also include traditional “stateful” inspection that characterises traditional firewalls and keeps track of the state of network connections.
    Top drivers for moving to a NGFW
    Research from 2014 showed the main reasons for moving to NGFW were increased use of social media, BYOD and more use of public cloud services such as Dropbox.
    There is a whole host of reasons to move to NGFW. Almost a quarter of organisations made the move to deal with sophisticated threat environments, such as APTs (Advanced Persistent Threats). Other reasons included consolidation of security functions, higher incidence of data breaches and security attacks.
    For organisations that are still using traditional firewalls and don’t plan to change, fear not. As an alternative solution they could add further point security solutions, for example, IPS (Intrusion Prevention System), URL filtering, antivirus of antimalware to their current firewall. Ideally they should look to replace their existing solutions with NGFW. From our team’s experience, the security and ease of use of an integrated NGFW platform outweighs the complexity and cost of multiple security platforms.
    This isn’t the end….
    Because it is such an interesting and evolving landscape, we will have more blogs for you on the topic of next generation security. Stay tuned and sign up to our newsletter to make sure you don’t miss out. Don’t forget to follow us on Twitter and LinkedIn.

    Insights

    State of the CIO – The good, the bad…

    Business and tech don’t see eye to eye, CIOs are fighting a turf war with other C-level executives and there is also an ongoing battle for tech talent. Happily, information security is a bigger priority for CEOs in 2015. So says results from the CIO.com survey involving hundreds of CIOs from various industries. Here are some of the main points:

    • On the positive side, 68% of CIOs said they have mutually shared measurable goals with other C-level executives
    • More than 75% of CIOs say they expect to collaborate on a business initiative with CFOs, COOs or CMOs
    • However, 33% of CIOs believe other departments see the IT department as an obstacle to their goals
    • 37% of business decisions-makers say the CIO is being sidelined in their company
    • 56% of CIOs expect to experience IT skills shortages in the next 12 months
    • In 2014, security was No. 8 on the CEO’s top priorities list. However, in 2015 it jumps to the 4th spot
    • However, CIOs in the retail industry are less likely to give security top priority than CIOs in some other industries
    • 23% of CIOs say that increasing cyber security will be the most significant reason for IT investments this year
    • 18% of CIOs in the retail, wholesale and distribution industries see security the same way

    You can download the full report from CIO.com here.

    Insights

    Ward Solutions predicts growth in BYOX and managed security…

    It’s 2015 and we’ve got our crystal balls out to make predictions for information security in the next 12 months.

    • More spend on BYOX
      We predict there will be an increase in spending on BYOX or mobile security in 2015 due to the volume and variety of mobile devices used by staff. The use of mobile devices continues to grow and there is added pressure on companies to accommodate this within their security policies. Appropriate security technologies and guidelines need to be put in place to enforce mobile security controls.
    • Growth of managed security services
      We predict that more companies will seek managed security services this year. In 2014, we saw our managed security services offerings grow by more than 25%. Organisations are increasingly looking to dedicated managed security service providers to outsource security services due to the cost and difficulty of managing security internally.
    • Increase in internal security incidents
      We forecast an increase in internal security incidents, either intentional or accidental from employees, or trusted third parties, resulting in more focus on insider threat programmes for companies.
    • Theft of privacy information
      Hacking is an increasing threat as very public incidents with Sony and Target have reminded us. This year, we expect theft of private information and data on devices to be one of the biggest issues facing consumers. Research shows that 92% of users store private information on their devices and loss or theft of this data would pose serious consequences. Ransomware infections which attempt to extort money from internet uses are expected to be a major concern for consumers in 2015. Last year, extremely sophisticated phishing and spear phishing targeted individuals and resulted in stolen passwords, credit card details and fraudulent eBanking activities.
    • Security for outsourced functions
      In many cases where organisations outsource functions, proper security measures do not exist. It is critical that the security policies and processes surrounding outsourced functions are in place in order to avoid breaches and data leaks.
    • More “cloud first” strategies
      When it comes to cloud, we anticipate that more businesses will adopt “cloud first” strategies in 2015 due to their cost effectiveness and agility. However, a better understanding of security issues and challenges associated with cloud computing is needed to ensure successful outcomes.
    • Move to hybrid cloud
      More companies will move to hybrid cloud, where some services are moved to cloud and others are kept on-premise. It is cost effective and a low barrier to entry to cloud computing. It also means more sensitive information can be kept on-premise while less sensitive information can be kept in the cloud.

    Subscribe to our newsletter now to stay current with all things information security in 2015.

    Insights

    7 Recommendations for Sustainable Security

    Our recommendations for a more sustainable security approach are as follows:

    • Be proactive about risks
      Adopt an ongoing sustainable risk-based approach to Information Security and threat management. Resist the temptation to be driven by vendor and industry hype. Always assess the threats, their impact and likelihood of occurrence in the context of your organisation or business in a systemic way. Make mitigation decisions based on prioritised risk.

     

    • Continuously review likely impacts
      Continuously review threats as to where they are at in their impact or lifecycle curve. Review your strategy for dealing with these threats, particularly ones that are nearing, reaching or past their peak impact phase.

     

    • Consider the lifecycle
      Consider the threats in the context of your Information System’s lifecycle. If an Information System is at risk from a threat that is due to be retired before the high impact or peak threat phase, then it does not make sense to invest heavily in best of breed niche mitigation technology. Instead, focus on accelerating the retirement of this service so that it leaves earlier in the threat lifecycle.

     

    • Reduce the cost
      Look for opportunities to reduce the cost or impact of typically more expensive mitigation solutions for these near peak, peak or past peak threats. This opportunity might lie in resource, financial costs or performance. Look for infrastructure, software, vendor and resource consolidation or overlap opportunities to reduce budget and resource usage.

     

    • Consider resources
      Review new or emerging higher impact threats so that your resources are used where they might be needed typically for newer or emerging higher impact threats.

     

    • Be agile
      Consider flexible and balanced Information Security budgeting and resourcing models to enable your organisation to deal with newly emerging threats that are a risk to your business, particularly for high risk threats.

     

    • Measure and report
      Have good reporting, intelligence and metrics – in order to facilitate your risk and lifecycle based decision making.

     
    With these recommendations taken on board, there’s no reason to be caught out when the next over-hyped security threat inevitably emerges in the new year!

    Insights

    Sustainable Security: Effectively managing the peaks and troughs of…

    The battle against cyber warfare

    Between APTs, AETs and government/political sponsored cyber warfare, it seems like every three to six months a new Armageddon style threat emerges. If you were to believe all the hype, often presented by certain media outlets and some of the less responsible quarters of the Information Security industry, new threats to information systems and digital business would be the end of the world. Unless of course you buy their “army” of expensive technology or services for the battle to prevent this slaughter.

    Despite all of these threats, digital business, information systems and technology continue to flourish. They are the key drivers and enablers for the modern and prosperous times that we live in. Why is this when these technological “comets of doom” continue to threaten the digital world we live in?

    Security threats have been around for some time

    New or emergent high impact security threats have been with us almost since Information Technology began. Before the current crop of threats, there were Viruses, Trojans, Worms, SPAM, DDoS, ransomware. Anyone remember when these emergent threats were hyped as the harbingers of doom of their respective day. Government/political and commercial sponsored spying and cyber warfare are not new or recent phenomena either, they have just been brought to the top of the agenda through revelations about the scale upon which they are happening, such as WikiLeaks and the mass surveillance exposed by Edward Snowden etc.

    Threat lifecycle

    In each case, these threats went through or are going through a typical lifecycle over time from emergence to outbreak, rising to a typically expensive peak impact followed by a sustainable, commoditised mitigation/operation. In each case the Information Security industry produced a management and mitigation strategy, usually comprising various combinations of technology, process and people.

    The initial hype phase for these threats has value to organisations and consumers in making them aware of the threat. The ongoing hype really has most value to the companies who are developing or selling the usually expensive technology, to help mitigate the issue.

    Sustainable Security: Effectively managing the peaks and troughs of threats
    Sustainable Security: Effectively managing the peaks and troughs of threats

    Non-sustainable strategy

    • A strategy of ever-increasing security spend as a percentage of overall IT spend to counter the new and ever increasing amounts of threats is not sustainable.
    • A strategy of continual ad hoc point security solution spend to help mitigate every new emerging threat is also not sustainable. This spend is not sustainable in terms of its cost, skills, resources, incremental infrastructure or reduced systems/service performance level.
    • A strategy of treating all threats similarly in terms of their risk to the business and their point in the threat lifecycle is also not sustainable as it leads to diluted finite resource and budget.

    The solution is a sustainable security strategy

    A sustainable security strategy recognises how much risk a particular threat poses to their organisation and at which point it is in its lifecycle. A CISO employing this sustainable strategy balances their “portfolio” of threat according to the current and future likely risk from these threats.

    They make their mitigation decisions by determining if, when and how to implement appropriate mitigation. They rebalance their mitigation solutions and resources, particularly after a threat’s peak impact in order to seek lower costs, less focus and requiring fewer resources. This frees up financial and resource budget to tackle relevant threats in the emergent or high impact phase.

    To help manage a number of convergent peaks from a number of high risk threats, CISOs should employ flexible spending models such as MSSP or outsourced Security-as-a-Service (SaaS) as a bridge until the preferred safeguard is adopted or as a final solution if appropriate.

    In the second part of this blog…..

    we’ll recommend a number of best practice guidelines for a more sustainable security approach.

    Insights

    2014's Media Highlights for Ward Solutions

    The team at Ward Solutions has been in the media this year on a number of occasions. Follow the links below to see the highlights.
    Business and Leadership – Ward Solutions creating 22 jobs as part of €1.8 million investment.
    Silicon Republic – IT security player Ward Solutions to create 22 jobs in €1.8 million investment.
    RTÉ – New jobs announced for Meath and Dublin.
    TechCentral – Ward Solutions creates 22 jobs as part of €1.8 million investment.
    Business and Leadership – Ward Solutions secures €120k contract with Laya Healthcare.
    Sunday Business Post – Security Watch – Why BYOD is an issue for so many businesses.
    Sunday Business Post – Fraud failures indicate industry lapses.
    Sunday Business Post – Effective encryption not implemented in many businesses.
    Sunday Business Post – ICT Security 2014 – BYOD trend at work is a fresh challenge for IT.
     
     
     

    Insights

    Ward Solutions is making the headlines…

    Silicon Republic recently published an interview with Paul Hogan, our Chief Technology Office (CTO) at Ward Solutions. The full text of the interview is below.
    “If a CIO does not maintain a strategic view, I don’t believe they could serve an organisation in the best manner,” says Paul Hogan, CTO at Ward Solutions. Security player Ward Solutions has experienced an average year-on-year growth rate of 20pc over the past two years and predicts this growth will accelerate further to 30pc per annum for the next two years. The company expects to achieve revenues in excess of €10m by 2016.
    In August, the company confirmed plans to create 22 new jobs at its Dublin and Belfast offices as part of a €1.8m investment to fund its expansion. This will bring the total headcount to 80 before the end of 2016. As well as the new jobs, Ward Solutions will be upgrading services delivered via its Security Operations Centre in Citywest, Dublin. This includes the enhancement of services such as managed security, digital forensics, e-discovery and security analytics.
    Can you outline the breadth and scope of the technology roll-out across your organisation and what improvements it will bring to the company?
    There are two ways we look at information technology in the business: firstly to support the ‘internal’ workings and secondly how we use IT to assist in delivering solutions to our clients. A solution such as a Secure Managed Service, whereby we would operate and support a full stack infrastructure for a client in a highly secure manner, would be very difficult if not impossible to achieve without a significant reliance on information technology. Other solutions that are services heavy, such as Threat Based Risk Assessments, also require specific IT solutions, and when we develop secure applications for clients, there is a vast array of software that we rely on.
    What are the main points of your companys IT strategy?
    Fundamentally IT is a business enabler for Ward Solutions and it’s pervasive for all that we do in admin, finance, sales, operations and management. Through the use of IT we look to increase business value, reduce costs, and most of all deliver excellent service and quality for our clients.
    In terms of managing IT budgets, what are your key thoughts on how CIOs/heads of technology should achieve their goals?
    Depending on the industry a CIO is operating in, there are metrics, such as per cent of a company’s revenue spend on IT, which the CIO needs to be aware of. Although this can help inform IT investments, planning and assumptions, it is important that the CIO can relate this back to specific objectives within the organisation, and articulate that at board level.
    How complex is the infrastructure, are you taking steps to simplify it?
    As an organisation that has grown rapidly over the last number of years, our IT estate has grown, as well. Having said that, we have looked to consolidate and optimise and currently operate our own ‘private cloud’ infrastructure, as well as using public and private cloud solutions from Microsoft. Although the underlying infrastructure may be quite complex, the experience to the end user – whether internal or a client – should not be. Again, if you take our Secure Managed Services offerings, there are a lot of underlying technologies and management systems that we use to keep the service running which the client is generally unaware of, but at the same time can get access to reports and dashboards showing the state of their service.
    Do you have a large in-house IT team, or do you look to strategically outsource where possible?
    All our IT is performed in-house, we do have support contracts with vendors for specific products that we use typically for third-line support. Outsourcing is a major consideration for a lot of CIOs, but not as much with us.
    What are some of the main responsibilities of your own role, and how much of it is spent on deep technical issues compared to the management and business side?
    In this role, I have had to step away from deep technical issues a number of years back to maintain a more strategic view of IT within Ward Solutions. I do believe it is important for the CIO to keep reasonably up to date with latest and emerging technologies and their potential application within the organisation, and this can be done without having to get “your head under the hood”. If a CIO does not maintain a strategic view, I don’t believe they could serve an organisation in the best manner and runs the risk of missing the bigger picture if looking at deep technical issues.
    What are the big trends and challenges in your sector, and how do you plan to use IT to address them?
    Innovation is key for us, it’s critical that we are always looking at new products and services to meet the demands of our customers. As a security services provider, the majority of these require an element of IT for delivery or support. In the area of Secure Managed Services we are constantly adding services to the catalogue which have a key reliance on IT. For example, we recently renewed our eDiscovery offering, which required a significant investment in software, servers and storage.
    What metrics or measurement tools do you use to gauge how well IT is performing?
    Firstly, we see if we can run IT to the budget allocated, but that’s not the full story. Internally, as part of our employee satisfaction programme, we would determine if IT is delivering to the expectations of our staff from all areas of the business and externally.
    Are there any areas youve identified where IT can improve, and what are they?
    There is nothing specific that stands out, however, as an organisation, we strive for continuous improvement across all areas of the business under a LEAN/six sigma programme, and that applies to IT, as well. Additionally, we are working towards the ISO 9001 certification, and we would expect to see some improvements in IT within that process.
    What other projects do you have lined up for the year, and what will they contribute to the business?​
    We are looking at deploying a new professional services automation (PSA) tool. This should make us more efficient in terms of how we run our business initially in the areas of resource utilisation and project management, which is the internal view, but also will deliver value to our clients in terms of easier ways to interact with us for service and support-related issues. In particular, we see lots of potential in running the Secure Managed Services offering in a more efficient and streamlined manner. The longer-term benefits accruing to the business would be realised when we fully integrate our CRM and finance packages, as well.
    Read the full story on Silicon Republic here.