UK Cybersecurity Guidelines

The UK government has issued details of its Cyber Essentials Scheme to assist organisations with their cybersecurity measures. The scheme allows organisations to apply for one of two levels of cybersecurity “badge” certification:

• Cyber Essentials – requires organisations to complete a self-assessment questionnaire (to be marked by an independent external body); or
• Cyber Essentials Plus – the organisation’s systems are tested by an independent external body.

Obtaining and marketing the cybersecurity badge should demonstrate confidence in that organisation’s cybersecurity measures to consumers and the public. The cost of obtaining a badge will depend on the certifying body. Companies bidding for certain government contracts will have to be certified in accordance with the Cyber Essentials Scheme from 1 October 2014.

The Cyber Essentials Scheme documents can be downloaded at: www.cyberstreetwise.com/cyberessentials/#downloads.

Cyber Security Directive And General Data Protection Regulation

Additionally, the new Network and Information Security Directive, known as the Cyber Security Directive, sets out cybersecurity requirements applicable to certain market operators and information system providers. It is likely to come into force in 2015 or 2016. European countries will need to implement legislation to give effect to this directive, which can take up to an additional two years. There are also similar obligations to take security measures for all organisations that process personal data under the new General Data Protection Regulation, which is also expected to come into force in 2015 or 2016 (and will be directly effective soon after, without the need for each European country to implement local legislation). A breach of the General Data Protection Regulation can expose the organisation to a potential maximum fine of the greater of EUR 100 million or five percent global turnover.

Cyber Essentials Scheme

The scheme focuses on Internet-originated attacks against an organisation’s IT system (recognizing that many organisations will need to implement cybersecurity measures for the other services they provide). Organisations should conduct cybersecurity risk audits and take steps to mitigate against these risks.

The five key controls (identified by CESG, the information security arm of GCHQ) of the Cyber Essentials Scheme are:

• Boundary firewalls and Internet gateways;
• Secure configuration;
• Access control;
• Malware protection; and
• Patch management.

The government believes that organisations can mitigate against the damage caused by cyber attacks and reduce the risk of a phishing or hacking attack if they implement Cyber Essentials and also continually review their cybersecurity risks.

Key Cyber Threats

The key cyber threats facing organisations are:

• State-sponsored hackers – to obtain corporate confidential information, trade secrets or intellectual property or to cause damage through sabotaging critical infrastructure;
• Organised criminals – to obtain personal identification or payment information to steal monies or commit fraud;
• Hacktivists – for perceived status or kudos from the hacking communities or for social or political ideologies;
• Organisations – to obtain corporate confidential information, trade secrets or intellectual property for competitive advantage or to sell to competitors;
• Current or former employees – for financial gain or for grudge-related reasons.

The specific cyber threats for a particular organisation will depend on the nature of its business and the type of information held by it. Organisations should also consider taking out insurance coverage to reduce the financial consequences of a cyber attack.

What To Do If An Organisation Is Cyber Attacked

The key to minimising the impact of an attack is detecting it quickly. Many organisations are unaware they have suffered an attack until sometime after the incident, occasionally when sensitive information is published in a blog or a website. As soon as an attack has been detected, organisations should:

1. Implement an Incident Response Plan

Organisations should have an Incident Response Plan ready for when an attack is made. A Technical Incident Response Team should already be primed to step-up and deal with an attack and to implement the Incident Response Plan. The Team should liaise with senior management, shareholders, lawyers and independent cyber experts as necessary being contacted to deal with the attack as soon as possible. The goal should be to minimise any disruption to the business and to maintain consumer confidence.

A forensic analysis of the attack by cyber experts, to determine the scope of the damage and the risk of another or an ongoing attack, should be conducted as quickly as possible. Insurance providers may need to be notified. Lawyers may need to be instructed to safeguard evidence, conduct or assist with internal investigations and prepare to defend the organisation against claims and also to deal with notification obligations (see below).

2. Comply with notification obligations

Some European countries have current obligations to notify data protection authorities about personal data breaches. (In the UK, only some organisations such as Internet service providers and telecommunications operators must notify the UK data protection authority within 24 hours of a breach.) After the new General Data Protection Regulation is in force, all European data controllers will have to notify the data protection authority about a breach incident which compromises personal data without undue delay. There are parallel obligations under the proposed Network and Information Service Directive (although Internet service providers will now be excluded from this obligation). Other regulatory bodies may also need to be notified. In some instances, individuals whose personal information has been compromised may or should also be notified.

3. Issue a PR statement and social media messages

Public statements, across all forms of media, should be issued to reassure consumers and stakeholders, to preempt a potential backlash and to regain confidence in the organisation.

Continual Review Of Cyber Attack Risks

The government’s Cyber Essentials Scheme is a useful starting point for organisations who are only recently, or who have not started, to consider cybersecurity risks to their businesses. Cybersecurity professionals view the chances of businesses becoming victims of a cyber attack as being almost inevitable. According to UK government research, 87 percent of small firms in the UK experienced a cybersecurity breach in 2012. Ninety-three percent of large firms were also targeted. Some incidents caused more than £1 million in damages.