JFSC / CERT / NCSC warning about raised cyber threat following the invasion of Ukraine

The JFSC cyber risk update provides information on:-

1. Jersey's Cyber Emergency Response Team (CERT) statement of imminent cyber risk
2. The availability of The UK's National Cyber Security Centre [NCSC's] Early Warning Service available to all Jersey-based organisations
3. Suggestion to Register for updates from CERT.JE via their newsletter for information if the risk situation develops.
4. Suggestion for all firms to Inform CERT.JE of any unusual cyber activity
5. Reminder and operation of Critical Cyber Security Controls

Starts

• The JFSC has reissued a statement from Jersey's Cyber Emergency Response Team (CERT) [https://cert.je/]

2021. Jersey's Cyber Emergency Response Team has been closely monitoring recent developments in Ukraine, including a series of cyberattacks in January and February 2021.
2022. These attacks have included both distributed denial of service attacks (DDoS) and malware designed to render information systems inoperable.
2023. Several of these attacks have been attributed by UK and US authorities to Russia's Main Intelligence Directorate (GRU).
2024. Whilst there no evidence of a specific threat to Jersey organisations, there has been an historical pattern of cyber-attacks on Ukraine with international consequences and local organisations are asked to prepare for an increase in malicious cyber activity.
2025. Similar warnings have been issued by other national cyber authorities including NCSC (UK) and CISA (USA).
2026. Such attacks are likely to be followed by an increase in criminal or hacktivist (cyber activist) led cyber- attacks.
2027. We are currently tracking follow-on cyber activity targeted primarily at government bodies, financial services, critical infrastructure and their direct supply chains.
2028. The situation is increasingly unpredictable and this raised threat level is likely to persist.
2029. Jersey based organisations operating in the financial services, government and public services, professional services and critical infrastructure sectors are therefore strongly encouraged to take the following immediate steps to minimise the risk of a successful cyber-attack. The below advice is also appropriate for organisations outside these sectors as cyber-attacks can be indiscriminate.

• AWARENESS AND ALERTING AND REGISTER FOR NCSC'S EARLY WARNING SERVICE.
  1. We have confirmed that NCSC will make NCSC's Early Warning Service available to all Jersey based organisations.
  2. This provides alerts when intelligence suggests your network or systems may be compromised.
• REGISTER FOR NCSC'S CYBER INFORMATION SHARING PORTAL (CISP) –
  1. Channel Islands node to receive and share intelligence on potential or actual attacks.
  2. JE will sponsor applications for CiSP from Jersey based organisations following a request to hello@cert.je.
  3. Register for updates from CERT.JE via our newsletter or social media (twitter and LinkedIn) so we can inform you quickly if the situation develops.
• REPORT UNUSUAL CYBER ACTIVITY VIA CISP
  1. Inform CERT.JE of any unusual cyber activity via
     • CiSP (Channel Islands Node) or
     • alternatively via email to incidentreports@cert.je.

• OPERATION OF CRITICAL CYBER SECURITY CONTROLS

1. Ensure that good cyber hygiene practices are followed consistently and internal controls are assessed against a recognised framework such as

• CyberEssentials Plus,

NIST CSF,

NCSC's Common Assurance Framework or ISO 27001.

Follow guidance from NCSC on actions to take when the threat level is heightened.

Ensure patching is up to date on all systems, including device firmware, with a particular focus on core IT infrastructure and externally facing systems.

Ensure externally facing services such as websites are protected from Distributed Denial of Service (DDoS) attacks by implementing cloud-based DDoS protection services.

Implement multifactor authentication (MFA) for all accounts and operate additional controls to secure highly privileged accounts.

Ensure employees are aware of good cyber hygiene practices, including the use of multifactor authentication for personal accounts.

Incident Readiness & Response Planning

1. Ensure cyber incident response plans are reviewed and tested on a regular basis.

• Ensure backup data is effectively segregated and undertake test restores on a regular basis.

Sources

• Further advice and assistance is available from local cyber security providers and from CERT.JE
• JFSC source https://www.jerseyfsc.org/news-and-events/invasion-of-ukraine-raised-cyber-threat/