The-Accountant-Sep-Oct-2017-Final

Information Technology
requiring its attention. The majority of the
major incidents the NCSC has dealt with
were C3-level attacks, typically confined
to single organizations. These account for
451 incidents to date. The remaining 29
major incidents were C2-level attacks,
significant attacks that typically require a
cross-government response.
Across these nearly 500 incidents, an
official in the NCSC stated there were five
common themes or lessons to be learned.
Firstly: There is still a need for
organizations to get the basics right -
software security patching, antivirus
updating and putting in basic protections
and controls for system administrators,
who are typically big targets for attackers
to steal their credentials.
Secondly: Organizations fail to get
the balance right between usability and
security - victim organizations had leaned
too far in the direction of convenience and
usability, leading to things like logging
being turned off to optimize performance:
decision-making around where to strike
that balance is typically confused because
of the complexity of the enterprises
being defended, and because of a lack of
understanding about what they are trying
to prevent and which data really matters.
Thirdly: Organizations continue to
use legacy systems and equipment – these
present opportunities to attackers: when
incidents are investigated, the NCSC
finds it is in the legacy systems that the
compromise has begun.
Fourthly: Outsourcing - in early 2017,
the NCSC reported on a major compromise
of managed service providers [MSPs]:
MSPs enable attackers to obtain security
credentials in one country, traverse across
their network, and then compromise a
company or series of companies in another
country, and exfiltrate (take out) the data
through a third country. The NCSC has
published a list of questions organizations
should ask their MSPs in terms of security:
organizations need to understand the
security implications of their supply chains,
who they are connecting up to, and what
risks are involved.
Fifthly: Mergers and acquisitions - in
mergers and acquisition, cyber security
is often overlooked in the due diligence
process; as a result, the cyber risk is not
understood and not addressed effectively.
WannaCry was a novel piece of malware
whose speed and impact were hard to
anticipate. Organizations should build
flexibility, speed, and adaptability into their
event-response capabilities. Those plans
should be tested across the organization,
on various event scenarios; specialized
resources and expertise should be identified
and adapted in response.
Risk modelling must be kept up to date.
The potential scenarios that could affect
the organization’s operations should be
rethought; the potential operational and
financial impacts should be established.
Second- and third-order consequences,
like supply chain disruptions and associated
financial costs, should be evaluated; risks
that demand the most focus should be
determined.
And finally, the organization’s cyber
insurance programme should be reviewed
and updated. Networks will continue to
become more connected and businesses
more dependent on data-sharing. Every
business that uses technology should take a
fresh look at its cyber insurance programme:
policies should be updated as needed to
provide coverage for business interruption
and cyber extortion; and programme limits
in the face of catastrophic scenarios should
be re-evaluated.
september - october 2017 31