On Wednesday 22nd July, Colin Robbins of Nexor, hosted a virtual Masterclass on behalf of the Nottingham, Derby, Leicester Branch of the Chartered Institute of Information Security Professionals on an “Insight into the Murky World of Cybercrime”. The event was well attended by 72 security professionals with some valuable questions raised throughout the presentations.
Leicestershire Police kindly provided the speakers for the event; CIISec Member Detective Sergeant Charles Edwards, Digital Media Coordinator/Digital Hub Supervisor, and Samantha Hancock, Cyber Protect Officer.
Charles began the Masterclass by discussing the Leicestershire Police’s strategic approach when dealing with cybercrime and the organisations they partner with to give a holistic view of the impact of cybercrime in the UK.
Samantha then followed on with an emphasis on educating and mitigating risk to prevent businesses and individuals falling victim to cybercrime.
5 Key Takeaways
1. Cybercrime/Cybersecurity
Statistics tell us that there are now more crimes online than offline; the risk of businesses falling victim to cybercrime is no longer “if” but “when” will it happen!
The UK Government now determine cybercrime as a Tier 1 risk:
- Cybercrime can be defined as criminal activities carried out by means of devices or the internet;
- Cybersecurity can be defined as protecting yourself, your organisation, and your customers in today’s interconnected world through People Process and Technology.
2. Who deals with Cybercrime?
Cybercrime is tackled by teams working locally, regionally, and nationally:
- Locally there is a dedicated team within Leicestershire Police with one common aim – to protect against cybercrime and educate businesses and individuals on best practice and to mitigate risks. This could range from a ransomware attack on a school, to unauthorised access to a local business;
- Regionally there is investigative capacity to provide technical support and provide oversight around management of organised crime groups. Within the East Midlands, this is the East Midlands Special Operations Unit (EMSOU). This provides the opportunity for cross border work, using a range of specialist resources such as online engagement officers and dedicated prevent teams/officers. EMSOU is supporting the launch of the East Midlands Cyber Resilience Centre. The regional teams will provide intelligence support for cross-county border work.
- Nationally, the National Crime Agency and GCHQ (incorporating the National Cyber Security Centre) provide advice and support to all sectors; offering a national range of intelligence opportunities. This approach allows visibility to national infrastructure elements, identified state actors and an overview of exploitation of software/hardware at scale.
Action Fraud is the UK’s national reporting centre for fraud and cybercrime. It is a central point of contact and offers a 24/7 service online to report any suspected incidents or scams. This information is collated and through data matching and analysis allows reports from different parts of the country to be linked in identifying the criminals behind the scams. This analysis is then sent to local police forces for investigation.
3. How do we deal with Cybercrime?
Visibility of annual assessments and cyber profile dashboards give an overview of the UK’s current cybercrime landscape. The approach used to action this is called the “4 P Strategy” – Protect, Prevent, Prepare and Pursue.
- Protect: educate and raise awareness offering simple advice and contextualised support;
- Prevent: identify those at risk of offending, divert and prevent the crime;
- Prepare: ensure incident management plan is in place. Is it well tested and does it reflect all areas of your business? Do you have a copy available offline and readily available?;
- Pursue: lock up the offenders.
4. What should you do?
Anyone can be a target or a victim. Training, education and awareness is essential to protect or mitigate impact from Cybercrime.
- Our first line of defence is our devices; are all your operating systems supported and up to date and do you have up to date anti-virus software? Do you have a robust process in place to ensure this happens?;
- Have you embedded a security culture in your business? Do all individuals know the escalation process to report an incident?;
- As an organisation do you have Cyber Essentials certification?;
- Join Cyber-Security Information Sharing Partnership (CiSP). This is a joint industry and government initiative set up to exchange cyber threat information in real time. Using a secure, confidential, and dynamic environment, this gives early warnings of cyber threats. It can also provide access to free monitoring reports tailored to your organisation’s requirements.
5. Actions you can take
- Report cybercrime immediately to Action Fraud;
- Share intelligence (CiSP);
- Share best practice;
- Do not hide what is happening, your experiences will help others;
- Staff are an essential element of Cybersecurity; ensure you invest in awareness training;
- Engage with your local cybercrime unit. Do you know who your local Cyber Protect Officer is?
How can Nexor help?
Nexor’s experienced cyber security consultants can work with your business to carry out a detailed risk assessment to determine what threats you need to defend against. Following this, we can design suitable risk mitigations for you to implement as well as assist you in gaining any certifications such as Cyber Essentials or ISO 27001 to help protect your business.
If you want to learn more about this Nexor are hosting a webinar on Thursday 24th September 2020 at 10am. Sign up now!
About CIISec
The Chartered Institute of Information Security (CIISec), formally the Institute of Information Security Professionals (IISP) is the only pure play information security institution to have been granted Royal Charter status and is dedicated to raising the standard of professionalism in information security. CIISec is here to help individuals and organisations develop capability and competency.
Author Bio – Dawn O'Connor
Dawn O’Connor is an associate of Nexor with an extensive business background across different market sectors including retail, local and central government and law enforcement. She is a member of the Chartered Institute of Information Security and co-chairs the Nottingham/Derby/Leicester Branch. Dawn holds the Certificate in Information Security Principles and the ISO 27001 Foundation certification.
