Cybersecurity Checkup & Hardening

Cyber attacks are on the rise. Many organisations are tightening their belts at the moment, looking for ways to save money. But caution those that cut from their information security budget - this is an area where organisations will never see return on investment, but they could certainly see a very large downside if they fail to prepare.

If you can’t afford to prepare for cyber threats, then you certainly can’t afford a breach.

Four in ten UK businesses (43%) and three in ten charities (30%) reported having experienced some kind of cyber security breach or attack in the last 12 months.

Take heed from those organisations who didn’t prepare adequately:

• Jaguar Land Rover
  In August 2025 a large-scale ransomware attack shut down IT operations across all JLR areas, including operations, payments, part tracking etc. As a result manufacturing has shut down at many sites, some analysts estimate losses from the attack will reach $2 billion USD ($2,000,000,000). The problem threatens to bankrupt smaller firms across the UK automotive supply chain, which would result in thousands of job losses. As of October 2025 the issue is still not resolved.

• Marks & Spencer
  Around Easter 2025 a hacking group gained access to M&S systems by exploiting a trusted third party partner - Tata Consulting Services (TCS). Once inside they wreaked havoc by deploying a ransomware attack which disrupted online sales operations for over four months. The cost of the attack was estimated around $400M USD through lost sales.

• British Airways
  In 2018 a hacking group was able to breach BA’s systems and obtain personal & financial details of customers via their website & mobile app. As a result BA were fined £20M (around $25,000,000 USD) by the information commissioners office.

• 23andMe
  Hackers reused credentials that had been exposed in old attacks to gain access to end user accounts at 23andMe. They took advantage by stealing information about DNA relatives, family trees and ancestry information. Although no financial or genetic data was stolen, the reputational damage was immense. The company was fined $3M USD by the information commissioners office. They filed for bankruptcy two years later.

• Hackney Borough Council
  In 2020 hackers deployed a ransomware attack on the council’s IT systems which disrupted all areas of council management, and stole sensitive personal data of some 280,000 individuals (including financial records, criminal records, religion, health and sexual orientation data). The ransomware attack caused significant disruption to local services (bin collections, council tax collection, benefits payments), has led to irreversible data loss and as of 2025 some council operations are still impacted.

• The NHS
  The National Health Service in the United Kingdom has been subject to many cyber attacks, most notably ransomware attacks in 2017, 2022 and 2024 which severely disrupted healthcare operations leading to real world outcomes like cancellation of appointments, surgical operations and tangible financial losses. Hackers stole patient medical records, contact details and in some cases even details about how to enter homes of vulnerable patients. Tangible costs in cyber attacks to the NHS likely exceed $140M USD, and many patients suffered in the attack indirectly through healthcare outcomes.

Our Blueprint

We here at 2099 Group believe that prevention is much better than a cure, and our comprehensive 8 pillar cybersecurity hardening blueprint can help you prepare your staff and your organisation against the evolving threat of cyber attacks.

1. Authentication hardening (“Authn”)
   1. Implement and review single sign on
   2. Introduce RBAC and time bound access
   3. Harden legacy authn systems
   4. Deploy MFA everywhere
2. Authorization hardening (“Authz”)
   1. Review of ACL & policies - Cloud
   2. Review of system permissions - workstation & domain
   3. Review of roles and service account usage
   4. Review of third party access
3. Network security
   1. Network perimeter security check
   2. OSINT review
   3. Structure & segmentation review
   4. Firewall hardening
   5. CDN & WAF implementation
   6. Endpoint security
   7. IDS/IPS systems
   8. Service mesh & zero trust configuration
4. Applications security
   1. Application review
   2. Application hardening
   3. Patch & upgrade strategy
   4. High availability & uptime boosting
   5. Email hardening
   6. Secret management
5. Data security
   1. Encryption review
   2. GDPR & Privacy review
   3. Access procedure hardening
   4. Handling procedure hardening
   5. Cloud storage review
   6. DLP systems
   7. Data classification review
6. Building resilience
   1. SDLC hardening
   2. Penetration testing
   3. Wargaming
   4. Operational readiness
   5. Monitoring strategy
   6. Incident planning & management
   7. Backup strategy
7. Training & Awareness
   1. Sysadmin training
   2. Knowledge building
   3. Creating runbooks
   4. Staff cyber-savvy awareness
   5. Remedial training
   6. Security culture
8. Accreditation & operational excellence
   1. ISO 27001
   2. UK Cyber Security Essentials Plus
   3. Other frameworks
   4. SoC deployment

Are you interested in cyber resilience services? Make an appointment to talk to one of our specialists today!