Definitions
Cyber incident
A cyber incident is one that involves action against an electronic system or systems that impacts the ability of an organisation to provide services to its customers. Such incidents may affect the confidentiality, integrity, or availability of the affected system(s).
Categories
There are various forms of attack that may occur during a cyber incident. Examples include:
- Malicious code execution, such as malware or ransomware.
- Denial of service.
- Phishing.
- Unauthorised access to systems.
- Insider threat, either malicious or accidental.
- Data breach, including stolen equipment.
- Targeted attack on the business, potentially involving a range of techniques.
Classification
The National Cyber Security Centre has implemented a classification system for cyber incidents. The system identifies incidents by severity. These are:
- Critical.
- High.
- Medium.
- Low.
Priority services and recovery timelines
Prater Raines provides the following services:
- Fleet: The website system for the Liberal Democrats.
- Lighthouse: The membership management system for the liberal democrats.
- Email Your MP: Microsite campaigning functionality for a variety of organisations.
- Adnum: An internal system for FIM Capital.
- Website Hosting: Various CMS based websites for businesses, organisations, and councils.
- SRB Intranet: The document management system for SRB.
- Email: Microsoft reseller email accounts for businesses and a mail server for Liberal Democrat local parties.
- Domain name registration: Nominet registrar for .uk domains.
- APIs: For the Liberal Democrats and for the Email Your MP service.
The priority services within the above list are those provided to the Liberal Democrats and to FIM Capital. Cyber incidents affecting these services should immediately be escalated to high priority, with an aim to returning to ‘business as usual’ within 24 hours. Where incidents affect other services, these service should be restored within 48 hours, or 72 hours where priority systems are also affected.
Actions and responsibilities during an incident
Pre-incident
It is important to have various processes in place to reduce the likelihood of an incident and to ensure an effective response during a live incident. These include:
- Planning for cyber incidents and testing the response to potential incident scenarios.
- Monitoring systems and supply chains for potential threats and keeping updated on the wider threat landscape.
- Providing ways for staff members and customers to report potential issues.
- Training staff to identify and report potential incidents.
The data protection officer is responsible for the pre-incident processes identified above.
Response
The response to a cyber incident involves various key stages. These stages are:
- Analyse: Identify the nature and severity of the attack, the effects it is having internally, and the external consequences for the business.
- Contain / Mitigate: Prevent the incident from getting worse by isolating or turning off affected systems, considering the potential consequences of doing so.
- Remediate / Eradicate: Prevent any further harm by removing the threat and preventing recurrence.
- Recover: Return to ‘business as usual’ and complete any actions required because of the incident.
The response to a cyber incident should be co-ordinated by the technical director in most cases but may be delegated to other staff members for low or medium severity incidents. The financial services lead is responsible for co-ordinating the response to cyber incidents affecting the Adnum system.
Review
It is important to carry out a review of all cyber incidents. The review process should consider a variety of questions. They include, but are not limited to:
- What improvements are required to reduce the likelihood of recurrence or speed up incident response?
- What information was needed to resolve the incident and how easy was it to obtain?
- What went well and what went poorly in resolving the incident?
- Are there further tools or processes that need to be put in place?
Having considered the above questions, any improvements should be documented, and actions should be assigned to the relevant staff member. This stage of the incident response should be led by the technical director in partnership with the data protection officer.