Katie Shanahan

What common misconceptions are there around cyber incident response? 🤔 We spoke to Cyber Incident Responder, Vanessa Horton, on the most common misconceptions: The big one is the [misplaced] belief that ‘it’s not going to happen to us’. Many organisations believe they won’t suffer a cyber incident, even if other organisations might. That’s a poor mindset to have because, for one, it’s wrong – everyone will suffer an incident at some point. But more importantly, this mindset leaves organisations unprepared for when they do suffer that breach, and haven’t got an incident responder on hand to keep the damage to a minimum. The fact that some big names have ‘been done’ recently shows how nobody’s safe. Not even big cyber threat actors! For example, not so long ago, LockBit [an infamous ransomware gang] got taken down. And various other ransomware groups, including Ragnar Locker and Black Basta, suffered the same fate. It just goes to show that no one’s above being successfully attacked. That’s just the unfortunate reality. Read more from our 'A Practical Guide to Cyber Incident Response' with Cyber Incident Responder, Vanessa Horton 👉 https://ow.ly/8u9e50S44nY #CyberSecurity #IncidentResponse #CyberIncident #Infosec

5

Latest updates on the Global Outage & CrowdStrike Lawsuit: 1) CrowdStrike Faces Lawsuit CrowdStrike has recently been sued by its shareholders, accused of making "false and misleading" statements about its software testing processes. The lawsuit alleges that these inadequacies contributed to the global IT outage. Despite these claims, CrowdStrike is vigorously defending its position, maintaining that its testing processes are robust and transparent. 2) Delta's Pursuit of Damages Delta Air Lines, one of the major corporations affected by the outage, has announced its intention to seek damages. Delta stated that it had "no choice" but to pursue compensation, highlighting that CrowdStrike's response—offering free consulting advice—was insufficient to address the widespread disruptions caused. 3) Public Outcry Over 10$ Apology Voucher Adding fuel to the fire, CrowdStrike's attempt to placate affected customers with a $10 apology voucher has been met with public criticism. Lawmakers and industry experts have described this compensation as inadequate, especially given what some are calling "the largest IT outage in history." This event can’t be treated in isolation. Cyber attacks from hostile states, massive system failures in the last month and recent Post Office scandal serve as a wake up call for the businesses and the government to increase their investment and oversight of Cybersecurity, underscoring the need for more robust cybersecurity measures and focus on operational resilience. The importance of building digital trust and ensuring system resilience cannot be overstated. Proactive measures rather than reactive ones are key, such that the businesses and governments embed operational resilience and cybersecurity into their core infrastructure. This situation provides an opportunity to address the critical issues surrounding cybersecurity and resilience. Here are three steps that businesses and governments should focus on to restore trust and enhance digital resilience: 1. Increased Cyber-Resilience and Media Literacy: Cybersecurity should be an integral part of our national infrastructure and education systems. Prioritizing the development of cyber-resilience and media literacy from a young age is key 2. Increased Involvement of Board and Senior Management in Resilience agenda: To ensure accountability company boards should include members specifically responsible for cybersecurity and operational resilience. This accountability will foster a culture of security from the top down. 3. Full Transparency with major Third Parties: Transparency between Businesses and their major third-party technology providers is key. As technology plays an ever-increasing role in our daily lives, clear communication and accountability are vital. Check out more from BCS, The Chartered Institute for IT and Rashik Parmar #digitaltranformation #crowdstrike #trust #itoutage #publicspeaking

12

Cyber Incidents: What exactly should organisations be monitoring? 🤔 We spoke to Cyber Incident Responder, Vanessa Horton, for her advice on what organisations need to be monitoring: Security events. These are just everyday events on your systems or networks – logins, incoming emails, files received, and so on. So, for example, if you suddenly get someone logging in from Russia, and they weren’t on a business trip there or something, you need to investigate. This means you’re not just tracking the logins themselves, but also certain information about them – locations and IP addresses, login times, files or services accessed, and so on. Again, you have to know your baseline. What is expected activity? And if it’s unexpected, someone must quickly investigate. If a threat actor did gain access to a user’s account, you want to prevent them from accessing anything else. Equally, if it’s just someone who’s on holiday in Russia and decided to log in, you can dismiss the security event. But you must establish that in your initial follow-up; you can’t just assume it’s not a security incident. [The difference between a security event and a security incident is that an event is an everyday occurrence – like users logging in. But some events also signify a security incident: a breach of confidentiality, integrity and/or availability, also known as the ‘CIA triad’.] Read more from our 'A Practical Guide to Cyber Incident Response' with Cyber Incident Responder, Vanessa Horton 👉 https://lnkd.in/eJnBShva #CyberSecurity #IncidentResponse #CyberIncident #Infosec #Anomaly #SuspiciousActivity

5

https://lnkd.in/eZfp59HD Schools need greater support and funding for protection and mitigation against such attacks. If a school is run as an academy can they face an ICO fine? There were 347 cyber incidents reported in the education and childcare sector in 2023, a BBC report revealed. It represented a 55% increase on 2022.

11

1 Comment

Cyber Incidents: To what extent does seasonality play a role in security monitoring? 🤔 We spoke to Cyber Incident Responder, Vanessa Horton, for her views on what role seasonality (like weekdays vs weekends, for example, or Black Friday) play in her role: Oh, seasonality plays a role, for sure. Black Friday is the perfect example. If you’re a retailer, you’re going to see way more web traffic than usual. You must be able to handle that. By having more people on call, for example. By double-checking things. You need to plan ahead and assess the risks. Again, a smart threat actor will target your weakest link, and when you’re at your most vulnerable. So, if they wanted to take your website down, for example, with a DoS attack [denial of service], a day like Black Friday is a prime time to target, when traffic is up anyway, and it’ll take fewer additional requests to flood your servers. Black Friday is also a great time [from the attacker’s perspective] to cause most harm. If your website isn’t operating that day, you’ll take a massive financial hit in terms of lost sales. Read more from our 'A Practical Guide to Cyber Incident Response' with Cyber Incident Responder, Vanessa Horton 👉 https://ow.ly/2C7950S45RZ #CyberSecurity #IncidentResponse #CyberIncident #Infosec #Anomaly #SuspiciousActivity #Seasons #BlckFriday

4

Keeping software up to date is a key part of data protection, and UK GDPR best practice, not to mention a legal requirement under the UK GDPR ‘accuracy’ data processing principle. This has been made clear by the ICO’s action in reprimanding the Electoral Commission. This is with regard to allowing a vulnerability in their Microsoft Exchange Server that exposed the personal data of 40 million people. Read the news item here. https://lnkd.in/eWmRDixY #informationsecurity #privacy #dataprotection #microsoftexchange

1

**Session Announcement** UK & Ireland CISO Executive Summit 11 June 2024 | Royal Lancaster London 𝐓𝐡𝐫𝐢𝐯𝐢𝐧𝐠 𝐓𝐡𝐫𝐨𝐮𝐠𝐡 𝐄𝐜𝐨𝐧𝐨𝐦𝐢𝐜 𝐔𝐧𝐜𝐞𝐫𝐭𝐚𝐢𝐧𝐭𝐲 𝐰𝐢𝐭𝐡 𝐄𝐟𝐟𝐞𝐜𝐭𝐢𝐯𝐞 𝐂𝐨𝐬𝐭 𝐎𝐩𝐭𝐢𝐦𝐢𝐬𝐚𝐭𝐢𝐨𝐧 In an era of economic uncertainty, organisations are facing intensified scrutiny over #budgets across all departments, including security. As CISOs reassess technology investments, #cybersecurity teams are challenged to achieve more with less. This necessitates a strategic approach to cost optimisation and resource allocation. To navigate these challenges, #CISOs must prioritise the automation of manual tasks and leverage existing tools and assets effectively. Join Sarah Lawson (CISO & Deputy CIO, UCL), Lorraine Dryland (Global CISO, First Sentier Investors), and Amir Ofek (CEO, Axonius) who will discuss: 💡Identifying the types of cost inefficiencies in your security team 💡Develop strategies to optimise costs and showcase ROI during financial challenges 💡Embrace modern cybersecurity asset inventory for cost optimisation and enhanced protection Only in-person on 11th June. View full CISO agenda and register here: https://lnkd.in/darsbT-h 𝗣𝗿𝗮𝗰𝘁𝗶𝗰𝗮𝗹 𝗗𝗲𝘁𝗮𝗶𝗹𝘀: 🌍 The Royal Lancaster, London 📅 11 June 2024 | 08:30 - 17:00 ✅ Exclusively for CISOs (or equivalent) from large enterprise organizations ❌ No Cost (on an approval basis only) 🔇 Chatham House Rules Gartner | Evanta, a Gartner Company | Sam Lincoln

10