There’s a major new piece of EU cybersecurity-related legislation landing in May, but it might not be the one you’re thinking of. Most UK organisations have their eyes firmly focused on the General Data Protection Regulation (GDPR). But arguably just as important for companies operating in critical infrastructure sectors is the new Security of Network and Information Systems (NIS) Directive. It introduces a range of best practice security steps which organisations must follow: fail to do so and you could face a GDPR-sized fine of up to £17m.
The government has already committed to transposing the directive into UK law irrespective of Brexit. With a 10 May deadline looming, the clock is ticking. Continue reading →
The past 12 months have been packed with geopolitical incident, global malware threats and ubiquitous big-name data breaches. From the CIA Vault7 and NSA Shadow Brokers leaks at the start of the year, to the WannaCry and NotPetya ‘ransomware’ campaigns, and Uber’s shock revelations just last month, there’s been plenty for UK CISOs to ruminate on. But now the year is nearly at an end, it might be useful to recap some of the biggest themes of 2017 — with an eye on fortifying systems for the 12 months to come. Continue reading →
Cyber-attacks are happening all the time. In fact, the one certainty CISOs should have today is that their organisation has either already been compromised, or it will be breached at some point in the future. But many of the most dangerous attacks are the ones designed to slip under the radar unnoticed — in many ways the opposite of your typical ransomware outage. This week, one of these sophisticated attack campaigns was revealed: a gang targeting US and Russian banks as well as a UK financial software provider. It’s already netted $10m (£7.5m) for the hackers, who are still at large. Continue reading →