ISPA Cyber Security Summit

ISPA held its first Cyber Security Summit on 7th July 2016 in the Brewery London, speakers included representative from Government, law enforcement, and industry. A summary of the day is below.

Cyber Security: what is expected from ISPs?

The panel included Emma Wright from Kemp Little, Thomas Owen from Memset, Rob Coderre from Verisign, Ben Russell from the National Cyber Crime Unit, Mike Lee and Chris Proctor from DCMS and Warwick Ashford, Security Editor of Computer Weekly, as Chair. In general, there was consensus amongst panellists that the threat from cyber security was outpacing the response to it, thus there needed to be more collaboration between industry, government, and law enforcement in order to deal with the threat. The key points were:

• Ashford said that business could move fast and be agile if they had the right security in place but there were indications the UK wasn’t keeping pace with the threat and it was costing the economy billions.
• Proctor said that cyber essentials was becoming a recognised brand that people would be asking for, he said that Government had started this process by requiring it for any contracts, but that this would be rolling out across industry.
• Russell said it was still a small elite group of people causing significant harm to the UK, and the threats were becoming increasingly agile.
• Russell said that ISPs needed to work with the NCA to help disrupt these criminals, he said that it was unlikely that the NCA would inform the press, regulator, or customers about an attack.
• Wright said that the NIS Directive was unlikely to affect telcos, as they were already covered by Ofcom regulations, but that telcos could expect to see it flowed down.
• Wright said that following the CMS Committee Report it was likely that the ICO fine for security breaches would go up.
• Wright said that despite Brexit the UK would likely have to comply with GDPR as it was unlikely that British companies would be able to process EU data otherwise.
• Coderre said that basic network hygiene would go a long way in stopping cyber threats, he also said egress filtering would help ISPs.
• There was some consensus in the room that more prosecutions of cyber criminals would encourage ISPs to share information with law enforcement.

Keynote: 2016 Cyber Threats and Trends, Rob Coderre, Verisign

Rob Coderre, Director of Product Management at Verisign gave an interesting speech on the cyber threats and trends of 2016. In general, he said the threat of cyber crime was evolving quickly, and companies needed to pay attention and change tact at speed. The key points were:

• Coderre said that the more information you collect and have on the threat, the better a decision you can make on protecting yourself from cyber threats.
• In 2015 there was an increase in the use of non-public web space for cyber criminal community organisation, Coderre said that most of the criminal had moved to private forums on the dark web, making themselves harder to track.
• Coderre said that DD4BC (DDoS for Bitcoin) had taken ransomware to another level and become increasingly common.
• Coderre said that the concept of patching was really important and something that ISPs should be doing regularly.
• DDoS for hire has been one of the biggest trends of the last year.

What can ISPs do to deliver optimised and future-proofed networks?

The panel included Robert Rylko, Vice President of AVSYSTEM, David Tindall, MD of Talk Straight, and James Blessing, ISPA Chair and CTO of Relish Networks as Chair and examined how to manage and optimise networks as customers demand more data and cyber threats evolve, as well as discussing the impact of cyber-attacks on infrastructure. The key points were:

• Tindall said that ISPs could do more to offer end user level security and that this could help stop attacks on your networks from being successful. He said whilst this was a massive leap for some ISPs in his experience it could be worth it.
• Rylko said that a platform which enables you to create central automatic behaviour processes could help combat cyber threats.
• Blessing questioned whether offering an end to end service would be a good idea for all ISPs, and expressed concerns that customers may put the blame on their ISPs if they suffered cyber attacks.