Cyber attacks on UK companies, and advice on repelling them
UK manufacturing and technology sectors are vying for first and second place as the most cyber-attacked industry sectors, according to the 2019 Global Threat Intelligence Report (GTIR) from US firm NTT Security – the report is compiled from trillions of logs and millions of attacks, said NTT, whose data is analysed across 18 industry sectors.
“While manufacturing took top billing in the 2018 GTIR, with 46% of all cyber attacks in the UK, this year’s report shows a significant fall to second place with 20% of attacks,” according to NTT. “However, the tech sector, which attracted 23% last year, jumps to top spot with 47% of attacks in the UK.
Finance, which is apparently the most attacked EMEA sector, is lucky in the UK because it only gets third spot with 13%, followed by business-and-professional services (4%) and 3% for healthcare.
“While manufacturing may have dropped down a position, the fact that it is still attracting a fifth of all attacks against UK organisations is a major concern,” said NTT cyber security manager David Gray. “The critical national infrastructure sectors tend to grab the headlines, such as the attacks on the Ukrainian national grid in 2016, or the Wannacry attack on the NHS in 2017. However, the recent attacks on Norsk Hydro demonstrate the impact that cyber attacks can have on other sectors, such as manufacturing, and highlight the importance of effective incident response.”
- Get the basics right. Without the right fundamentals in place, attacks do not need to be advanced to succeed. People are often a manufacturer’s greatest threat, so invest in staff awareness and training, and highlight the importance of collective responsibility.
- Take an intelligence-driven approach to security. IT and security should avoid working in silos and having a ’not in my backyard’ mentality by developing robust holistic processes and procedures.
- Develop threat intelligence capabilities. There is no such thing as an isolated incident and there is a need to manage the whole incident by developing threat intelligence – pervasive visibility is essential.
- Manufacturers are still failing to prepare. There is still an element of ‘head in the sand’, where they do not think it is going to happen to them. Having effective incident response capabilities that are tested regularly is key and enables organisations to respond quickly in order to mitigate the threat and identify the cause.
And wake up to what counts as vulnerable.
“The lines between traditional and digital manufacturing are blurring,” said Grey, “where high value manufacturing and advanced technologies are key for global competitiveness and there is greater convergence of IT with operational technology, which brings with it greater complexity and risk. The problem is that operational technology has traditionally been something of a dark art for IT and security teams who lack the knowledge and skills to effectively map their operational technology risk landscape and implement practical plans and processes.”
Where are those attacks coming from?
- Once again China is the number one source of attacks (20%) by country against UK organisations, followed by the US (16%) and France (10%).
- Apart from Sweden, the UK is the only country to see most attacks coming from China.
- Across EMEA, China is second (13%) just behind the US (16%).
- Globally, again the US is top attack source (22%) followed by China on 13%.
- Senior Cyber Risk Consultant, UK - Remote first- Exclusive
- United Kingdom
- Depended on experience.
Cyber Security Risk Consultant to join specialist, people first security consultancy. WARNING if you want a large, slow moving, high politics, high travel security consultancy that demands their a pound of flesh this is NOT for you. Client focused opportunity. Prior consulting experience is essential within Cyber Security. Experience working with businesses to identity and make recommendations to mitigate cyber risk. Some of the nice to have certifications. CRISC, ISO27001 Lead implementer, CISA, CISM, CISSP UK based - remote first mentality. (With some travel) Training budget Unlimited holiday Looking to interview immediately Unable to offer sponsorship.
- identity access Management Consutlant
- Upto £80,000 plus benefits
An Identity & Access Management Consultant is needed for an expanding business based in the United Kingdom. (Remote role with monthly office meet ups) The Identity & Access Management Consultant will be responsible for the technical design and implementation of Identity & Access Management/IAM products for a wide variety of clients. Deliver bespoke end-to-end consultancy service to our clients, from gathering requirements through to implementation. Work in a close team designing, developing, and implementing first-class IAM solutions. Manage client relationships, working closely with key stakeholders to continually evaluate business requirements and ensure the highest quality solution delivery. If you are interested we are looking for an individual with Previous experience working within the IAM or CIAM field is essential, Strong knowledge with SAML and Oauth and ideally OpenID Previous experience from any of these technologies: One Identity, SailPoint, Saviynt, Ubisecure, Ping Identity, would be advantageous
- 17'5 NOT 4 7R4P | Pen testing Lead 100k++
Lead Penetration tester wanted please. - This is however a Master level as appose to padawan. 1. 100k+ for the skilled individual. 2. Research / training time 3. Hybrid role- 3 days at home 2 in the office with the team in London. (11am - 16:00) 4. Exclusive opportunity. So yours to hear about if you are quick. Infrastructure and Web application / red teaming pen testing experience Someone that can scope, deliver and speak to clients.
- It's Pen Testing, The good, the bad and the ugly
- United Kingdom
A new lead Pen Testing opportunity, AND slightly different from the usual you may see. The good, the bad and the ugly… Lalalalala la laa laaaa The GOOD 1. £90-110k for the skilled individual. 2. Research / training time 3. Hybrid role- 3 days at home 2 in the office with the team in London. (11am - 16:00) 4. Exclusive opportunity. So yours to hear about if you are quick. The bad 1. You have to apply or email me so we can speak. 2. 17'5 NOT 4 7R4P or click bait The ugly 1. It’s only ugly if you don’t reply and someone else you know gets it. Infrastructure and Web application / red teaming pen testing experience Someone that can scope, deliver and speak to clients. Apply today for more information.