Cybersecurity breaches and disclosure reporting are a bit like London buses.
You never know quite when they are going to turn up, and then three turn up together. When it comes to cyber breach disclosures, you literally have no idea if or when they are going to turn up at all.
Take the one at the Electoral Commission disclosed this week. The incident was identified in October 2022 after suspicious activity was detected on the regulator’s systems. (It then became clear that ‘hostile actors’ first accessed the systems fourteen months earlier, in August 2021).
As was required under the law, the Commission notified the Information Commissioner’s Office (ICO) within 72 hours of identifying that data on its systems that may have been accessed, and then, finally, ten months later, it published a formal notification to the public.
In mitigation for the delay, the Commission said it had to work with external security experts and the National Cyber Security Centre (NCSC) to investigate and secure its systems, which is fair enough—but a disclosure all of ten months later? There is a risk that some organizations will now regard ten months as an acceptable timeframe and the going rate for public disclosure.
Key cybersecurity questions need answers
The disturbing breach at the Electoral Commission raises questions about the effectiveness of cyber-governance at other independent or public bodies, and about the technical advice they have been given.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataIn a statement, the Electoral Commission’s chief executive Shaun McNally said the organisation regrets that insufficient protections were in place to prevent this cyberattack. It should be credited for making that clear. But what that suggests is that either cybersecurity was not sufficiently regarded as a high-enough priority at the Commission or that mistakes were made somewhere along the line. Which begs the question: which organization advised the Commission on its cybersecurity protection measures?
Given the sensitive nature of its work, overseeing elections, and regulating political finance, the Commission should have had the highest cybersecurity measures in place. Did the National Cyber Security Centre scrutinise them? And if not, why not? It is probably reasonable to surmise that other public bodies are similarly insufficiently cyber-protected. In fact, while you are reading this, it is highly likely that a surreptitious breach is currently taking place at a public body either in the UK or somewhere else around the globe.
Email is a key attack vector….
The recently published Acronis 2023 Mid-Year Cyberthreats Report highlighted that the number of email-based attacks seen thus far in 2023 has experienced a staggering 464% surge compared to the first half of 2022. Secondly, when considering the attacks per organization within the same time frame, there has been a notable increase of 24%.
The numbers underscore the escalating threat landscape—with email being the main attack vector—and the urgency for organizations to fortify their defences against malicious activities.
…and regulators are not helping
It is worth reading an opinion piece by the former director of the US Cybersecurity and Infrastructure Security Agency (CISA), Chris Krebs, who questions US Securities and Commission (SEC) cyber security regulations, which require companies to publicly disclose incidents and regularly report on governance. In theory, the increased transparency will certainly drive much-needed awareness across industries.
But for Krebs, the new incident reporting requirements are redundant and misdirected. In 2022, the US Congress directed CISA to develop incident notification regulations for industry. CISA is the lead civilian agency for cybersecurity, and incident reporting should go there. But the new SEC rule now requires companies to report incidents to two federal regulatory authorities: CISA and the SEC.
As I said, you wait for one incident reporting requirement to come along—and then along come two at once! All aboard!
