As of January ’23, all companies and organisations within Europe have to comply with the new NIS2 directives. A major difference with previous legislation is that the NIS2 includes sanctions and the board can be held accountable if insufficient action has been taken in the area of Cyber Security. Because the guidelines of the NIS2 apply to considerably more sectors and branches, it’s important that SMEs in the Netherlands and in other European countries get their act together. In this blog you can read what you as a company must comply with and what exactly the NIS2 entails.

What is NIS?

NIS is short for Network and Information Security and is the first legislation in Europe in the field of cyber security. (The NIS has also been in force in the Netherlands since 2016 and has been converted in the Netherlands into the Wet Beveiliging netwerk- en informatiesystem [WBNI]. This guideline motivates companies and organizations to organize and tighten their digital security.) With the sharp increase in cyber-attacks, the European Commission presented a new EU security strategy in 2020: the NIS2.

Where the NIS is limited to only the large companies in vital sectors, like drinking water supplies and telecom, the NIS2 goes a step further. The NIS2 definitely will have a bigger impact on EU business. This mature version of the NIS focuses on three pillars of security:

• Security risk mapping;
• Protection and detection to mitigate risks;
• Limiting the consequences of cyber incidents.

With the NIS, many companies still get away with complying with the GDPR (AVG in the Netherlands) and other ‘basic rules’. But now that the NIS2 guidelines are in force, many companies really have to pull out all the stops when it comes to cybersecurity.

Do you want to know more about how to approach this, or are you curious how compliant your organization is at the moment? Our experts are ready to answer your questions!
Or download the NIS2 brochure.

Adopt a risk-based approach to information security.

Taking risks is a natural part of doing business. Risk management forms the basis for decisions and creates a healthy balance between threats and opportunities. Both are necessary to achieve the organizational objectives as well as possible. Risk management in the cybersecurity domain ensures that an organization’s technology, systems and information are protected in the most appropriate way and aligned with the things that are important to your organization. A good approach to risk management is embedded throughout the organization and complements the way you manage other business risks.

Risk management in security

Every organization has to do with risks. Most people are aware of the fact that you simply cannot erase or avoid every risk. It’s all about getting the balance. Risk management is the ideal process that helps make decisions with the right balance between threats and opportunities to best achieve organizational objectives. Risk management in the security domain helps with protecting data (and all concerned systems and technology) in an organization and deploying limited resources where it will have the greatest impact. You can make better decisions through risk management, but for this to happen, it must be embedded in the organisation.

Adopt a risk-based approach to information security.

Taking risks is a natural part of doing business. Risk management forms the basis for decisions and creates a healthy balance between threats and opportunities. Both are necessary to achieve the organizational objectives as well as possible. Risk management in the cybersecurity domain ensures that an organization’s technology, systems and information are protected in the most appropriate way and aligned with the things that are important to your organization. A good approach to risk management is embedded throughout the organization and complements the way you manage other business risks.

Risk management in security

Every organization has to do with risks. Most people are aware of the fact that you simply cannot erase or avoid every risk. It’s all about getting the balance. Risk management is the ideal process that helps make decisions with the right balance between threats and opportunities to best achieve organizational objectives. Risk management in the security domain helps with protecting data (and all concerned systems and technology) in an organization and deploying limited resources where it will have the greatest impact. You can make better decisions through risk management, but for this to happen, it must be embedded in the organisation.

What are the advantages of risk management?

Good risk management is about:

• the right information to improve decision making;
• helping delegate decision-making across the organization while maintaining appropriate board-level oversight;
• Providing a foundation to adapt and respond effectively to new threats and opportunities as they arise;
• Whether you are new to cyber risk management or are trying to assess the effectiveness of existing approaches, providing an accurate understanding through guidance. In doing so, you get a better picture of what a good approach to risk management looks like in the context of your organization.

Think about how employees interact with technology, systems and services

How employees deal with the various systems, networks and services within the organization is also something to think about. How are employees supported to do this in a safe and usable way? If you include this in risk management, the cybersecurity risks of the organization are further mitigated. Systems include people, processes and technology: the way cyber risk management is deployed must take into account these different elements and how they interact with each other.

Choose a cybersecurity risk management approach that fits the organization

Consider which approach to cybersecurity risk management, or a mix of approaches, is right for your organization. There are countless tools, methods, frameworks and standards to choose from. This depends on the standards or regulations that are followed within the organization, costs and/or level of knowledge. The most important part? Go for an approach that is right for your organization and that reveals good risk information about the systems and services. It is not always necessary to carry out a detailed risk assessment. Using a baseline such as Cyber Essentials to provide information about the basic controls needed is often enough to protect against most cyber risks.

Do you want to know more about the correct implementation of risk management? One of our experts will be happy to help you on your way!

There are a lot of different definitions of the word ‘hacker’ available on the internet. The most commonly accepted definition of hacker is the following: a person who uses computers to get access to data in somebody else’s computer or phone system (without permission). Of course, there are different degrees of hacking and there’s also a difference in what kind of hackers there are. For example, there are hackers who don’t mean to inflict any harm, but do fall under the definition of ‘hacker’. This blog will tell you more about the different types of hackers.

Different types of hackers and their characteristics

In a previous blog on our website you could read more about the different forms of hacking and how you can protect yourself against these cyber-attacks. But every hacker works differently. Below is an overview of the different types of hackers that exist and how they operate.

Green Hat Hackers

Green hat hackers are the rookies of the whole bunch. This type of hacker just started learning about hacking and computer security. They oftentimes focus more on gaining knowledge and improving their skills than engaging in cybercrime. Green hat hackers are seen as the group in the middle: often morally grey and not as skilled as both the white hat hackers and the black hat hackers.

Script Kiddies

Last on the list of popular hackers are the script kiddies. Script kiddies are a type of hackers that use pre-existing tools and scripts, often without a full understanding of how they work, to attack computer systems and networks. They’re called “script kiddies” because they rely on scripts and tools written by others instead of on their own expertise. This is exactly why they usually aren’t taken very seriously as hackers, or at least, the degree to which they pose a threat. This group of hackers are often students and/or teenagers.

Protect your data

There are a lot of ways to get hacked. That is why it’s of importance to protect your accounts, systems and network against the different forms of hacking. As you can read in this article, there are also ethical hackers and security experts that you can call in to test the security of your company.

If you want to know more about hackers, types of hacking or need help with the security of your company, please contact one of our experts!

Every organization should invest in cyber security, it’s the job of the CISO to present a convincing business case. A case should give insight in why an investment is necessary, but also why it’s beneficial. By adopting a “security first” perspective, compliance is often automatically covered. To properly complete this business case and help CISOs get started, we’ve set out the following steps:

1. Conduct a full audit

First, it’s important to conduct a full audit of the current security measures, the policy and any gaps or areas that need improvement. Look at where confidential and sensitive data is stored and who has access to it. Not all data have the same impact or level of risk. It’s wise to investigate this properly so you can use the available budgets as efficiently as possible. Internal threats are common and the risks of possible data leaks that are caused by it through malicious or even careless employees are often underestimated. The process of an audit is time-consuming but necessary to get a full view of the safety measures that already exist.

Want to know more about how to approach this? Our experts are ready to answer your questions.

Hackers, cyberattacks, phishing E-mails. These days it seems like half of the news is about cyber attacks. Unfortunately, these types of happenings are indeed on the rise. Since there is still a lot of uncertainty about what exactly a hacker can see or do, we will tell you more in this article.

What is a hacker?

According to the dictionary a hacker is a person who uses computers to get access to data in somebody else’s computer or phone system (without permission). This means that if you’re able to get into someone’s laptop, you’re a hacker. At OpenSight we think this definition is a little too broad. There’s a significant difference between ethical hacking and hacking with malicious intent. For example, when someone tries to enter a system solely to find vulnerabilities in said system, this is not necessarily a hacker in our definition. We distinguish different types of hackers like Grey hat hackers, White hat hackers, Green hat hackers, Blue hat hackers and Red hat hackers. Every hacker has a different method or hacks with a specific goal in mind. In the previous articles on our website, we explain exactly what types of hacking there are and how you can protect yourself against a hacker or cybercriminal.

Should you recognize one of the above signals and suspect that you have been hacked? Make sure you consult an expert! If you haven’t encountered a cyber attack yet, it’s better to be safe than sorry. Always make sure that you protect your valuable data against cybercriminals and ransomware. Want to secure your data professionally and efficiently? Contact one of our experts!

A large proportion of the working people have been working from home for the past two years. This means a large part of the business conversations and activities took place online. While this way of working had positive effects, it also opened the door for data leaks and cybercrime. In this article we’ll tell you everything about ransomware, what it is, how it works and what you can do against it.

What is malware?

Malware is an umbrella term for software like viruses, spyware, and Trojan horses. Malware usually ends up on a computer or network when employees click on a link or document that contains this software. Because many organizations’ work traffic has been from home in recent years, we are seeing an increase in malware attacks.

What is ransomware?

Ransomware is a form of malware. This form of malware ensures that people within the organization can no longer access important documents or processes that are essential to keep the organization running. Often a large ransom is demanded from the organization to regain access, hence the name. Here are some more types of ransomware that hackers can use:

• Screen locker ransomware: A form of ransomware that blocks the access to your screen.
• PIN locker ransomware: This one changes the pin code of your device, so you can no longer log in.
• Disk coding ransomware: This form of ransomware encrypts the Master Boot Record and other (file) system structures. As a result, you no longer have access to the operating system. As a result, you no longer have access to the operating system.
• Crypto ransomware: This is a pesky type of ransomware because it encrypts all user files on the disk.

How to protect your organization from ransomware?

Unfortunately, it’s impossible to completely rule out a ransomware attack. The right security software and security measurements, however, go a long way. The most important aspect on how to survive a ransomware attack is timing. The earlier you intervene, the better. The above tips help detect and combat an attack early. We’d like to emphasise it once more: regular backups will significantly reduce the impact of a ransomware attack!

Want to know more about the impact of ransomware attacks on your company or how you can better protect important data against cybercriminals? Please contact one of our experts. We are happy to help!

What is a DDoS-aanval? Perhaps one of the most asked cyber security related questions of the year. To get straight to the point: DDoS is the short hand for ‘Distributed Denial of Service’. This is an attack hackers use to temporarily take systems or applications offline. In this article we’ll take a deep dive into the world of DDoS attacks and tell you exactly how to protect your organization against such an attack.

What is a DDoS attack?

When a big amount of traffic gets send towards a network or server it hinders its operation. In the worst case the network or server stops working altogether. This is why the term ‘Distributed Denial of Service’ is used, a network or server is unable to deliver services. That’s exactly what the perpetrator wants. Unfortunately, an online DDoS attack can be staged by anyone. Whether that is to outsmart a competitor, prevent access to specific data or information or simply to nag someone out of revenge. When professional cyber criminals perform a DDoS attack it’s usually with the goal of getting money. DDoS ‘attacks’ can also be caused when too many people try to get access to a website at the same time. This often happens with concert tickets and limited offers. This does not necessarily qualify as an attack but can have the same effect.

The tips above are just a few examples that showcase how you can protect your organization against DDoS attacks. There are countless other measures you can take. Take a look at our tips to protect your business. Want to know more? Contact one of the OpenSight experts.

We often get questions about the ISO 9001 certification. In this article we’ll explain what an ISO 9001 certification is, why it is valuable to get a certification and how to get it.

What is ISO 9001?

ISO 9001 is a globally recognized standard in the field of quality management. With this certification you as an organization show that all products and services meet all the needs, requirements, wishes and specifications of stakeholders. By complying with ISO 9001 organizations show that they work transparently and reliably.

Why OpenSight ?

For an ISO certification process to succeed, the management system must fit in well with business operations and monitor the operational impact. With over 10 years of experience, our team has helped hundreds of organizations with designing and implementing different ISO standards. We work from the perspective of human and organization. Our consultants advise in a pragmatic manner and support in the design and implementation of policies and measures. Projects will run more smoothly, and we’ll answer all your technical questions. If you choose OpenSight, you choose the guaranteed technical support and knowledge that your organization needs.

Other benefits:

• Technical consulting, implementation and maintenance; all-in-one.
• A pragmatic approach with attention to people and business.
• Flexible input allows you to set the pace yourself.
• Personal support with the technical implementation of security measures.

Check out this page for more information about our certifications.

More and more large organizations and companies are getting attention from news due to them falling victim to data breaches, ransomware or cyberattacks. The Dutch Data Protection Authority reported an explosive increase in reports of a data breach in 2021. A doubling of the previous year, to be exact. The number of ransomware attacks will also increase by 33% in 2021, according to the annual report of the Public Prosecution Service. A cyberattack has become a serious threat every organization, regardless the size, must watch out for. We see a large part of the working population (in the Netherlands) fall behind. Entrepreneurs and employees are only partially aware of the consequences of a cyberattack for their company. It’s important for organizations to learn more and take responsibility for the processing and storage of their data. CIO, Marcel Krommenhoek talks about the risks of a cyber attack.

What exactly is a cyber attack?

A cyberattack refers to destroying, changing, or gaining access to (personal) data of an organization, without the permission of the organization. For example:

• Your USB stick with (personal) information of customers on it gets stolen;
• A hacker breaks into your computer network and steals (personal) information;
• Any type of ransomware.

Hackers that break into the network of an organization and acquire sensitive data are more common than often thought. To make matters worse, according to research from Cisco, about 60% of cyberattack victims go bankrupt within 3 years after the attack. How is that possible?

”Almost all organizations depend on digital data, so it has a huge impact if this data leaks or gets damaged.” Marcel explains. “We often see that a cyberattack has a long-term impact on business operations. This can result in direct operational loss, damage claims due to non-compliance with obligations or serious reputational damage. There are also considerable recovery costs and investments involved in a cyberattack so that the weak spots in the security can be closed. The combination of these matters puts the survival of the organization at risk.”

According to Marcel it’s not solely the cyber attack that causes bankruptcy. It’s the road to recovery and the associated costs that kill these companies. In the field of cybersecurity, it’s better to be safe than sorry.

Mind the gap – about closing the gap between cybersecurity and business

When we talk about making organizations more secure, we should mainly focus on closing the gap between IT and business. Especially in the coming years. According to Marcel, this starts with raising awareness among staff. Communication from IT and cyber experts can help with this. What many people don’t realize enough is that the main goal of these cyber experts is to keep the business functioning undisturbed. That’s why these experts are also of big importance for the business side of the organization. If you use that in your communication and make cyber security a common goal, new opportunities will present themselves!

Would you like to talk about the various options to better secure your organization? Contact one of our experts.