What is a cyber incident?

What is a cyber incident?

According to the National Cyber Security Centre (NCSC), A cyber incident is:

“a breach of a system’s security policy in order to affect its integrity or availability and/or the unauthorised access or attempted access to a system or systems; in line with the Computer Misuse Act (1990).”

Out of the 819 cyber-incidents reported to the FCA in 2018, 93 were confirmed as a type of cyber-attack, such as DDoS, Malware or Ransomware of which the majority, not surprisingly, were phishing attacks. However, the most frequent incidents, at 174 out of 819, were third-party failures.

I found this article, dating back to April 2017, which refers specifically to the issue of UK firms not being prepared for third-party failures and at the same time having an over-reliance on third parties. This figure seems to suggest that not a lot has improved here, although, in the 2 years since this article, I would say that businesses have been further pushed towards third-party cloud services as that industry has grown, so the important takeaway here is that management of third-party suppliers is in need of improvement. For a full review of how to manage your suppliers, I suggest you read our supply chain security guide.

The second highest cause of cyber-incidents at 157 were issues with hardware and software, which cause service disruption. Again, reliance on third parties and third-party products and services is an area of security risk to be managed.

When to report a cyber-incident

Creating an incident response plan can help you to strategise your communication plans in the event of an incident. When to report a cyber incident and who to, varies depending on the consequences of the event and the industry.

Operators of Essential Services (OES) fall under the Network and Information Systems (NIS) Regulations along with other services critical to the economy and wider society, such as water, transport, energy, healthcare and Digital infrastructure. NIS regulations came into force in May 2018, just before GDPR, though with a lot less fanfare.

OESs have breach-reporting obligations under NIS. The banking sector falls within NIS, and cyber incidents must be reported to the FCA, under NIS Regulations, when computer systems and the digital data stored and processed within them are compromised.

Under the UK General Data Protection Regulation, if a cyber incident results in “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed”, the data controller must inform the ICO within 72 hours using the GDPR process, if there is deemed a risk to the rights and freedoms of individuals. If the risk is high, the breach must also be reported to the affected data subjects.

Non-compliance with GDPR can risk a fine of up to £17 million or 4% of annual turnover, whichever is greater, but the costs to the organisation, separate from any fine levied, may be significant and include the cost of reputational damage and lost business.

Non-compliance with the NIS Regulations risks a fine of up to £17 million. The GDPR and NIS 2 are separate laws, so it is possible that a single cyber-incident that infringes both sets of regulations could lead to double enforcement action from both the ICO and the relevant NIS competent authority. Learn if you are in scope with NIS 2 here.

The increased reporting of cyber-incidents in the finance sector in 2019 is undoubtedly linked to the introduction of the GDPR and NIS regulations in May 2018. Uncertainty regarding what needs to be reported has led to a belt-and-braces approach by firms fearful of falling foul of the new laws.

Need help with building a robust cybersecurity strategy?

If you would like to discuss your cybersecurity posture, contact our friendly team of cybersecurity experts.

We provide an outsourced, fully managed SOC service – removing the overhead cost of building a security centre in-house. We can also help with Supply Chain risk management, incident response exercises and phishing awareness training. 

People vector created by fatmawatilauda – www.freepik.com