ProfSec27-09ps

IS NOW
Combining thermal security cameras with video management systems.
www.flir.com
Untitled-20 1 18/02/16 10:18
rules on breach reporting:
Operators of essential services
such as utilities, hospitals
and the railways will be
expected to meet new rules on
network security – including reporting
breaches within 72 hours – months
before sector-specific guidance is
issued by Government, according to a
consultation document.
Pictured: Pylon, and
below, electricity substation
Photos by Mark Rowe
Consultation
details
The consultation by the
Department for Digital,
Culture, Media and Sport
(DCMS) closes on
September 30. Visit
https://www.gov.uk/
government/consultations/
consultation-on-thesecurity-of-network-andinformation-systemsdirective.
56
NIS directive
The UK Government is consulting
on how to bring in the Security of
Network and Information Systems
(NIS) directive. It has much in
common with the GDPR (general
data protection regulation), besides
the deadline of May 2018; penalties
for serious breaches and losses of
services, for failure to set ‘appropriate
and proportionate security measures’,
are 20m euros or 4pc of offender’s
turnover. The European Commission,
with member states, have agreed the
NIS with the aim of increasing the
security of Network and Information
Systems (NIS) in the European Union
(EU). As with the GDPR, though
the UK voted for Brexit in 2016, the
Westminster Government says that it
supports the aims of the NIS Directive.
Having to report
It’s to cover UK ‘operators in essential
services’ (OESs for short) such as
electricity, ports, airports and train
operators, water, oil refiners, NHS
trusts and digital infrastructure and
what the Government admits are the
increasing numbers of cyber threats.
Also covered are other threats affecting
IT, such as power failures, hardware
failures and environmental hazards.
A consultation document covers what
the technical security measures ought
to be, to manage the risks; incident
reporting of anything that has an
‘actual adverse effect’ on systems;
and what the penalty regime ought to
be. While the document admits that
having to report may be a burden on
businesses, incidents for reporting are
computer viruses and malware, and
anything else that leads to a loss or
reduction in an essential service. The
Government also wants to encourage
voluntary reporting of incidents
where operators had to act to keep
services going. What the thresholds for
reporting will be will differ by sector
SEPTEMBER 2017 PROFESSIONAL SECURITY
Network
directive
and have to be worked out. As for
how fast you are supposed to report
an incident, the directive does not
specify; and while the consultation
document likewise only asks for ‘the
earliest opportunity’, as an incident
may spread, it does also set 72
hours (after ‘becoming aware of an
incident’) as a maximum.
Guidance and principles
The Government proposes what
it calls a ‘guidance and principles
based’ approach; the official National
Cyber Security Centre (NCSC) will
set out principles, and the guidance,
working with relevant Government
departments and ‘competent
authorities’. As for a timetable, the
Government says that in January the
NCSC is to publish generic crosssector
security guidance, including
a cyber assessment framework; the
directive should become law (like the
GDPR) in May 2018; and detailed,
sector-specific guidance should come
by November 2018. Promised in the
guidance is what ‘good’ looks like;
and minimum security requirements.
For search engines too
Proposed principles set out briefly in
the document cover governance, risk
management, asset management and
risks to the supply chain, including
contractors. The consultation
document also says the NIS directive
applies, ‘in a lighter touch manner’,
to digital service providers (DSPs)
such as online marketplaces and
search engines, and cloud storage
services. These should do whatever’s
appropriate to manage risks, for
incident handling, business continuity,
and monitoring and audit. Again,
a ‘guidance and principles based’
approach is proposed, in line with
the GDPR, and the European
Union’s ENISA agency for network
and information security. As an
aside, ENISA’s European Energy –
Information Sharing and Analysis
Centre (EE-ISAC) is running a
seminar for the energy sector at its
Athens base on September 7.
Comment
Justin Coker, Vice President EMEA
at Skybox Security, a cybersecurity
and firewall management software
company, welcomed NIS and advised
review of systems. “The Government
is saying severe fines will be levied
unless an organisation can prove it
assessed the risks adequately. But,
too often there is no visibility of
where the threats and vulnerabilities
are. The attack surface is now more
complex than ever, so organisations
need to move away from traditional
thinking and develop a clear picture
of the long-term security goals, and
plan the security programme in a
structured and logical way. Protecting
and securing critical digital national
infrastructure presents a real challenge
because end-to-end access analysis
must be done across hybrid IT and
operational technology networks.” p
www.professionalsecurity.co.uk