IT Cyber Security For Our Financial Services Client
Since January 2020, Windows 7 Operating System is not supported by Microsoft anymore. This means any PCs still running the software no longer receive security updates, software updates, or technical support for any issues.
Many small businesses are not aware of the potential impact and implications of not running the latest software releases. Their approach? “If it ain’t broke, don’t fix it”. Unfortunately, this mindset will cause systems to be compromised at some point as there is no further maintenance available to protect their operating system from cyber attacks if they still use Windows 7.
On the upside, this Windows 7 end of life status has incentivised some of Espria’s clients to undertake a review of their IT systems.
Our client’s issue : an IT system vulnerable to threats
One of our clients has used the cessation of the Windows 7 platform to look at their complete IT infrastructure and ensure that it is as secure and reliable as it can be.
The team here at Espria performed an audit of their IT systems.
Several areas in need of improvement were identified, including:
-
- Multiple anti-virus products being used throughout the organisation but also on some machines!
- Different versions of Microsoft Office being utilised, including Windows 2007, and desktops running multiple Windows Operating Systems
- Windows Updates not being applied to all machines
- Large levels of spams received on a daily basis
- Many web browsers in use
- Administrative rights granted to users on their desktops
- Simple passwords used and shared amongst all users
- Remote user laptops only secured by simple passwords
- All users provided with remote access to the server, whether it was actually required by the business or not
Our solutions : new processes
Whilst the above was not causing any problems from an operational perspective, clearly this is not best practice as to how IT systems should be maintained.
Through the introduction of new processes and a small investment in hardware and software products, we were able to address each of these concerns within a short space of time with minimal disruption to the userbase:
-
Whilst the above was not causing any problems from an operational perspective, clearly this was not best IT practice.
Through the introduction of new processes and a small investment in hardware and software products, we were able to address each of these concerns within a short space of time with minimal disruption to users:
- We introduced a modern, anti-virus solution with central management, update services and reporting.
- We migrated all users to Office 365, ensuring that the same version of the Office product was used and automatic updates were carried out.
- We standardised Windows 10 operating system across all machines, performing in-place upgrades where possible or machine replacements where hardware was not suited to the new environment.
- We configured Windows 10 to perform updates automatically in the background to ensure that all users are on the latest security release.
- With the migration to Office 365, this has automatically provided a level of spam protection : only required emails are allowed to go through.
- We agreed with the business that only 2 Web Browsers should be used and removed non-supported products. We configured automated updates to ensure that the latest product versions are always present.
- We removed administrator rights from all users to ensure that their desktop environment cannot change so that no additional software can be installed.
- We introduce complex passwords to ensure a minimum level of characters, as well as password change enforcement every 30 days.
- We enabled encryption services on remote laptops prior to Windows starting so that the data cannot be accessed without an initial key being entered to allow the machine to start.
- We reviewed all remote user access to ensure it was restricted to only those that need it. In addition, a secure Firewall with VPN Services was installed so that remote users have to authenticate against the Firewall before they are given access to the network.
If your business is not up to date with IT security, your systems are at risk of being compromised.
So it’s imperative you remain a step ahead with your cyber security.
The Results
These steps have led to an improved IT offering for the business’ customers while ensuring the company is better protected against cyber attacks.
We will continue to review the installation every 6 months to ensure that the levels of protection and policies used remain adequate.
Reveal areas that need proactive, defensive or collaborative resource
One of our experts will review your current data risk, examine current governance and security controls.
We’re experts in building sustainable IT infrastructure that can scale to your businesses needs.
You may be interested in
Beyond Copilots: Why AI Agents Are the Next Competitive Advantage
AI is no longer a tactical tool, it’s becoming the engine of enterprise transformation. While copilots and other generative AI tools have helped teams work faster, the real breakthrough is happening with AI agents: autonomous systems that don’t just assist but act, learn and orchestrate entire workflows across the business. The question every executive should be asking is: “How will we harness AI to create value at scale before our competitors do?” High-performing organisations aren’t waiting. They’re embedding AI agents into daily operations and seeing measurable impact; accelerated decision-making, leaner processes and stronger financial outcomes. When markets move at digital speed, standing still means falling behind. Here’s why: So, the question isn’t “Should we adopt AI?”, it’s “What could…
Zero Trust Networking
Protecting Employees Without Friction Your workforce is your greatest asset, and your greatest vulnerability. Attackers know this, which is why phishing and credential theft remain the most common entry points. But here’s the leadership challenge: how do you protect employees without slowing them down? Zero Trust answers that question by making security invisible yet uncompromising. Employees work from anywhere, home, client sites, airports, without clunky VPNs or endless password resets. Behind the scenes, every login is verified, every device assessed, every anomaly flagged. If something looks wrong, a compromised credential, an unusual location, the system reacts…
Shadow AI: Executive Briefing on Real Risks, Business Impact and Mitigation
Shadow AI is here, and it’s growing Shadow AI is the use of artificial intelligence tools and platforms outside the oversight of IT, security, or compliance teams. This is not a hypothetical concern. KPMG’s 2025 global survey found that up to 58% of employees are using AI productivity tools daily, and nearly half admit to uploading sensitive company information to unauthorised platforms. Only 41% of employees say their organisation has a policy guiding the use of generative AI, revealing a significant governance gap. The Risks Are Real and Substantial The evidence from leading analysts and recent incidents is clear:…
Cyber Resilience in 2025: From Tick-Box to Boardroom Imperative
What the NCSC’s 2025 Review Means for UK Businesses The National Cyber Security Centre’s (NCSC) 2025 Annual Review is a wake-up call for business leaders across the UK. The days when cyber security was simply an IT concern or a routine compliance task are over. With a record number of nationally significant cyber incidents handled in the past year (more than double the previous year’s figure), it is clear that cyber risks have become a central issue for organisational survival and national prosperity. The Evolving Threat: Why Businesses Can’t Afford Complacency No sector has been spared in the latest…
Is Your MSP Really Helping You Grow — Or Just Keeping the Lights On?
There’s a moment in every business where the question quietly surfaces: “Are we getting what we really need from our IT provider?” It’s not always easy to answer. On the surface, things seem fine. Tickets are resolved. Reports arrive. There’s someone to call when things go wrong. It’s familiar. It’s comfortable. And that comfort can be deceiving. Because beneath the surface, many organisations are stuck in a service relationship that feels safe — but is actually stagnant. And here’s the truth: comfort isn’t the same as progress. For many, the idea of changing MSPs or challenging the…
The 2025 State of Ransomware: Key Insights on Attacks, Costs, and Recovery
Ransomware continues to evolve — and so must our defenses. The State of Ransomware 2025 report from Sophos presents one of the most comprehensive views yet into how organisations around the world are being impacted by ransomware attacks. Based on an independent survey of 3,400 IT and cybersecurity leaders across 17 countries, the report explores how attacks are evolving, the operational weaknesses adversaries exploit, and the human and financial tolls that follow. Whether you’re building a cybersecurity strategy or assessing risk, this year’s findings offer crucial, real-world insights to guide your response. Key Findings from…