This week’s Knowledge Update talks about how half of Norway’s population may have been breached, the head of NCSC stating that a major cyber attack in the UK is a case of “When, not if” and complexity of DDoS attacks are rising.
Half of Norway’s population may have been breached
Health South-East RHF, who deliver healthcare for the most populous part of Norway, including the Capital, is investigating an unauthorized intrusion into its IT systems which may have breached the personal data of over half the country’s population.
In a statement last week, Health South East said, “The countries healthcare IT security centre, HelseCert, had notified its IT delivery partner Sykehuspartner HF (Hospital Partner HF) of some “abnormal activity” at the beginning of January.
The police were notified that the breach was perpetrated by an “advanced and professional” person. Organisations of any size are at risk of malicious breaches, protecting customer data is a legal duty. Cyber Essentials provides a framework, backed by the UK government, for businesses to improve their information security. More information can be found here.
A major cyber-attack on the UK is a case of “When, not if”
The head of National Cyber Security Centre (NCSC) has said that a major cyber-attack on the UK is a case of “When, not if” warning of serious disruptions to the British elections and critical infrastructure
Ciaran Martin, who is the Chief Executive of the National Cyber Security Centre (NCSC) said that the UK was has been fortunate enough to avoid a so-called ‘Category One (C1) attack, which is broadly defined as an attack that could weaken infrastructures such as energy supplies and financial service sectors.
During Martin’s interview with the Guardian, he said that he anticipated such an attack in the next two years. Although category one attacks can be sophisticated and persistent, perpetrated by career cyber criminals, many of the attacks targeting small business are low sophistication but high volume. To best protect your business need to make sure that staff are made aware of the threats posed from phishing through training and awareness sessions.
Policies in regard to the acceptable use of computer equipment, handling data and payment processes should be implemented and adhered to. Prevention advice for Phishing can be found here.
Complexity of DDoS attacks are rising
According to a new report, DDoS attacks have become more stealthy and intelligent in 2017 and will keep becoming more intelligent.
In 2017, more than half (59%) of service providers and around half (48%) of enterprises experienced multi-vector attacks, which is a 20 percent increase over 2016. Multi-vector attacks combine high-volume floods, application layer attacks and TCP-state exhaustion attacks in a single offensive, increasing mitigation complexity.
Darren Anstee, who is the Chief Technology Officer for Netscout Arbor, has told SC Media UK that the biggest change they’ve seen in 2017 has been the prevalence of multi-vector attacks, often targeting the application layer.
DDoS mitigation techniques include investing in greater bandwidth, using a content delivery network, monitor your systems and hosting in the cloud. Further information on DDoS and how best to prevent it can be found here.
Read more.
