Cyber Attack

Manufacturing – Cyber A Real Threat

by
Manufacturing

The manufacturing industry is becoming a prime target for hackers where their technology is being compromised resulting in significant disruption within this sector.

Make UK , the Manufacturers Organisation recently carried out a cyber security resilience survey in the UK which demonstrated varying degrees of preparedness by manufacturers.

https://www.makeuk.org/insights/publications/2019/09/06/cyber-security-and-manufacturing

The highlights of the report were as follows:-

  • 60% of manufacturers indicated that they had been subject to some form of cyber security incident
  • 41% of their customers had requested evidence of the robustness of their cyber security processes and procedures
  • 31% of manufacturers were also asked this question within the supply chain

IBM’s 2019 Global Threat Intelligence Index showed that 10% of all attacks are aimed at the manufacturing sector.

Cyber Risk 

As with most business digital transformation is underway but with this brings new vulnerabilities and threats which need to be managed. For the manufacturing sector achieving the optimum production rates is vitally important and one of the ways in achieving this is through digitisation and a greater reliance on connectivity throughout the organisation.

What are some of the main Cyber Threats in this sector?

  • The theft of intellectual property by a hacker
  • Ransomware attacks from malware
  • Phishing attacks through as a result of access via the industrial control system
  • Spam messages which when deployed on mass will impact on productivity and communications within the organisation.
  • The compromise of the firms website that may impact on their reputation should defamatory of controversial commentary be posted by a hacker.
  • Employees or customers being subject to identity theft where they have had their personal details accessed by a cyber attack. This could include bank and credit card information details that are then used to commit fraud or are sold on the dark web.

How can the sector help protect itself ? 

Cyber risk management plays an important role in combating the evolving and unpredictable cyber threats that exist and should be pro-active rather than reactive.

In tandem with this businesses in this sector would benefit from purchasing cyber insurance which provides coverage for financial loss caused as a result of unauthorized access of their computer systems. More important it also provides incident response services from an established vendor panel drawn up by insurers.

Irrespective as to how cyber threats are managed it important that this given the correct level of priority at board level so that the right attention and appropriate resources are utilized to protect the well being of the organization.

Image : Shutterstock

The Cyber Threat to Critical Infrastructure

by
Cyber Threat

The operation of Critical Infrastructure in the UK is pivotable in the safety and economic prosperity of the country…. but what protection is being provided to mitigate the cyber threat posed by hackers ?

We are seeing increasing threats to key infrastructure such as airports and power stations with the cyber threat now emerging as a very real risk. This concern is also now at the forefront of governments on both sides of the Atlantic with initiatives being put in place to protect our critical infrastructure.

Europe – The Network and Information Systems (NIS) Directive 

The European Commission agreed to implement the Network and Information Services Directive in late 2015 as reported in our post http://cyberbrokers.co.uk/cyber-security/   

This Directive needs to be complied with by May 2018 however according to a report by Corero Network Security suggests that it may prove difficult for certain sectors of the UK’s critical infrastructure to achieve this. The report found that 39% of the critical infrastructure in the UK did not reach basic cyber security standards. Key sectors were the NHS and the police.

https://www.corero.com/company/newsroom/press-releases/uks-critical-infrastructure-skipping-basic-cyber-security-checks-and-ignoring-ddos-threats-/

The main reason for the Directive is to increase the security of Network and Information Systems within the European Union with the aim to bring the following:-

  •  Minimum standards of cybersecurity for banks, energy, transport , health and water utilities.
  •  EU-wide rules on cybersecurity.
  •  Cooperation between EU companies on cyber security
  •  The sharing of information of breaches
  •  Best practices in cyber security
  •  Mutual help in securing a country’s critical infrastructure

In addition to critical infrastructure these regulations will apply to certain technology firms and it is possible that this will also be applicable to major online marketplaces, such as eBay and Amazon, and search engines such as Google.

Last month the Government launched a consultation paper which sets out the proposed implementation in the UK which will also reflect the UK departure from the EU. The consultation will ascertain the views from industry, regulators and other relevant parties

The consultation will cover the following :-

  • The essential services the directive needs to cover
  • The possible penalties that could be applied
  • The authorities that will regulate and audit specific sectors
  • The security measures that will be imposed
  • Appropriate timelines for incident reporting
  • Assessment of the impact on Digital Services Providers

https://www.gov.uk/government/consultations/consultation-on-the-security-of-network-and-information-systems-directive

USA – Homeland Security – The Presidential Policy Directive /PPD-21

The main purpose of this directive is to provide the provision of strategic guidance and to promote the security and resilience of the US’s critical infrastructure.

Within this directive Homeland Security will support the following:-

  • Identify and prioritize critical infrastructure, considering physical and cyber threats and vulnerabilities.
  • Maintenance  of national critical infrastructure centers in order to provide a situational awareness capabilities  about emerging trends and imminent threats
  • The coordination of appropriate bodies and Federal departments to provide analysis, expertise, and other technical assistance to critical infrastructure businesses
  • Facilitate the exchange of information and intelligence necessary
  • Work to improve the resilience of critical infrastructure against cyber threats
  • Annual review of the protection required by statute to protect national critical infrastructure.

The critical infrastructure of a country’s is a prime target for hackers and it is therefore essential that appropriate cyber security standards are in place and that this continues to keep place with the changing cyber threat landscape.

Image : Shutterstock

Are You Prepared For A Data Breach?

by
Data Breach

Are you prepared for a Data Breach ?

Every business should be prepared for a data breach …… hackers act indiscriminately and any business could be a legitimate target.

An incident response plan is essential part of the jigsaw in managing cyber risks and does play a very important role in being prepared for a data breach.

The plan should be constantly updated on at least an annual basis with consideration given to the following:-

  • Breach experience of a businesses peer group
  • Independent third party review of the incident response plan
  • Tabletop exercises to ensure effective implementation of the plan
  • Appropriate employee training
  • Crisis management scenarios played out in order to address changing cyber risk landscape
  • Ensure that effective communication is practiced at all levels of the business in the event that the plan becomes operative.

What makes a good Incident Response Plan?

1.Buy in of implementation of plan by all relevant stakeholders to include the legal team , IT , risk management , HR    Public relations and facilities management.

2.Board level support lead by CISCO.

3. An on-going synopsis of cyber threats to the business so the plan can be adapted or revised

4. Assessment of any third parties cyber exposures that may impact on the businesses with checks carried out on their own cyber risk posture.

5. Minimum security standards implemented with third party providers

6. The purchase of cyber insurance to support the business and avail assistance of insurers incident response team of professionals.

The Experian Data Response Guide is an annual report that provides plans and processes to implement when a data breach occurs within a business.

The most recent report shows that the awareness is now at a much higher profile that it ever has been with senior management more involved with being data breach prepared. There is still however a lack of confidence in actually being able to manage a data breach. The report also showed that incident response plans were not regularly updated with 35% of businesses not updating this since the plan was first instigated. It was also discovered that very few businesses have a “dry run” to see how the plan would work in practice.

http://www.experian.com/assets/data-breach/white-papers/2016-2017-experian-data-breach-response-guide.pdf

The stakeholders of the incident response plan need to be at all levels from senior board members, finance and HR directors and employees representing different sectors of the business.

General Data Protection Regulations (GDPR)

The GDPR comes into force on 25th May 2018 and with this brings an obligation to protect personal data of individuals with the onus to report any data breach that may impact on such individuals.

It is important therefore that businesses have robust systems in place to manage the appropriate handing of data but also how cope with a data breach should this occur.

This includes who to report the breach to and what to report and make reference to such matters as the nature of the breach, the consequences of the breach and measures taken to address the breach. Systems therefore need to be in place so that this information can be provide to the ICO or other relevant regulatory body.

Experian Data Breach Resolution and Ponemom Institute released an industry study on 27th June this year which revealed that whilst most businesses are aware of global and data security regulations they have not yet have addresses the necessary organizational changes in order to achieve compliance.

The study carried out on 550 IT security and compliance officers entitled “Data Protection & Regulations in the Global Economy” ascertained that only 32% of the respondents still didn’t have an incident response plan in place. Furthermore only 9% of business stated that they were ready to comply with the GDPR next year with 59% stating that they did not know how to comply……

https://www.experianplc.com/media/news/2017/experian-data-breach-resolution-and-ponemon-institute/

Cyber Insurance

Cyber insurance can help with managing and mitigating a data breach, the following services are included when a cyber insurance policy is purchased :-

  • Legal assistance in notifying data subjects that may have lost data
  • Forensic Investigation is provided to help ascertain how the breach was caused and if the hacker is still able to infiltrate the computers systems.
  • Public Relations to help manage the impact that this might have on the public’s perception of the breach.
  • Credit Monitoring services to monitor individuals bank accounts should their date be used to carry out fraudulent transactions.

The appointment of such specialists on an individual basis can be very expensive and it is worth considering this form of insurance for this reason alone.

To sum up an incident response plan is a key piece of armoury to help protect a business from the consequences of a data breach and should be an integral part of the overall cyber risk management procedures and practices.

 

Image : Shutterstock