mitigation starts now

Mitigation starts nowDI Daniel Lawrence, NPCC National Cyber PROTECT Coordinator

1/11/2016

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to ncscinfoleg@ncsc.gov.uk

Mitigation starts now

DI Daniel LawrenceNPCC National Cyber PROTECT Coordinator

Objectives

• Incident Handling – Are you ready?

• Reporting Cyber Incidents

• Assessment of the Incident (who takes precedence)

Incident Handling – Are you ready?

Cyber breaches and attacks over the past year:• 65% of large firms • 1 in 4 of all businesses

What is at risk?• Your money• Your data (e.g. customer details, intellectual property,

confidential emails)• Your day-today operations (e.g. customer website, internal

systems)• Your business’ reputation

The cyber threat: are you a target?

Things to think about

• Tell the organisations that can help

• Ensure you have a business continuity plan for when things go bad

• Think about messaging, both internally and externally

• Know your network and what normal looks like

• Do you know what information you are holding and how quickly you can find out what has gone?

Not just a problem for the IT department

Will require a response from staff across teams:

• Legal• HR• Communications/Media• C-level staff• Business Continuity

Incident Handling Model

• Understand the risks facing your business

• Assemble the correct team

• Understand your network topology

• Develop and test an incident handling plan

• Establish effective forensic readiness

• Ensure you have key points of contact

• Agree a decision log format

• Exercise the incident handling team

• Drive user awareness

• Agree internal and external communications & reporting structures

• Detect events as they happen

• Use data feeds to provide context

• Understand the affected asset

• Make proportionate response recommendations

• Understand the attack

• Preserve evidence

• Consider appropriate clean-up actions

• Initiate internal communications

• Activity will depend on the nature of the incident

• Implement alongside your Business Continuity Plan

• Ensure full visibility and agreement of system owner

• Ensure shared understanding on briefings

• Establish a feedback loop

• Maintain the feedback loop

• Identify when systems can be reintroduced

• Focus on preventing a recurrence

• Maintain communications

• Ensure a shared understanding of the end state

• Treat incidents as learning opportunities

• Complete relevant documentation

• Learning lessons is an ongoing process

• Consider implications for all elements of your business

• Share what you have learned – on CiSP!

Reporting Cyber Incidents & Cyber Crime

Historic / incident that has passed• Action Fraud – actionfraud.police.uk• 0300 123 2040

Crime in Action• 101 / 999

Local to National * * *

Information Sharing and CiSPNeed to Know → Need to Share

CiSP is a joint government and industry initiative to share cyber threat information, hosted by CERT-UK

Free to join – funded by UK government

Current membership stands at over 6500 individuals and under 2500 organisations

The ‘Fusion Cell’ stimulates discussion and sharing on the platform and provides all source assessment

Sharing is based on Traffic Light Protocol

CiSP produces a range of products/outputs including alerts and analysis papers for organisations

Different products for differing cyber maturity

CiSP Homepage

CiSP Environment

Private Secret

Open to every member with no restrictions

Restriction either by membership (group) or by subject (space)

All groups are private (members only) but their existence is public. Only members can view content in a private group. Secret groups are private but invisible to non-members.

Spaces and Groups

You can be anonymous…

…but think carefully if you need to be.

Discuss – Disseminate – Analyse

Structured Incident Reports

Future developments

Enhanced 2FA

A New Homepage

From the board to the frontline…

Evoke behaviour change

Cannot be done in isolation

End user / employee awareness is not the panacea…. Board level responsibility

There needs to be technical solutions as the most educated will still ‘click the link’ or ‘open the attachment’…

Top to bottom review of processes is key

Role of PROTECT is to raise awareness to those identified as being most vulnerable to exploitation.

dlawrence@cert.gov.uk

mitigation starts now

Technology

edwyn pull- starts now! led shop & prices may vary after

the keyless era starts now. - builders' hardware · the...

starts now 100 rebate - ramtech

internet computing the next generation starts from now...

black friday starts...now!

summer starts at springhill · 2016 registration now open...

planning for promotion: the clock starts now july 20, 2011

the end of the beginning starts now

healing starts now expanded edition - free preview

the future of integrated command and control starts now

now our community needs committee starts the award …

what’s next starts now - nielsen€¦ · what’s next...

your future starts now! 2011 performance training services

the future starts now - vvl: victoria's virtual · pdf...

mitigation and adaptation - the university of edinburgh ·...

prentice-hall, inc.1 chapter 18 your financial future starts...

welcome back to physics. your 5 minutes starts now

jaxport: the future starts now. jacksonville port...

your journey starts now!

mitigation of noise impact: the use of soft starts...