According to the UK’s National Cyber Security Centre (NCSC), 480 major cyber incidents have attacked the UK within the last eight months.
NCSC revealed to Computer Weekly that they dealt with 451 C3-level attacks that aim for single organisations, 29 C2-level attacks that usually require a cross-government response, and no C1-level attacks, although the WannaCry ransomware came close.
The Director of Incident Management at the NCSC noted that there are five common themes or lessons to learn:
- Balance between usability and security
- Outsourcing
- Legacy systems and equipment
- Mergers and acquisitions
- Getting the ‘basics’ right
Understanding risks and security implications
“We are still seeing organisations that are not getting the basics right, like software security patching, antivirus updating and putting in basic protections and controls for system administrators, who are typically big targets for attackers to steal their credentials,” said Noble.
“The decision making around where to strike that balance is typically confused because of the complexity of the enterprises being defended, and because of a lack of understanding about what they are trying to prevent and which data really matters,” he added.
Noble concluded that organisations need to understand what risks are involved, the security implications, their supply chains and who they are connecting up to.
Written by Leah Alger
