🛡️ Reducing Your Risk: Practical Advice on Cyber Threats and Responding to Cyber Incidents #CyberMonth2023

Despite best efforts, there are times when things do go wrong, and it is crucial to know how to respond to a cyber attack. In such cases, there are a number of steps you should take including reporting the incident to the relevant authorities:

✅ Incident Identification and Assessment:

• Prompt identification of the cyber incident, its nature, and the extent of the breach is crucial. Employing intrusion detection systems and monitoring the network for anomalies can expedite this phase.
• If they are not already involved at this stage, bring in key support functions such as your IT Support and Data Protection Officer!

✅ Containment and Eradication:

• Once identified, efforts should be directed towards containing the incident to prevent further damage. This includes isolating affected systems and removing malicious codes.

✅ Notification to Relevant Authorities:

• Department for Education (DfE):
  Especially if the Management Information System (MIS) is compromised, informing the DfE is a procedural necessity. Their contact for reporting cyber incidents is sector.securityenquiries@education.gov.uk.
• Action Fraud:
  The UK’s national reporting centre for fraud and cyber crime. Reporting can be done by calling 0300 123 2040 (option 9) or at https://actionfraud.police.uk.
• Information Commissioner’s Office (ICO):
  As the national data protection authority, reporting a significant breach to the ICO within 72 hours is a statutory obligation under the GDPR. If the cyber attack involves a personal data breach, it is likely that this will meet the threshold for reporting to the ICO.
• National Cyber Security Centre (NCSC):
  The NCSC has a new Cyber Incident reporting tool that can be accessed here at https://report.ncsc.gov.uk. They also have a Cyber Incident Signposting Service (CISS) which can provide guidance on who else to report to based on the specifics of your particular incident and your location within the UK.
• Cyber Security Insurance Provider:
  Notify your insurance provider to understand the coverage and the support they can provide in managing the incident.
• Local Authority Designated Officer (LADO):
  If the breach involves safeguarding issues, the LADO should be informed.

✅ Communication with Stakeholders:

• Clear communication with stakeholders including staff, parents, and the governing body is essential. This should include the nature of the breach, the steps taken to remedy it, and how future incidents will be prevented.

✅ Utilize the NCSC’s Suspicious Email Reporting Service (SERS):

• Forwarding suspicious emails such as phishing attempts to the NCSC’s SERS can help prevent further phishing attempts and contributes to the national cyber security resilience.

✅ Recovery and Lessons Learned:

• Restoring and validating system functionality for school operations is critical. Post-incident analysis to understand the root cause and implementing lessons learned to prevent future incidents is a key component of organizational resilience.

✅ Engagement with Cyber Security Professionals:

• Engaging with cyber security consultants to audit and enhance the school’s cyber security posture is a prudent step towards fortifying the institution against future threats.