As attacks reach critical infrastructure and public services across the UK and Ireland, ThreatLocker urges organisations to close the basic gaps that attackers still exploit and not let AI distract them.
This Cybersecurity Awareness Month, ThreatLocker®, a global leader in Zero Trust cybersecurity, has set out 10 priorities for organisations in the UK and Ireland, urging them to get back to the cybersecurity fundamentals before anything else.
With AI dominating the conversation this year, many businesses feel they must adopt ever more sophisticated defences to keep pace with ever more sophisticated attacks. Reality couldn’t be further from that: until the basics are fixed, attackers will keep getting in the same way.
In July, the UK government confirmed that hackers linked to the Iranian regime had taken a small UK gas generator offline for four days, although the Department for Energy Security and Net Zero said the wider energy system was never at risk. Weeks later, on 27 August, the National Cyber Security Centre (NCSC) warned that operational technology and edge devices across UK sectors were being increasingly targeted, with limited real-world disruption. These systems are often exposed through the same “easy routes” outlined below, highlighting the basic vulnerabilities businesses should be addressing this Cybersecurity Awareness Month.
Ireland is also facing similar pressures. In March, attackers took over an administrator account at a notable medtech firm and used Microsoft Intune’s wipe command to erase nearly 80,000 devices. Similarly, Ireland’s Department of Education lost around 607,000 contact records after a social engineering attack on its external helpdesk.
Danny Jenkins, CEO and Co-Founder of ThreatLocker, said: “October is Cybersecurity Awareness Month, and while much of the discussion will rightfully be centred on AI, we need to make sure those concerns don’t lead us to lose focus on the cybersecurity fundamentals.
“Most AI cyberattacks still rely on familiar weaknesses like stolen credentials, untrusted software and an allow-by-default approach that lets users and applications do whatever they want unless activity is later identified as a problem.”
This Cybersecurity Awareness Month, ThreatLocker urges UK and Irish organisations to focus on these 10 fundamentals:
-
Turn on Multi-Factor Authentication (MFA), but do not stop there: Require it for email, cloud applications, remote access and administrative accounts, and pair it with device verification and access policies.
-
Make stolen credentials less valuable: Use unique passwords in an approved password manager and eliminate shared accounts.
-
Remove local administrator rights: Grant access only to approved people, applications and tasks for the limited time it is required.
-
Adopt a deny-by-default approach and block untrusted software: Allow only approved software to run, define what is needed and control everything else.
-
Do not give trusted applications unlimited freedom: Control how approved applications interact with files, other applications, credentials and network resources.
