Interview With Ivan Spencer-Phillips – Astaris

This week, we had the opportunity to speak with Ivan Spencer-Phillips, the Head Engineer at Astaris. We discussed their beginnings, what services they offer, and why do individuals and companies need a good VPN.

Private Internet Access: Please describe the story behind Astaris: What sparked the idea, and how has it evolved so far?

Ivan Spencer-Phillips: Some years ago, I was living in London, doing “break-fix” IT. Things would break at a customer site, I’d go running to fix them. It was poorly paid, highly stressful and the business wouldn’t have been able to grow past however fast I was able to zip about London on a scooter. 

The transition to be a Managed IT Service Provider took a while, but once it was done, what we wanted and what the customer wanted were aligned. They wanted reliable, secure and fast systems. They didn’t want downtime, they didn’t want to be waiting for us to get to site, scrabble around under their desks to fix stuff. By pouring in lots of engineering work up front, by putting in place business grade kit that could be managed remotely, we could deliver that, and we could deliver it much more efficiently and effectively  – all without having to run between locations all the time.

PIA: What services do you offer?

ISP: The more elements of a customer’s IT we control, the more reliable we can make it. They don’t want the internet service provider blaming the VoIP supplier for problems etc.

They want one point of contact who they can report a problem to, and know that it’s going to get fixed without further fuss from them, that it’ll be done quickly and fixed permanently.

To be able to do this, we not only look after desktops, but we look after the network, the VoIP, the internet connection, the wireless, the email, the document storage, backup, security training, software licencing etc etc.

By outsourcing their IT to us, as local specialists – it frees them up to concentrate on doing whatever it is that their business does.

PIA: Why do individuals and companies need a good VPN?

ISP: Can businesses operate without a VPN?

For the most part, yes. Those companies in the SME sector that still have on-prem line of business applications are shrinking fast. COVID has only accelerated that process.

However, just because you CAN operate without a VPN, doesn’t mean that you should. With people connecting to work systems from home, from a hotel, from a coffee shop – from anywhere that the business doesn’t have control over the network, then you just can’t tell what is going on inside that network. Is it secure? who is looking at the traffic? what data is being gathered? etc etc. All information that, from a security point of view, you probably don’t really want to be freely giving away to…well.. who knows? Not to mention the risk of employees perusing “alternative content” (ahem) on company devices. In fact, the more you think about it… the less and less of a good idea it is to operate WITHOUT a robust VPN in place.

Yes, client VPN’s used to be a complete nightmare to set up, manage and keep reliable. But that’s really no longer the case. A few minutes to set up, test and show employees how to use them is time well spent.

And if I’m a home user, my home internet service provider is furiously collecting all sorts of data on me. For “marketing” purposes and who really knows what. If I put any value on my privacy, then perhaps I don’t want them tracking me so much. A VPN might be a very good idea.

PIA: What are the worst cyberthreats out there today?

ISP: Ransomware. By a country mile.

Before Ransomware, viruses were essentially an irritation. Yes, they’d spam everyone in your address book, yes, you might have to wipe and reinstall the machine, but the long term effect was small and the cost impact wasn’t terrible.

Ransomware was a game changer. Suddenly the loss of all the data that the business needs to operate was being held hostage. For large amounts of money that had to be handed over to some of the nastiest people in the world. Make no mistake, these aren’t kids messing about. This is serious organised crime. The very last people you want to be handing money to.

If you didn’t pay, your business was in deep trouble, because without the data you couldn’t properly operate.

If you did pay, then you might not get the data back but you’re certainly on their list of “people who will pay when threatened” and they’ll try again and again.

Even leaving that aside, have they opened back doors to allow future attacks? Have they copied all your data so they can launch fraud / ID theft attacks? Now they know who you are, they know what you do, they know who your customers are etc. They’re going to go after them as well. 

The cost and impact is much higher than a plain virus ever was. And it can go on for years. A scan of your passport that was on the file system when Ransomware hit – that’s just the thing they need to try and open bank accounts in your name many months from now.

In short: Ransomware is a nightmare

Keeping it out is a 3 step process

a. Defend as far out as possible. If you’re relying on a user to NOT open an infected attachment in their Outlook, it’s much too late. Multiple defence tools, overlapping. Lots of user training.

b. Contain. If something gets in because one user gets compromised, then that user is going to have a bad day, but it must not be able to spread to other users, other systems. 

c. Recover. If the first two steps have failed, we need to be able to say “oh well, let’s roll back to yesterday”. You can only do that if you have PROVEABLY restorable backups. Not “we thought we were backed up, but when we needed them….turns out they’ve not been working for months…” (very common…)

PIA: Would you say there is enough awareness of cybersecurity among the industry and the people you work with?

ISP: It’s not their area of expertise. They just want stuff to work. Security is a three-way tradeoff between security, cost and ease of use. So expensive stuff that gets in the way of “business as usual” is unwelcome, especially for a theoretical threat. Why would I pay extra for airbags in my car? I’ve never had an accident; I don’t need them.

It’s up to IT Support providers to fit those “airbags” anyway – to roll it into their monthly service charge and package. It’s good business sense anyway. Cleaning up after Ransomware has got in takes a huge amount of engineering work, that the customer is likely to unhappy about paying – because “wasn’t the IT Support provider supposed to be keeping us safe?”. Lots of downtime, lots of hassle, lots of cost. Exactly what IT Support providers should be trying to avoid for their customers.