Transparency around cyberattacks is important
Source: Middle East Insurance Review | Aug 2023
In a joint blog post, the National Cyber Security Centre (NCSC) of UK and the UK Information Commissioner’s Office (ICO) have stressed the importance of transparency in the aftermath of a cyberattack, highlighting that a lack of evidence that data has been stolen does not mean theft did not take place.
The two organisations dealing with cyber security aim to dispel the common misconceptions that can discourage organisations from reporting a cyberattack. Unreported incidents are denying organisations the opportunity to learn from them and prevent future attacks.
If attacks are covered up, the criminals enjoy greater success and more attacks take place. Hence, it is in everyone’s interests to be more open about cyberattacks, by exploring – and dispelling – some of the myths around responding to cyberattacks.
The blogpost focuses on six misconceptions that often discourage organisations from reporting attacks, particularly ransomware attacks, and sets out to dispel them.
The six ‘myths’ which the NCSC and the ICO have identified as commonly held by organisations that have fallen victim to cyber incidents are:
- If I cover up the attack, everything will be okay
- Reporting to the authorities makes it more likely your incident will go public
- Paying a ransom makes the incident go away
- I have got good offline backups, I will not need to pay a ransom
- If there is no evidence of data theft, you do not need to report to the ICO
- You will only get a fine if your data is leaked
This latest move by the NSCS and the ICO comes amidst threat actors continuing to cause significant disruption through cyberattacks. The silent incidents make future attacks more likely, while sharing information amongst communities about an attack can ultimately improve the threat landscape for everyone. M