AXLR8 achieve Cyber Essentials Plus 2022-3

AXLR8 achieve Cyber Essentials Plus 2022-3

AXLR8 have now completed our audit for 2022-3. We are spending increasing amounts on cyber security every year. This puts AXLR8 ahead of most competitors in the markets in which we supply and support our systems.

The Journey

We would love to report that we flew through but let’s just say but the pre-audits were very useful. We are a great deal more secure again this year as a result. It will be even tougher next year as IASME are enhancing the standards. The bar is getting higher.

However, it does not just stop at the audit pass, like you we are bringing on new people and machines and constantly changing our networks for expansion. That means we need the changes to be within cyber security guidelines and we need to maintain constant vigilance with regular user tests and evidence software upgrades and security updates are happening.

Once again, we would like to thank RightCue Assurance for the audit and helpful guidance for maintaining standards in preparation for the tougher new audit in 2024.

Why should I care?

You would be concerned in a close proximity of someone coughing without putting their hand over their mouth or buying a meal in a restaurant where the chef did not wash their hands. You should be even more worried if you have a software supplier – especially as SaaS supplier – who does not maintain standards of cyber security that are audited by a reputable body. How could you trust them with your private data and mission critical system?

Please call 01344 776500 if you would like any details for this or if you are considering your own Cyber Essentials programme.

AXLR8-CyberEssentialsPlus
AXLR8 pass Cyber Essentials Plus 2022-3

Working Lunch with AXLR8: Public Sector

AXLR8 will be running a free series of training courses for the Public Sector covering the AXLR8 IRM (Information Request Manager) system for FOI, SAR, Reviews and Appeals and Complaints.

We hope you will find these workshops as useful as AXLR8’s commercial clients did in September’s very successful series for their industries.

The 12 sessions will run at 12:30 on Wednesdays from November 10th, 2021 to February 16th, 2022.

We run all our sessions over Zoom because of the quality of presentation and reliability. However, the feedback is that this is not possible for most public sector sites. Therefore, we will run it over MS Teams. Please be patient in the first couple of sessions whilst we find our feet using this as a webinar medium.

The agenda for the training sessions are as follows:

DayTitleAgendaAimed atDate
1Introduction – overview and definitionsWorkflow supported definitions list management of an IRUsers10th November
2Workflow KPIsDashboards, tracking IRs.Users17th November
3Logging a requestRequest creation, auto creation, adding notes, adding documentsUsers24th November 
4IRs and activities (tasks)Activities required to achieve the response to the IR.Users1st December
5Progress trackingThe calendar: Bank holidays, FOIs and SARs. Public and private notes and documents. Alerts, triggers and expediting weekend, working days and holidays. Users8th December
6Information request manager portalAccess rules, applicant blind, reports, documents and updating progress.Users15th December 
7Reviews and appealsReviews, appeals, timescales & audit. How to read audit trails, notes, history and mail attach. Users12th January 
8Public disclosure logPreparation and clean up, notes, documents, privacy. API for web presentation.SuperUsers19th January 
9Super user functions 1Data cleaning and retention, keeping your data clean, removing duplicates, DPIA and information asset register. SuperUsers26th January 
10Super user functions 2Drop down menus, lookups, labelsSuperUsers2nd February 
11Super user functions 3Report builderSuperUsers9th February
12Super user functions 4Creating new user accounts, granting and revoking access rights.SuperUsers16th February 

For more information on our Information Compliance Systems: http://www.requesttracker.co.uk/

Power cut today

There is a power problem in our area.

Telephones

The phones will still work. We have configured the RingCentral system to receive calls on selected mobiles. Client calls should be dealt with but we may be a little terse with incoming cold sales calls today.

Support Email

We will forward Support to a temporary mail box which will be monitored. So, you may receive an error message from our office server but the support email will get to the team. Some will be working at home.

Timecales

SSEN are working on it and will keep us updated. The local socials are going bonkers. Lights flickering occasionally everywhere.

Prevention

Hopefully, the problem will only last a few hours. Although we have large UPS storage, we will be looking for bigger reserve supplies for the office.

NACFB conference at the NEC

On 30th September, a team of us from AXLR8 went to our first trade show since lockdown. It was very professionally organised and run.

Great to meet up with so many clients and other potential technical and business collaborators.

The resilient commercial finance market is alive and kicking!

To learn more about how AXLR8 help your finance broker find more clients and process proposals quickly and easily, please contact us at 01344 776500 or send us an email.

Online AXLR8 refresher training

AXLR8 is just completing a very successful “Working Lunch with AXLR8” series of seminars in our Staffing Agency vertical market. The reason is that in most of those businesses staff may have changed. Staff turnover has been huge in so many industries over the last year and knowledge needs refreshing as we enter the “New Normal”. Also, many of the clients I speak to on a daily basis have been furloughed for long periods or have been performing other jobs.

Your organisation will also be considering staff knowledge retention and changes through this (hopefully) once in a century economic upheaval. Also, there is friction slowing the uptake of in-person training (expense, fear of infection, petrol shortages as I write, etc.)

Nevertheless, so many of the mainstream and offbeat metrics show that there is an uptick in all those business areas that indicate we are coming out of the downturn. Businesses that are barometers of the economy are on the up and up!

So AXLR8 will be running two more Working Lunch with AXLR8 series. One for Finance clients in October and one for Government in November. Please watch this space. We will also circulate invitations soon so we can win some space in your diary.

New Phone System

As part of our investment in customer service this year, we have revolutionised the telephone system. Having surveyed the market and seen many excellent new phone systems, we have gone with BT CloudWork. Our new numbers may come through as 0203 795 3629 or our direct dials depending upon who is calling.

You can still reach us on 01344 776500. However, we have dropped our old DDI numbers which were hardly used. They became a problem when people returned individual calls without going through the switchboard. If that person was away from their desk, the customer service was a VM or transfer.

Feedback

We would be grateful for your feedback if you have any trouble getting through to customer service. We do not want anyone in voicemail jail!

Future possibilities

The system from BT is based upon RingCentral which is up there in the (Nov 2020) Gartner Magic Quadrant with MS. Others trailing in that quadrant are Zoom, 8X8 and Cisco. So far we are pleased with the implementation and will be researching all the programmer interfaces for incoming caller identification to pop screens, etc. that we had developed over 15 years with our last (Splicecom) system which was well ahead of its time.

We are already dialling out direct from the AXLR8 Radical internal CRM system.

All calls will be recorded for training and quality purposes and the next development is to store them against the support ticket as we do with emails. That way all the information about a case is kept in the right “job bag”.

If you are planning phone integration with your AXLR8 system, please call us up. We heve been doing it for more than 20 years so you will be in safe hands.

New Finance Broker Portal User Experience

Thanks to the commercial finance intermediary clients and their teams who have helped us develop and improve this new look and feel. We hope you feel we acted on your feedback and you like the results. If your organisation has not switched your user account over to it yet, here is a video showing how it works.

AXLR8 Commercial Finance Systems
Easy to use and improves productivity

AXLR8 has been working for two years on a new set of portal development tools to create user experience (UX) – simple workflow systems that are easy to use. We have deployed them on modules of our other systems before but this is the first full systems refresh to come all the way through a year of broker feedback.

In addition to improving productivity, the new user interfaces we hope the systems are

  • easy to use
  • simple to understand
  • quick to learn (virtually no training is our goal)
  • flexible to change and evolve for your company
  • easy to pick up again after a break
  • friendly
  • secure and quick

Please judge for yourself. Watch this video.

The new interface development tools are proven in many of our systems now including the Loan Matrix (Loan Management System), Information Asset register (IAR) and the new Talent Management and Applicant Tracking Systems (ATS) from AXLR8.

Easy to use AXLR8 Portals
Easy to use AXLR8 Portals

Secure Passwords

Your passwords should be unique and memorable. If you do not read any more of this article, just remember to make your passwords from three random words.

Passwords should be…

  • long at least 10 characters
  • unique – do not use the same password for more than one purpose
  • memorable – if possible so you do not have it on a yellow sticky!
  • complex – add some numbers upper and lower case characters and some non-alphanumerics such as $, -,!,@ (special characters)
  • regularly changed
  • securely stored if stored at all. Possibly an encrypted file or a specialist recognised password vault
  • changed occasionally (changed too often can create its own security weaknesses). It is accepted that a more complex long password changed less frequently (say annually) is better than a simpler, shorter password changed frequently (e.g. every quarter).

Some of the above may conflict. The better (long, uncrackable, frequently changed, etc.) your password is, the more difficult it is to recall. Therefore, you need to record it and, unless this is done securely, that in itself becomes a security weakness. The familiar yellow sticky on the screen is dangerous but writing them all down on a piece of paper is asking for trouble.

Only secure systems should be trusted with your personal information:

  • encrypted password storage so not even the programmer of the system can read it.
  • SSL encrypted browser to server communications (padlock HTTPS:// in the URL) so that it is not compromised between your PC and the server
  • A ban on further attempts at password attempts after a small number of tries – five to ten attempts maximum.

Your information is probably already compromised

You must assume your password has already been found out and is available to many hackers. How?  Check this site to see where your details.

https://haveIbeenpwned.com

Put your email into the box and see the results showing how many sites, where you used that site, and what personal information has already been stolen and has been on sale for many months or years. Everyone should know this but we reckon nineteen out of twenty AXLR8 clients we show this to are completely unaware of how exposed they are.

Brute Force Dictionary Attack

Someone can easily guess my password?

There are hacking tools that attempt thousands of username and password combinations. Many of our servers that are open to the internet have 45,000 attempts per day which are blocked.

The way password guessing works is by using information already available to the hacker’s computer. Your name is an example so do not use your name with “123” after it. Further, your first & last name, school and many more pieces of personal information must be assumed to be known by hackers. If you have a word that is typically used in your password such as a pet name, animal, flower, place, or whatever, a “Dictionary” attack will probably find it by using a list of common words and configurations of those words. For example, Dictionary attacks are really good at words and phrases. They also check adding your date of birth and other information they have derived or purchased. Thus, if your password is made from the word Banana and your date of birth (in this example 10th November), you might make a password like “B4n4n4-1011” On the face of it, this is more than 8 characters and obeys many of the accepted rules from a few years ago.

Good dictionary attacks already have your date of birth, first pet’s name, primary school name, and many other answers to “hint” and “ID check” questions you might have entered in other sites as mentioned above.  Most know dates of birth and names of children, which are very common combinations for passwords. All know combinations of common passwords like “Secur1ty”, “pass1234”, “Password!” and “letmein” is well known. Similarly, although it is not the subject of this article, please do not keep your default firewall or blue tooth PIN as “1234” or “0000”. Also, obviously, do not make it the same as your bank PIN!

Yikes! What shall we do then?

Password reset

You should change your password now.

Dictionary attacks are very, very good at finding a word or phrase and number combination. However, they are unable to begin to guess at something you passed on the way to work, a randomly selected object in your house and a film you like or three things you saw on holiday or in a film plus your favourite actor.

Just choose three random words to make a memorable password and chuck  in some number(s)/non-alpha(s) characters.

e.g. apple sock ship might end up apple1812-$hipSocks.

Maximum password attempts is a good way to protect against such attacks.

In conclusion make sure your passwords obey the rules at the top of this page and, if you do nothing else, use three random words that only you would recall because only you saw a jaguar, a robin and a bike tyre puncture on your way to the shop this morning.

Repercussions

If it is your personal password for, say a private bank, game or subscription, you may lose money or pride. Worse is possible if someone steals your identity and commits criminal offences in your name. It is not enough to know you are not guilty. There are several cases where an innocent victim of such ID theft has been attacked by another victim of the crime. Lastly, if you are at work and responsible for other people’s data on a system and neglect your duty to create a secure password and keep it secret, you could damage many other people. This could happen if you are working on any accounts, CRM, HR system and many others.

Also, if you are an AXLR8 client running a business you have built up for years, you will need to make sure that you and your staff abide by these simple rules in a complex world.

If this raises any queries, please call AXLR8 support on 01344 776500 and we can help your Super Users with your system security and staff security training.

AXLR8 Support during Lockdown 2

We really apprciate your business and hope that our support is up to scratch. Some things may take a little longer. The reasons for this are:

  • the requests are new because your business has pivoted and we are having to work out how best to support your changed processes. For example, an event stewarding company now doing supermarket queuing, doormanagers to security, countercover to NHS work, and meny more.
  • We have a slightly smaller staff complement.
  • Some comunication is harder with the slight distancing of working at home and not seeing you in your offices.
  • Client staff turnover means we are training many new people who have not previously been so involved with the system. This has helped us identify many areas for video training and other e-learning tools which clients are trialling now.
  • Clients are asking us for more advanced help because their staff numbers have dropped. To survive, they must automate more. In many cases one or two people are left from a previous team of ten or twenty times that number.

For more information about our lockdown support service arrangements see this article.

Stay well and contact us if we can be of any assistance. Most importantly, please recommend AXLR8 if you know of people looking for systems.

AXLR8 Public Sector Code Library

For around five years we have asked government clients to share their code and some notes and tips every time they use AXLR8 APIs. There was a slow start but people are quite enthusiastic now.

AXLR8 are collating code samples so that public sector organisations do not have to reinvent the wheel every time a new organisation writes an interface to (e.g.) the PDL API. This should help codify a scheme that has been running for a while informally.

  • Would it be helpful to see examples of other people’s code as we collect permissions from similar public sector businesses using AXLR8 APIs?
  • Once finished, could we have a copy of your code for the AXLR8 Public Sector Code Library?
  1. Who will have access?
    Just the direct programmer at the public sector organisation concerned. Reciprocation of their finished code into the PSCL will be assumed/ agreed. Programmers working for subcontractors will be asked to place their code in public ownership as a condition of participation and their employer will be copied in. Most will agree it of little cost and great benefit to all. The relevant code will be kept in our support KB and has been provided by email up to now. In future, we expect to load it on a data asset register with public sector restricted access.
  2. Will it be a security breach?
    Even if you give us the raw code, we will remove the credentials and replace them with “———”, or similar.
    Even your organisation need not be identified if you wish to replace your organisation’s specific URLs with e.g. “Devshire.gov.uk”
  3. Who owns the IPR?
    I see it as Crown Copyright in 100% of cases. We have had the odd situation where a subcontractor has been less than forthcoming with the code interfacing between a public sector website and our systems and this has been one of the main motivators for this PSCL project. We have no real way to enforce this if the purchasing business do not make it a condition of the offer of work or agree perhaps a smaller fee and release the subcontractor from the obligation. However, I believe the results they achieve for such a “saving” will be more costly in the end and less maintainable.
  4. What else do we need?
    It would be helpful to others to say what CMS your system works with and provide any other notes. Perhaps some notes on what you might have done if you had more time?
  5. What if my code was not as clean as I would have liked due to the time I was given?
    Your code is brilliant. Do not worry, it will help someone and all devs know they have done the same somewhere.

Any questions or comments, please contact AXLR8 Support on 01344 776500.