Incident Management Scenario, Matt Parker Information Assurance & Cyber Safety

Transcription

1 Incident Management Scenario Please take your seat at a table towards the front Thank you

2 Incident Management Scenario Matthew Parker Information Assurance & Cyber Security Engagement Programme The National Archives

3 Risks and data loss On your tables please discuss the following 3 questions: 1) What are the most important bits of information or information assets within your organisation? 2) Where do the technical risks to your information come from? 3) Where do the cultural risks to your information come from?

4 The scene Your name is Max Breach You work for a small marketing company in Leeds You have just arrived for work on Monday morning You ve made a coffee and start checking your s

5 New unread 10:05am Dear Max I just received a call from Steve Beer a new HR administrator who said he left his work bag in Wetherspoons after a few drinks on Friday night. He went back on Sunday but according to the bar staff there was no sign of it. Steve told me that the bag contained 10 staff record files, including names, address, payroll information and national insurance numbers. The bag also contained a personal USB stick which had a backup of our customer relationship management system I've done some digging and Steve has been working unsupervised despite only being with us for two months, he has limited experience and has had no training. I m not sure what to do!! Please advise Debbie Bone Helpdesk Manager

6 i) What do you need to find out? Dear Ma I just received a call from Steve Beer a new HR administrator who said he left his work bag in Wetherspoons after a drinking session on Friday night. He went back after work on Monday but according to the bar staff there was no sign of it. Steve told me that the bag contained 10 staff record files, including name, address, family member details and key life events. The bag also contained a personal USB stick which had Directors expenses claims, their bank details and NI numbers. I've done some digging and Steve has been working unsupervised despite only being with us for two months and has limited experience and no training. I'm really scared about this getting out and not sure about next steps Please advise Debbie Bone Helpdesk Manager

7 Sent messages - 10:15am Debbie, Thanks for your , cc'ing in our SIRO. Key things we need to find out: - Do we still have a copy of the CRM on our system? - Why did it take until Sunday for Steve to return to the pub? - Who are the colleagues whose data might have been lost? - What harm could come to them? - Were there any protections on the USB (i.e. encryption)? - Are there wider consequences to consider such as loss of customer confidence? - Did Steve report this to his manager or the police and who should be responsible for this information? You, me and the SIRO to meet in 15 minutes ok? Max Breach

8 New unread 10:16am Hey Max I've just seen on Twitter that a member of the public has found a USB stick in a local pub and is threatening to give the CRM backup to a rival marketing firm!! The story has been picked up by the local and national media who are asking me for a comment and people on twitter are offering cash for a copy of our CRM!!! Please help!! Jo Scare Press and Communications

9 New unread am Max, Debbie forwarded me your , sorry about all this mate! I'm not in the office but if you have a look on my desk you'll find a notebook with the names of the 10 people in the missing files By the way, the USB wasn't encrypted and it was a complete backup of our CRM system. There was other stuff in the bag like my office pass, an emergency contact list and my iphone. Complete disaster! Hope this helps a bit! Cheers, Steve

10 ii) What actions do we need to take?

11 Emergency breach meeting Time: 10:35 am Attendees: Max, SIRO, Jo, Debbie Actions: Comms team to prepare lines to take with the media Remove Steve s notebook and contact the 10 staff Inform the ICO Inform the 10 staff members whose records have been lost Establish whose information might have been lost in the CRM and consider contacting them Suspend Steve s access rights and introduce him to management Talk to other members of Steve s team and check this attitude to home working and data security is not part of a wider trend Inform security about the missing staff pass

12 iii) What could have prevented it?

13 Steve Beer incident report Preventative steps Questions to ask: Do we have controls on storing information on USBs? Do we have comprehensive home-working and clear desk policies and are they being followed? Do staff know when and how to report losses? Are line managers aware of the risks and do they allow new starters to work unsupervised? Are staff aware of the consequences of a data loss? Can we implement better induction training? Are there issues with our organisational culture? Are we prepared for the speed of social media?

14 In your organisation Would this have happened in your organisation? Why/why not? What do you do differently? What could you do differently?

15 What happened next? 1. Steve never made it back into the office 2. The member of the public decided to hand the bag back rather than sell the information on 3. A man was apprehended after trying to access the office with Steve's missing staff pass 4. The breach was reported to the ICO who issued a strong warning for the lack of encryption and inadequate home working policy

16 THANK YOU! For training enquiries and for more information: Follow us on