As attacks reach critical infrastructure and public services across the UK and Ireland, ThreatLocker urges organisations to close the basic gaps that attackers still exploit and not let AI distract them.
This Cybersecurity Awareness Month, ThreatLocker®, a global leader in Zero Trust cybersecurity, has set out 10 priorities for organisations in the UK and Ireland, urging them to get back to the cybersecurity fundamentals before anything else.
With AI dominating the conversation this year, many businesses feel they must adopt ever more sophisticated defences to keep pace with ever more sophisticated attacks. Reality couldn’t be further from that: until the basics are fixed, attackers will keep getting in the same way.
In July, the UK government confirmed that hackers linked to the Iranian regime had taken a small UK gas generator offline for four days, although the Department for Energy Security and Net Zero said the wider energy system was never at risk. Weeks later, on 27 August, the National Cyber Security Centre (NCSC) warned that operational technology and edge devices across UK sectors were being increasingly targeted, with limited real-world disruption. These systems are often exposed through the same “easy routes” outlined below, highlighting the basic vulnerabilities businesses should be addressing this Cybersecurity Awareness Month.
Ireland is also facing similar pressures. In March, attackers took over an administrator account at a notable medtech firm and used Microsoft Intune’s wipe command to erase nearly 80,000 devices. Similarly, Ireland’s Department of Education lost around 607,000 contact records after a social engineering attack on its external helpdesk.
Danny Jenkins, CEO and Co-Founder of ThreatLocker, said: “October is Cybersecurity Awareness Month, and while much of the discussion will rightfully be centred on AI, we need to make sure those concerns don’t lead us to lose focus on the cybersecurity fundamentals.
“Most AI cyberattacks still rely on familiar weaknesses like stolen credentials, untrusted software and an allow-by-default approach that lets users and applications do whatever they want unless activity is later identified as a problem.”
This Cybersecurity Awareness Month, ThreatLocker urges UK and Irish organisations to focus on these 10 fundamentals:
-
Turn on Multi-Factor Authentication (MFA), but do not stop there: Require it for email, cloud applications, remote access and administrative accounts, and pair it with device verification and access policies.
-
Make stolen credentials less valuable: Use unique passwords in an approved password manager and eliminate shared accounts.
-
Remove local administrator rights: Grant access only to approved people, applications and tasks for the limited time it is required.
-
Adopt a deny-by-default approach and block untrusted software: Allow only approved software to run, define what is needed and control everything else.
-
Do not give trusted applications unlimited freedom: Control how approved applications interact with files, other applications, credentials and network resources.
-
Patch the applications attackers are targeting: Keep an accurate inventory of the software in environments to prioritise vulnerabilities that are actively exploited, exposed to the internet or present on critical systems.
-
Close unnecessary doors to the internet: Regularly review exposed ports, remote desktop services, VPNs and externally accessible administrative tools. If a service does not need to be publicly reachable, it should not be.
-
Keep attackers away from backups: Isolate them from production systems and credentials, control what can reach them and test restoration regularly.
-
Prepare employees without making them the only defence: Train staff, but design security around the assumption that someone will eventually click the wrong link, enter credentials on the wrong page or approve the wrong request.
10. Practise the response before an incident: Run exercises based on realistic scenarios such as ransomware, credential theft or the compromise of an administrative account.Jenkins added: “UK and Ireland companies should treat ransomware as a board-level issue and act proactively rather than in the middle of a cyber incident. The controls that matter the most are allowlisting, ringfencing and zero trust network access. They can limit what a hacker can access despite entering a system. Don’t make it easy for them.”From a gas generator in the UK to a medtech firm’s device estate in Ireland, the common thread is that attackers keep succeeding through gaps organisations already know about. Whatever role AI plays in the threat landscape, the organisations that have the strongest foundations in place, from controlling what can run on their systems to limiting unnecessary access, will be better positioned to prevent an attack from spreading and respond when one occurs.
