• 0800 0862018
  • This email address is being protected from spambots. You need JavaScript enabled to view it.
  • Mon - Fri 8:00 - 17:00

InfoSec / Cyber

Hooded person over a computer linked to a padlock and password, badge for data protection officer, white text saying Be Cyber Aware

October is Cyber Security Awareness Month: 30. Support

October is Cyber Security Awareness Month, and while we don't think that cyber awareness is something to cover just once in the year, we think it's a good opportunity to publish some information that can be used all year round.
Awareness Day Thirty: Support
Awareness Day Thirty: Support

We thought it might be helpful to list organisations that can provide support for cyber security with regard training, awareness, resilience and recovery:

Your data protection officer.
Your IT provider.
The NCSC (the National Cyber Security Centre).
Make cyber security a priority.
Train your staff: NCSC School staff training.
South East Regional Organised Crime Unit
Have a cyber incident response plan.
Review the DfE's cyber security standards.

Review DPE's previous articles:

Be Cyber Aware: Cyber attacks and transparency. A no blame culture
This article is about cyber attacks and data breaches that may go unreported due to the misconceptions about how organisations might respond to them.  The NCSC recently published an article about why transparency around cyber attacks is a good thing for everyone.
The NCSC and the ICO may work on a cyber attack together if an incident brings down a business, severely impacts national services and infrastructure or massively disrupts people's data-to-day lives, however they consider that a large number of attacks may go unreported.  The article talks about a number of myths:

Myth 1 - If I cover up an attack everything will be OK - of course it won't.  Every successful cyber attack that is hushed up, with no investigation or information sharing, makes other attacks more likely because no one learns from it.  Keeping your cyber incident a secret doesn't help anyone except the criminals.

Myth 2 - Reporting to the authorities makes it more likely the incident will go public.  Your confidentiality will be respected and both the NCSC and ICO don't proactively make information public, or share it with regulators without your consent.  Remember your regulatory responsibilities.

Myth 3 - Paying the ransom quickly to get the decryption key and restore services doesn't always help.

Myth 4 - I've got offline backups, I won't need to pay a ransom.

Myth 5 - If there is no evidence of data theft, you don't need to report to the ICO.  You should always start from the assumption that it has been taken.

Myth 6 - You'll only get a fine if your data is leaked.  This isn't necessarily the case.  A personal data breach is more than just a loss of data.

The full report is here: Why more transparency around cyber attacks is a good thing for everyone

We would always encourage staff to report any cyber attacks and data breaches. Visit our Information & Cyber Security Best Practice Library for support and guidance. Raise awareness with staff through training, posters and discussion.  Having a 'no blame' culture will encourage staff to report issues.
Ensure you have a Cyber Response Plan: Cyber Response Processes.

What to do in the event of a cyber attack?

Tell someone!  Report to IT. Report to SLT. 

Unplug the computer from the internet by removing the ethernet cable or turning the Wi-Fi off.

If you are a victim of a ransomware attack we would recommend reporting this to Action Fraud: https://www.actionfraud.police.uk/ as well as your data protection officer so they can advise about the data loss.  Most cyber crimes like these will also need to be reported to the ICO by your data protection officer.

Isolate the infected device and pass to IT 

Always ensure there are backups you can restore from.

Little Guide to ACTION FRAUD