Collaborate Disseminate
Law firms collect, process and store vast amounts of extremely sensitive data about their clients, this when combined with a poor ‘people security’ culture and a general lack of digital security know-how, is a recipe that leaves legal compani… Continue reading Why a Cyber Attack can cost a Law Firm an Arm and a Leg
Yesterday I spoke at the R3 Summit (Resilience, Response and Recovery) in London, on the topic of Cyber Security Incident Management and response. Given the Q & A and the ensuing discussion after my talk, the attendees were particularly interested in my views on incident containment ahead of recovery. Below is a summary of what I said.
Step 2: Incident Identification
Upon initially identifying a cyber security incident, the very first question to answer is; what is the actual or potential business impact of the incident? On the face of it this can be a difficult question to answer, as the facts tend to be rather scant upon initial incident identification. However, the worse case scenario, the potential business impact, must be regarded as the actual business impact until facts are presented, through incident investigation, to prove otherwise. For example, take an online database holding 10,000 user accounts, in the space of a few hours, 20 users report via the company helpdesk that their accounts have been hacked into. Without further facts it should be assumed the entire database, all 10,000 user accounts, are compromised. This should remain the case until further facts are established to disprove which accounts have been and not been compromised. Cyber security incident investigations can take weeks to complete, and may never reach a conclusive finding on the scope of IT system or data compromise, in which case the worst case scenario must remain adopted.
Step 3: Incident Containment
Once the actual or potential business impact is understood, the next thought should be to contain the incident. The objective of containment is to limit the business impact of an incident. This is where the preparation work and the identification stage in knowing the business impact comes into play, if the potential cost and reputational damage caused by an incident, is greater than taking down business services over a period of time, then the correct business decision is to pull the plug on the service. So incident recovery may have to take a back seat for a while in order to protect the business’s overall interests. If this means pulling a plug on a busy ecommerce website, or downing an entire company network, if this course of action is the lesser of the two evils in terms of business impact, it is always the correct decision to take. Judging the business impact in knowing how long business systems need to remain down depends on Step 4.
Step 4: Incident Investigation and Forensics
As most cyber security incidents involve law breaking, whether external hackers or internal disgruntled staff, your servers and infrastructure must to be regarded as a crime scene, and so processed accordingly. There is always forensic data to collect, which may hold vital clues to the incident cause and scope, often these data clues are volatile, and can be lost if not collected quickly and correctly. Therefore any investigation and forensics work must be performed by an appropriate qualified internal or third party, while ensuring there is a legal ‘chain of custody’, in case either criminal or civil action occurs down the line. The amount of time to engage and complete computer forensic investigations can be significantly reduced, if you plan for them as part of the incident management preparation (step 1). If you do not have any qualified resource within your organisation, I recommend arranging to have a third party provided external computer forensic investigator on a retainer; typically they will provide a 4 hour call out response time.
Aside from the potential court room battles, the other primary reason to perform a proper forensic investigation is to establish the facts of an incident occurred. Without knowing the detailed facts of just how the breach occurred, you cannot know whether restored systems (step 5) will be still vulnerable or not. For example if you intend to restore systems from a backup, how do you know which backup is compromised or still vulnerable? It is imperative you know exactly when and how a cyber security incident occurred before engaging a recovery process, as in repeating an incident. there can be significant business impact, especially reputationally.
Step 5: Incident Recovery
Only once the facts of the incident are fully known, can you ensure eradication of the incident vulnerabilities and/or malware, and confidently recover systems and business services.
Step 6: Learning the Lessons
The final stage of cyber security incident management, and arguably the second most important step after the incident management preparation, is ensuring the business learns lessons from incidents. This is a healthy way to improve the business security posture, and there is nothing worse than repeating an incident.
Continue reading Cyber Security Incident Management, Response and Recovery Guidance
Continue reading Yahoo, The Largest Data Breach in History…so far
Continue reading Yahoo, The Largest Data Breach in History…so far
Cyber Security Defence
The UK is a significant player in the international cyber threat intelligence community, although a highly secretive business, the “snooping” documents leaked by Edward Snowden demonstrated how closely GCHQ works with their American counterpart agencies. When it comes to the business of protecting the UK’s critical national infrastructure, economy and businesses from cyber attacks, NATO membership trumps the EU membership every time. So I don’t believe UK citizens should be too concerned that Brexit will significantly weaken the UK’s cyber defence posture. I also don’t see that UK security agencies and services ties being cut with their European counterparts any time soon, given the common terrorist, criminal gangs, and cyber threats European countries share.
Privacy and Data Protection
Privacy is a fundamental right for all European Union citizens, and to address this right in the digital space, the EU have devised the General Data Protection Regulation (GDPR). The GDPR is a top to tails overhaul of Europe’s current Data Protection Directive (law), upon which EU member states data protection laws is based, including the UK’s Data Protection (Act) law. Europe’s existing data protection legalisation is well past its sell by date, it was drafted without any knowing or consideration of social networking, borderless cloud services, and colossal personal data collection and mining. Yet despite desperate need for digital privacy protection legalisation in Europe, the GDPR has been held up by Brussels’ bureaucratic red tape for far too many years, and it has only recently made it an agreed final draft, which is due to come into European Union law in May 2018.
The GDPR applies not just each EU member state, but any business or organisation from countries outside the European Union which stores and/or process EU citizen’s data. So from the UK perspective, despite the uncertainty caused by Brexit, my advice is for UK businesses to assume the GDPR is still going to apply, and to continue preparations to be compliant by May 2018.
Why UK will still need to comply with GDPR
I believe it is highly likely that the UK government (executive) will adopt the GDPR into UK law despite Brexit, or at the very least the vast majority of the GDPR requirements. The EU is likely to insist on the UK replicating the GDPR in law as part of the trade negotiations. Given many businesses in the UK will store and/or process EU citizen data, they still have to comply with GDPR regardless of Brexit or even client contract clauses. Finally it would be extremely emotive and controversial if UK companies were to treat and regard UK citizen privacy and personal data at a lesser degree to that of ‘foreign’ EU citizens. So I do fully expect it to be business as usual in UK on the data protection front despite Brexit. Continue reading Why Brexit will be Business as Usual for Cyber Security & Data Protection in the UK
The European General Data Protection Regulation (GDPR) was finally approved by the European Parliament this month. Coming into force in 2018, the GDPR has serious teeth with an up to 4% global turnover fine for non-compliance, and 72 hour mandatory data breach reporting amongst ground breaking data protection changes geared at improving EU citizen’s privacy rights. The new data protection regulation will have significant impact all businesses in UK, even if the UK votes to leave the EU.
News