Item 09 Appendix
West Dunbartonshire Council · 5 February 2025
Back to Corporate Services Committee — 5 February 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Some pages contain no extractable text. They may be blank, graphics or scanned pages. OCR has not been applied.
Page 1
1 OFFICIAL People and Technology Cyber Incident Response Plan Appendix
Page 2
2 OFFICIAL Vඍකඛඑඖ Cඖගකඔ Version No Updated By Reason for Update/Area Updated Date Updated DRAFT 0.1 ICT Security Officer Initial draft (replacing previous plan) for review including SG mandatory requirements for continuity across public bodies 20/10/2023 2nd Draft 1.0 ICT Security Officer Removed some comments, added CIRT details, post to RD as Draft 25/7/24 3rd Draft 1.1 ICT Security Officer Updated following meeting with ICT Mgmt, Resilience Officer and Chief Officer (People and Technology) 05/09/24 4th Draft 1.1 ICT Security Officer Updated following meeting with ICT Mgmt, Resilience Officer and Chief Officer (People and Technology) 11/10/24 5th Draft ICT Security Officer Updated for Mgmt review 21/11/24 Final Working draft ICT Security Officer Final Draft for committee review 20/12/24 Aකඞඉඔ Rඍඋකඌ Version No Approval Body Approval Date Effective Date Review Date Draft 0.1 moved to Published 1.0 ICT Management and Steering board Draft 1.1 Dඑඛගකඑඊඝගඑඖ Lඑඛග Name Position ICT Manager, ICT Section leaders x 2 ICT Management team
Page 3
3 OFFICIAL 1. Introduction to the Cyber Incident Response Plan (CIRP)....................................................................6 1.1 Purpose.............................................................................................................................................6 1.2 Central Notification and Co-ordination Policy....................................................................................6 1.3 Alignment to UK National Cyber incident Reporting Protocols..........................................................7 1.4 Scope.................................................................................................................................................7 2. Management Roles and Responsibilities................................................................................................8 2.1 Cyber Incident Response Team (CIRT) & Crisis Management Team (or Strategic/l Resilience Group (SRG/RG))............................................................................................................................................8 2.2 RACI Matrix.......................................................................................................................................8 3. Communications .....................................................................................................................................10 3.1 Management Notification.................................................................................................................10 3.2 Third Parties Notification .................................................................................................................10 4. Cyber Incident Response Process ........................................................................................................11 4.1 Step 1 – Prepare..............................................................................................................................12 4.1.1 Required documentation .........................................................................................................12 4.1.2 Preparation..............................................................................................................................12 4.1.3 Business As Usual information/processes which will assist in any future incident response (Information available prior to any incident)..........................................................................................13 4.1.4 Training & Awareness .............................................................................................................13 4.1.5 Testing.....................................................................................................................................13 4.2 Step 2 & 3 – Identify and Report .....................................................................................................14 4.2.1 Incident Types.........................................................................................................................15 4.2.2 Data Classification...................................................................................................................16 4.2.3 Reporting to the ICO................................................................................................................16 4.3 Step 4 – Analyse and Investigate....................................................................................................17 4.3.1 Cyber Incident Severity Assessment.......................................................................................17 4.4 Step 5 – Containment......................................................................................................................21 4.5 Step 6 – Eradicate...........................................................................................................................23 4.6 Step 7 – Recovery...........................................................................................................................23 4.7 Step 8 & 9 – Reporting and Lessons Identified...............................................................................23 5. Appendix A – Forensic Imaging Guide..................................................................................................25 6. Appendix B – Cyber Incident Response Team (CIRT) Contact Information......................................26 7. Appendix C – Crisis Resilience Management Team (CRMT) Contact Information ...........................26 8. Appendix D – Third Party Support Services Contact Information......................................................27 9. Appendix F – Notifiable Reporting Form...............................................................................................28 10. Appendix G – NCSC Incident Categorisation Framework...................................................................31 11. Appendix H – List of Abbreviations.......................................................................................................33
Page 4
4 OFFICIAL 1. Introduction to the Cyber Incident Response Plan (CIRP) 1.1 Purpose The purpose of this plan is to provide operational structure, processes, and procedures to West Dunbartonshire Council employees, so that they can effectively respond to incidents that may impact the function and security of digital assets, information resources, and business operations. Cyber-attacks can quickly escalate and become a significant business disruptor requiring both business continuity and consequence management considerations. Whilst much of the CIRP will be managed within the IT Services environment, early consideration should be given to engaging both Business Continuity, Resilience Leads and Strategic Resilience Group (SRG) and/or the Resilience Group (RG) as appropriate, in order that the wider issues can be managed. The CIRP will assist West Dunbartonshire Council in identifying, managing, investigating, and remediating various types of cyber incidents. It describes the processes for initiating a response and establishing the structure needed to ensure response execution. This CIRP will also reference procedural documentation that provides operational-level details specific to handling the various incident types. The CIRP cannot anticipate and provide guidance for all potential incidents. Management and incident responders should consider the current situation, business impact, and security needs of West Dunbartonshire Council and balance those against the guidance and recommendations provided by the CIRP. Governance of cyber incident policies, procedures, and planning, is the responsibility of the ICT Management team and the ICT Security Officer. This plan is based on several recommended industry best practices including: The Standard of Good Practice for Information Security 20181 Existing cyber incident response documentation provided by Scottish Public Sector organisations ISO/IEC 27035: 2016 Information Security Incident Management2 1.2 Central Notification and Co-ordination Policy All Scottish Public Sector organisations should comply with the Scottish Public Sector Cyber Incident Central Notification and Co-ordination Policy as part of the Scottish Government Public Section Action Plan (Appendix E and F) which outlines the policy and procedures for notifiable cyber incidents impacting on Scotland’s public services. The trigger for consideration of such notification is defined as incidents or attacks against Scottish public sector network information systems which will: Have the potential to disrupt the continued operation of the organisation or delivery of public services; and/or Carry a likelihood that other public, private or third sector organisations may experience a similar attack, or that the incident could spread to those organisations; and/or 1 Available at: https://www.securityforum.org/solutions-and-insights/standard-of-good-practice-for-information-security/ (last visited 17th Nov 2023) 2 Available at: https://www.iso.org/standard/78973.html (last visited 17th Nov 2023)
Page 5
5 OFFICIAL Could have a negative impact on the reputation of the Scottish public sector or Scottish Government; and/ or Carry the likelihood of Scottish Parliament or national media interest. In such circumstances there is a requirement to notify the National Cyber Security Centre (NCSC), Scottish Government Cyber Resilience Unit (SG CRU) and Scottish Government Resilience officials for incident management and co-ordination purposes and Police Scotland for crime investigation considerations. This reporting mechanism is intended to enable the appropriate levels of external support to be considered that might not be immediately obvious to organisational security teams who are focussed on dealing with the incident at hand. 1.3 Alignment to UK National Cyber incident Reporting Protocols The CIRP acknowledges the National Cyber Incident Management Policy (NCIMP – this is a restricted circulation policy) and the Scottish Public Sector Cyber Incident Central Notification and Co -ordination Policy, that set out the process for managing cyber incidents that have a national impact in both Scotland and the UK context. The NCIMP aligns with the Central Government Arrangements for Responding to an Emergency: Concept of Operations (CONOPS). The NCSC is responsible for officially ‘declaring’ a cyber incident that requires management and co-ordination at a UK level. For context and information on the NCSC incident categorisation framework3 please see Appendix G. 1.4 Scope An Information Security Incident is an incident that specifically impacts upon West Dunbartonshire Council information assets, e.g., the loss, theft, damage, or unauthorised destruction of information; or an item of IT equipment on which such information is stored. Information Security Incidents typically involve a potential impact to the confidentiality or integrity of West Dunbartonshire Council information. Events affecting the availability of West Dunbartonshire Council information are typically handled as Information and Communication Technology (ICT) Service Incidents by ICT Service Management processes in the first instance as such processes are focused on restoring service availability to users as quickly as possible. Loss of service availability is likely to become a security issue where it stems from a deliberate hostile act, or where change is required to avoid repetition. A cyber incident is the subset of Information Security Incidents that affects digital data or ICT assets and does not involve any hardcopy information. For example: a user account compromise, a network intrusion, or a malware outbreak. Cyber incident management is the process of handling all cyber incidents in a structured and controlled way. This plan aims to ensure that: All cyber incidents are managed effectively A consistent approach is implemented to manage cyber incidents The damage caused by a cyber incident is minimised The likelihood of recurrence of the security incident is reduced by the review and implementation of appropriate measures The scope of this plan is limited to cyber incidents affecting the ICT services, electronic data and associated digital assets within the control of West Dunbartonshire Council. For the purpose of this 3 Available at https://www.ncsc.gov.uk/news/new-cyber-attack-categorisation-system-improve-uk-response-incidents (last visited 17th Nov 2023)
Page 6
6 OFFICIAL plan, the following list of IT incidents will not be treated as cyber incidents and therefore are outside the scope of this document: Software problems and technical failures not caused by malicious activity Unavailability of the ICT network and / or systems Performance problems with the corporate ICT network and / or systems Hardware problems and failures 2. Management Roles and Responsibilities 2.1 Cyber Incident Response Team (CIRT) & Crisis Management Team (or Strategic/ Resilience Group (SRG/RG)) Cyber incidents are managed (triage, containment, eradication, lessons identified and reporting) by the CIRT. This team is responsible for analysing security breaches and taking any necessary responsive measures and advising Senior Management and if stood up the SRG of key breaches and the response developed. In most instances the CIRT will be informed of and brought together as a team when relevant breaches/risks have been raised to the group after an assessment of risk has been made by the ICT Manager. It may be that a smaller team from within ICT Services will assess and classify the incident prior to escalation to the CIRT which will likely involve wider non-ICT employees. References to an Extended CIRT will relate to external parties invited as required. The SRG may be stood up to deal with the strategic consequences and decisions that arise from the CIRT incident management. Within West Dunbartonshire Council this team consists of the Chief Executive, Chief Officers and HSCP Heads of Service. The Core CIRT includes key operational employees necessary to identify and triage all cyber incidents within West Dunbartonshire Council. This team will be chaired by the ICT Manager supported by the following employees as required: Information Security Officer ICT Extended management team Other ICT officers with specialist knowledge as required The CIRT will revert to the SRG or RG as determined by incident scope : The CIRT may be extended (Extended CIRT) to incorporate external partners and agencies where this is deemed appropriate in circumstances to add value to the management of the incident. This will often be the case in more complex incidents that lead to escalation. This may include: Existing strategic ICT partners and/or suppliers; 3rd party security specialists, Scottish Government, Police Scotland, and/or the National Cyber Security Centre (NCSC). 2.2 RACI Matrix Delegation, clarity, and accountability are crucial in dealing with cyber incidents that have escalated to requiring a CIRT to be formed. The RACI matrix is a useful tool that assigns responsibility and maps out tasks, milestones or key decisions involved in completing a project such as managing an incident. It assigns which roles are Responsible for each action item, which personnel are
Page 7
7 OFFICIAL Accountable, and, where appropriate, who needs to be Consulted or Informed. It is a very useful tool in the context of developing a CIRP. Responsible: Refers to those who do the work to complete the task. Accountable: Designates the person who ultimately answer for the results of an activity, and who delegates the work to the people who will execute it. Consulted: Refers to those who should be heard on the related activity, and with whom there is two- way communication. Informed: Designates those who sought to be kept up to date on the progress of the activity, and with whom there is just one-way communication. Figure 1 outlines where key responsibilities in the incident handling process fall in the form of a Responsible / Accountable / Consulted / Informed (RACI) matrix. Figure 1 – West Dunbartonshire Council CIRP RACI Matrix Task No. Task ICT Services staff and teams (SPECIFIC TEAMS) IT Services EXTENDED Management Team Managed Service Provider CIRT SRG/RG Third Party Stakeholders Impacted individuals Law Enforcement and Regulators All Staff Insurers and Audit 1 Identifying Incidents R A,R R - - R - - - 2 Reporting Incidents R A, R R - - R - - R 3 Capturing Incidents R A R - - - - - - 4 Assigning Incidents R A R - - - - - - 5 Investigation of Incidents R A R C - R,(I) (I) (I) - (I) 6 Containment of Incidents R A R C - R (I) (I) - (I) 7 Eradication of Incidents R A R C - R - (I) - (I) 8 Recovery from Incidents R A R R,C R R (I) (I) - (I) 9 Review & Learn from Incidents R A,R R R,C C C - (I) R (I) 10 Improve / Prevent Recurrence of Incidents R A,R R C - R (I) (I) - (I) 11 Policy Impact - I R,C (I) - 12 Resilience and Business Continuity Assessment - I R,C (I) -
Page 8
8 OFFICIAL 3. Communications 3.1 Management Notification The Core CIRT will keep the Council’s resilience lead, SRG/RG and associated third parties informed of the details of all confirmed CRITICAL or HIGH severity cyber incidents via the appointed Single Point of Contacts (SPoCs). Identified management and third parties include the following: Council Resilience lead Strategic and/or Resilience Groups Communication with regulatory authorities as required. Contact contracted security specialist third parties for assistance as required. Core respondents within the Scottish Public Sector Cyber Incident Central Notification & Co- ordination Policy Resilience Partnership for early multi agency support and co-ordination arrangements. 3.2 Third Parties Notification The Core CIRT will arrange via the DPO for notification to relevant third parties all confirmed CRITICAL or HIGH severity cyber incidents where the incident has compromised their information, such as payment card/ account data. This would also include situations where the third party has lost data or the data has been compromised that relates to West Dunbartonshire Council and/or our customers. Incidents that would need to be notified include: Loss of Personally Identifiable Information (PII), such as personal details including name, address and telephone numbers of staff or customers- responsibility for potential reporting to the ICO sits with the Council’s Data Protection Officer. Key logger or card skimmer device found DDoS attack where DNS need to be modified Contacting software vendors for modifications to applications to remove exploited vulnerabilities The Core CIRT will notify Cyber incidents requiring support from trusted third-party service providers such as ISP, DNS management, Application Development and Penetration Testing where there is a need to consult with them with regards supporting the management of the incident. Following SRG being stood up, the Core CIRT will notify the relevant authorities of cyber incidents that meet the requirements of the Scottish Public Sector Cyber Incident Central Notification and Co- ordination Policy to: Police Scotland Cyber Unit, The National Cyber Security Centre, The Scottish Government Cyber Resilience Unit.
Page 9
9 OFFICIAL Where incidents do not meet the thresholds of the above policy the Core CIRT will consider notifying Cyber incidents to the NCSC and / Police Scotland and Scottish Government CRU where there is value in improving the rich intelligence picture, other public sector bodies could take mitigation steps or there is a crime worthy of investigation. 4. Cyber Incident Response Process Figure 2 sets out the end-to-end incident handling process in overview. The relationship between the Council cyber incident response steps and the phases set out in the NIST incident handing guide SP 800-614 (the coloured blocks) is shown for reference. Figure 2 – Cyber Incident Response Process 4 Available here: https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf (last visited 17th Nov 2023)
Page 10
10 OFFICIAL 4.1 Step 1 – Prepare The key to minimising the impact and quickly recovering from a cyber incident is in the planning and preparation. A well-trained team that has access to a comprehensive up-to-date set of documentation with a well-managed and monitored ICT estate will greatly improve the response times to a cyber incident. Therefore, the following actions should be undertaken to enable a CIRT to function effectively. 4.1.1 Required documentation The documentation below must be comprehensive, easily accessible to those who require it and contained in a central location, WDC utilise the cloud based Resilience Direct (RD) platform as a central repository and will retain hard copies in the Secure Resilience cabinet located on the 2nd floor in the WDC Church street office. In addition, a library of documents and plans are retained in the ICT cloud based service desk software, Freshservice, and this will soon be available from outside the organisation. Cyber incident Response Plan (this document) Exercise in a box from NCSC and tactical workflows (Playbooks) for specific response actions (under development) Inventory of digital assets (where they exist) The Qualys vulnerability management tool will be used as a starting point, similarly, Education have the Gsuite management console which has information on the Chromebook estate Network Diagrams Documentation of services, protocols, and ports allowed or links where this information resides available via resilience direct (RD documentation is currently being reviewed) Inventory of approved operating systems and applications (Resilience Direct) Configuration standards for all systems Media inventory Detailed Forensic imaging procedures (provision via 3rd party is acceptable) Contact information for: o Core IT CIRT members o CIRT members (Appendix B) o Crisis Reliance Management Team (CRMT) members (Appendix C) o Third Party Support Providers (Appendix D) Along with System Logs where available Change control for all systems as recorded in the Freshservice system 4.1.2 Preparation Gather cyber threat intelligence to enable an understanding of the risks to the business and infrastructure, knowledge of threat actors, their motivation and delivery methods. Threat intelligence sources include: National Cyber Security Centre Threats reports Cyber Information Sharing Partnership (CiSP)
Page 11
11 OFFICIAL Open-source intelligence feeds, including security vendor assessments and security newsfeeds and subscriptions Police Other preparatory activities include: Routine review of the West Dunbartonshire Council security architecture to ensure a comprehensive defensive structure is in place. Reviewing the organisations related policies e.g. Business Continuity policies. 4.1.3 Business As Usual information/processes which will assist in any future incident response (Information available prior to any incident) Availability of known baselines (where available) for network, server, storage, and application performance accounting for fluctuations in demand for known activities e.g., month end, product launch etc. Automated alerting from all systems when their performance or other metrics falls outside the acceptable tolerances Daily review of automated alerts and review of event logs where appropriate Access to Configuration Management type Databases, server database, device database, Freshservice system. Backup and recovery processes for all systems and infrastructure Ensure all system clocks are synchronised with a trusted network time source Implement a cohesive patch management plan for all operating systems and third-party applications Implement a functional vulnerability management program that identifies weaknesses in the West Dunbartonshire Council environment that can be efficiently remediated Consider developing and maintaining partnerships with external third-parties for services such as: o Digital Forensics and other Incident Response services o Regular Phishing simulations and exercises o Credit protection for data breaches o Citizen call centre for use during a data breach o Crisis/reputation management o Threat Intelligence 4.1.4 Training & Awareness Annual CIRT refresher on cyber incident response plan actions Security awareness training is given to all employees as part of the induction process with annual refresher training. Incident Response Training as part of the Civil Contingencies Service WDC maintains a record of all employee security training 4.1.5 Testing West Dunbartonshire Council shall execute a Testing, Training, & Exercise (TTX) program to sustain and refine the organisation’s ability to handle cyber incidents in accordance with the best practices outlined in NIST Special Publication 800-84 Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities. Testing should include:
Page 12
12 OFFICIAL Annual penetration testing Annual internal testing of response plan / playbook, using simulated scenarios including: o Ransomware o Phishing (Every 2nd month) o Distributed Denial of Service (DDoS) o Data loss and theft Testing of Insider threat assessment 4.2 Step 2 & 3 – Identify and Report Any suspected or actual breach of information security policy or systems must be immediately reported to the West Dunbartonshire Council ICT Service Desk by phone call, ICT Management by email and/or text, ICT tech desk if on site at Church Street offices If a suspected breach involves an employee relating to a sensitive issue, then a report can be made directly to the Information Security Officer or to the Head of your service area When reporting a cyber incident, it is important to collect as much information about the incident as possible to enable the ICT service desk to give the incident an initial priority. Key information to be captured should include: Contact information of the person reporting the incident and related parties Host names and IP addresses of suspected breached systems Nature of incident The potential impact of the incident along with which business area is likely to be affected by it Description of the activity and supporting evidence e.g., logs The asset tag/s of any device/s involved Employees have a duty to report, log or respond to a notification of a cyber incident and failure to do so would be considered a serious matter. Once the above information has been obtained, this will allow the ICT Service Desk to assign a service desk priority to the incident, this will then determine whether this is a security incident and needs to be referred to the CIRT and assigned a Cyber Incident priority.
Page 13
13 OFFICIAL 4.2.1 Incident Types Figure 3 below lists incident type and descriptions of the incident: Ref. Incident Type Description 1 Installation or execution of unauthorised/malicious software. Suspected, attempted or actual installation/execution of unauthorised or malicious software on a West Dunbartonshire Council device. Includes malware detections by anti-malware software (even if mitigated successfully) and detections by application whitelisting solutions. 2 Network intrusion, enumeration or another probe. Suspected, attempted or actual network intrusion, enumeration or probe. Includes intrusion alerts generated by network security equipment such as firewalls or IDS/IPS. 3.1 Physical loss, theft or damage of an IT asset. Suspected, attempted or actual physical loss, theft or damage of any ICT asset containing West Dunbartonshire Council data. Includes the loss/theft of laptops, tablets, smartphones or removable media (USB sticks, CDs, DVDs, DATs, etc.). 4 User impersonation (including account compromise/hijack). Suspected, attempted or actual instances of user impersonation. Includes password-sharing, attacks on authentication controls, impossible log-on scenarios, zombie user accounts, etc. 5 Suspicious privilege amendment. Suspected, attempted or actual instances where a genuine user appears to have been placed in an inappropriate user group or to otherwise have gained excessive privileges. 6 Suspicious use of legitimate privileges. Suspected, attempted or actual instances where a user appears to have abused legitimate access privileges; e.g. by accessing a large number of files/records, e-mailing data to unauthorised recipients, copying data to removable media or unusual network locations, etc. 7 Eavesdropping on a legitimate communication channel. Suspected, attempted or actual instances where West Dunbartonshire Council data appears to have been intercepted by an unauthorised party. Includes instances where sensitive data is transferred to authorised recipients in unencrypted form. 8 Service spoofing (e.g. MITM). Suspected, attempted or actual instances where a data service belonging to, or used by, West Dunbartonshire Council is spoofed by a third party. Includes fake West Dunbartonshire Council websites. 9 Denial of Service / excessive resource consumption / spam). Suspected, attempted or actual instances where an entity places an excessively high demand on a given information system or asset. Includes Denial of Service and spam. 10.1 Phishing Suspected, attempted or actual instances where: Persons within West Dunbartonshire Council receive an email which claims to be something, or from someone, that it is not. Persons outside West Dunbartonshire Council receive an email which claims to be from or to otherwise represent West Dunbartonshire Council, but is not. 10.2 Social engineering Suspected, attempted or actual instances where an unauthorised person attempts to gain access to West Dunbartonshire Council data or ICT systems by deception or extortion of authorised users (staff, customers or third parties).
Page 14
14 OFFICIAL 11 Inappropriate use of IT facilities (including inappropriate web browsing). Suspected, attempted or actual instances where a user uses a system to which they have authorised access in a manner that is illegal, in breach of West Dunbartonshire Council policy or otherwise contrary to workplace norms. This includes: browsing websites that are inappropriate for the workplace; sending threatening, obscene or harassing communications; or accessing/storing illegal material (including in breach of copyright). 12 Other harmful mode not listed Any event that is deemed to be a security event that falls within the remit of the CIRT, but which does not fall into any of the above categories. Figure 3 – Incident Types 4.2.2 Data Classification West Dunbartonshire Council possesses and stores information with varying levels of sensitivity. If a cyber incident occurs, the response will depend on the type of data stored on the affected systems. The CIRT should review the Councils Security Classification guidance. Figure 4 below provides a high-level summary for data classifications. Classification Description OFFICIAL Information which will be disclosed in response to a FOISA request, but which the Council does not wish to publish pro-actively and would not want to release in an uncontrolled and out of context manner Information is restricted to employees or other contracted persons working on behalf of the Council. This may include information published on the Council’s Intranet/Internet site and Council policies OFFICIAL-SENSITIVE Information which is shared on a need know basis which could have damaging consequences (for individuals or the Council generally) if it were lost, stolen or published in the media. Such information assets are conspicuously marked OFFICIAL – SENSITIVE Figure 4 – Data Classifications 4.2.3 Reporting to the ICO In line with the GDPR (Article 33) the ICO must be informed within 72 hours of the organisation becoming aware of a reportable data breach. The DPO shall determine whether the incident amounts to a data breach which requires to be reported to the ICO. Further guidance can be found at https://ico.org.uk/. Where a decision to notify the ICO has been made, the following must be included as a minimum: Describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned, and the categories and approximate number of personal data records concerned. Communicate the name and contact details of the contact point where further information can be obtained. Describe the likely consequences of the personal data breach.
Page 15
15 OFFICIAL Describe the measures taken or proposed to be taken to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects. Where an incident under investigation meets the reporting requirements of the Scottish Public Sector Cyber- Incident Central Notification and Co-ordination Policy, then core organisations including Police Scotland and the NCSC will have been informed and able to offer incident management and investigative support where appropriate. Where incidents fall below this policy position consideration will be given to informing the NCSC and Police Scotland of the incident. This decision will be taken by CIRT and reporting actions undertaken by the Information Security Officer. 4.3 Step 4 – Analyse and Investigate The Core CIRT will perform an initial triage and classification of all suspected cyber incidents to confirm the validity and the potential impact of the incident. The initial classification may be changed once more detailed investigation has been carried out. The initial classification should be retained so that this can be used to help refine and improve the overall incident response process. All incidents (once declared as being a “Cyber Incident”) will be given an initial priority 1 (Critical) by the ICT Service Desk. All CIRT members will be contacted with details of the cyber incident. Once an alert has been received, the Core CIRT must research the event, leveraging rapid data collection and initial analysis (triage). The goal of the triage is to acquire enough pertinent preliminary information to appropriately determine both the data classification involved and the estimated severity of the incident. The initial Incident Responder (initial entity to receive the alert or be assigned the alert) shall conduct an initial assessment and provide a data classification and a preliminary incident severity to the Incident manager. The Core CIRT should appropriately note and/or close out incidents involving false-positives according to the appropriate incident-tracking procedures. Where a confirmed incident meets the severity score is determined as high or critical, it must be escalated to the CIRT and the Chief Officer People & Technology, as the Council Resilience Lead, alerted. 4.3.1 Cyber Incident Severity Assessment Incident severity as annotated in Figure 4 is guided by the consideration of two separate components: “Type of Threat” and “System/Information Criticality.” 4.3.1.1 Types of Threat The following is an explicit description of these threats in descending order of criticality: Types of Threat Description Threat Level 1 Human-Controlled Root-Level Compromise - Unauthorised external personnel (cyber intrusion). - Partner organisation exceeding authority. - Internal personnel exceeding authority. Close-Access Breach (physical penetration of a site) - Rogue wireless access point. - Router re-direct. Threat Level 2 Human-Controlled User-Level Compromise - Unauthorised external personnel (cyber intrusion). - Partner organisation exceeding authority. - Internal employee exceeding authority.
Page 16
16 OFFICIAL Threat Level 3 Automated (malware-controlled) Root-Level Compromise Threat Level 4 Automated (malware-controlled) User-Level Compromise Threat Level 5 Denial of Service Threat Level 6 Focused Scanning or Unmanaged Malware 4.3.1.2 System/Information Criticality The criticality of systems and information that is potentially at risk is the second component to guiding the assessment of the severity of an incident. The following is an explicit description of these system/information criticalities in descending order of importance: System/Information Criticality Description Criticality Level 1 Enterprise-Wide Network Resources (Revenue-Generating Services, Routers, Switches, DNS, Proxies Firewall etc.). Criticality Level 2 High Criticality Information – Confidential Information (Intellectual Property, PII, PHI etc.). Criticality Level 3 High Criticality Systems (Active Directory, Exchange, Web Services etc.). Criticality Level 4 Sensitive Information – Restricted Information (Sensitive Corporate Information, non-PII, Financial Transaction Information etc.). Criticality Level 5 Non-Critical Multi-Use Systems (File Servers, SharePoint etc.). Criticality Level 6 Individual Systems and Non-Sensitive Information. 4.3.1.3 Overall Incident Severity Score The overall impact of the type and criticality is established using the matrix below, providing an initial estimation of the Incident Severity. Incident TypeSystem/Information Criticality 1 2 3 4 5 6 1 Critical Critical Critical High High Medium 2 Critical Critical High High Medium Medium 3 Critical High High Medium Medium Medium 4 High High Medium Medium Medium Low 5 High Medium Medium Medium Low Low 6 Medium Medium Medium Low Low Low Figure 4 – Incident Severity Assessment Matrix
Page 17
17 OFFICIAL 4.3.1.4 Incident Severity Guidance The following guidelines are for categorising the severity of an incident based on the known facts of the incident and the subsequent impact to the organisation. The prioritisation of how to resource the response to the incident is a critical decision point in the process. The CIRT should handle incidents based upon the risk they pose to West Dunbartonshire Council, its information, and computing environment. This section describes the severity levels and the structure used to determine this. The Core CIRT will normally handle severity levels assessed as LOW and MEDIUM, whilst the CIRT will normally handle severity cases assessed as HIGH or CRITICAL Severity Level Impact to West Dunbartonshire Council Incident Response Characteristics CRITICAL Highest severity level. Impacts are extraordinary and potentially catastrophic to the proper conduct of Council business, loss of public trust, and/or impact on Council operations or personnel. Impacts that are indicators of this degree of severity are: Threat to life or physical safety of the public, customer, or Council personnel. Significant destruction of ICT systems/applications. Significant destruction of corporate capabilities. Significant disruption of Council business operations over a sustained period of time. Massive loss of confidential information. Significant loss of public confidence. Dramatic reputational damage. Risk of financial loss (generally more than £500,000). This level requires immediate and continual response actions from the CIRT and must include as a first step, notifying the Chief Officer of People and Technology. An incident of this severity has the most significant impact on Council operations and involves an extensive, persistent, and usually very sophisticated attack that is difficult to contain, control, or counteract. This level of severity will trigger the Scottish Public Sector Cyber Incident Central Notification and Co- ordination Policy. Indicators of this are: Senior council leadership will have an immediate and ongoing interest in the incident, the investigation, and the eventual recovery from the incident. Major external support from multiple organisations would be engaged. Would likely involve law enforcement. Would likely involve multiple levels of regulatory or compliance reporting. Would likely involve engagement by multiple media outlets. HIGH Impacts are substantial to the proper conduct of Council business, loss of public trust, and/or impact on Council operations or personnel. Impacts that are indicators of this degree of severity are: Impactful destruction of some ICT systems/applications. Impactful destruction of some corporate capabilities. Substantial disruption of Council business operations over a sustained period of time. Substantial loss of confidential information. Substantial loss of restricted information. Substantial loss of public confidence. This level requires immediate response from the Core CIRT and must include as a first step, notifying the Chief Officer of People and Technology. The Extended CIRT must also be notified. Most of the Extended CIRT will likely be engaged at some point of the incident response effort. This level may involve extended work hours, to include weekends, or could involve 24/7 response activities. An incident of this severity has a real and negative impact on Council operations and involves a persistent or sophisticated attack that requires substantial resources to contain, control, or counteract. This level of severity will trigger the Scottish Public Sector Cyber Incident Central Notification and Co-ordination Policy. Indicators of this are:
Page 18
18 OFFICIAL Substantial reputational damage. Risk of financial loss (generally between £100,000 and £500,000). Senior council leadership will have an interest in the outcome of the incident, the investigation, and the eventual recovery from the incident. External support from multiple organisations will likely be needed to resolve. Would likely involve law enforcement. Would likely involve some level of regulatory or compliance reporting. Would likely involve engagement by some media outlets. MEDIUM Impacts are moderate to the proper conduct of Council business, and/or impact on Council operations or personnel. Impacts that are indicators of this degree severity are: Moderate disruption of Council business operations over a sustained period of time. Multiple sites or multiple business units affected by the incident. Moderate loss or manipulation of restricted information. Limited loss of public confidence. Limited reputational damage. Risk of financial loss (generally between £25 and £100,000). This level requires notification to the Council CIRT. Several or most Council CIRT members will be engaged in some aspect of the response effort. The Extended CIRT must also be notified. Selected Extended CIRT members may be engaged at some point of the incident response effort. This level may involve extended work hours initially, and will revert to a normal working schedule once initially contained. An incident of this severity has some impact on Council operations and involves an attack that requires an organised response to contain, control, or counteract. This level of severity will trigger the Scottish Public Sector Cyber Incident Central Notification and Co- ordination Policy. Indicators of this are: External support may be needed, and will be engaged as needed. May involve law enforcement. May involve some limited level of regulatory or compliance reporting. Would likely not involve media outlets.
Page 19
19 OFFICIAL LOW Impacts are greatly limited to the proper conduct of Council business, and/or impact on Council operations or personnel. Impacts that are indicators of this degree severity are: Limited or no disruption of Council business operations. One site or business unit affected by the incident. Limited or no unauthorised access to restricted information. No impact to public confidence. No impact to reputation. Risk of financial loss (Under £25,000). This level requires handling by a cyber or incident response team member (Core CIRT) and some Extended CIRT members may be notified if deemed necessary. This level of response is conducted during normal working hours. An incident of this severity has limited or no impact on Council operations. Indicators of this are: External support is generally not needed. Law enforcement is generally not engaged. Regulatory reporting is not warranted. Would likely not involve media outlets. Figure 5 – Incident Severity Assignments 4.3.1.5 Key Escalation Contacts Contact Details The Scottish Government Cyber Resilience Unit (CRU) Email: cyberresilience@gov.scot Phone: Police Scotland Email: C3DivisionServiceOverview@scotland.pnn.police.uk Phone: dial 101 ask for Duty Cyber Officer SGoRR Email: SGORRInformation@gov.scot Pager: NCSC Incidents Team Email: Incidents@ncsc.gov.uk Phone: 3000 200 973 External Contracted Cyber Partner 4.4 Step 5 – Containment The CIRT or Core CIRT will take actions to contain and isolate the incident from the council network; this may include the following: Isolating a system from the network Removing users access privileges Stopping services running Isolating connections to external partner’s networks to prevent spread to other organisations Identifying systems and services affected including details of: o Host names, o IP addresses,
Page 20
20 OFFICIAL o MAC addresses, o Active services, o Locations Identifying times and source IP addresses of the attack including the following details o Host names, o IP addresses, o MAC addresses, o Protocols, o Locations, o Time, o User accounts used If required contact specialist external support services to assist in the containment and evidence gathering. Details of handling procedures for specific attacks, including DDoS, Hacking, Suspicious Activity (virus or malware, loss, or theft of data) will be detailed in the cyber playbooks (currently under development) Handling procedures for forensic evidence Maintain the state of the affected system (i.e., do not power off) Identify all potential sources of available evidence which may include: o Storage media (HDD, DVD, USB, Tape) o Live data (RAM, IM, network connections, encrypted files, and folders) o Application data (temporary files and folders, browser history, email, images, swap file, hibernation files) o Servers (active directory, email, internet server, web server, encryption key distribution, authentication servers); o Logs (event, traffic, AV, software) o Mobile phones (call history, contacts, emails, photos, videos, SMS, calendars, locations) o Sat Nav (journeys, locations) o Electronic Files (documents, databases, spread sheets, PDFs, presentations) o Hard files (printed copies, bills, invoices, receipts, notes, diaries) o Meta data (dates, times, authors, accessed, created) Log all actions taken including: o Name, date, and time of the person collecting the evidence o How the evidence was collected, preserved, duplicated, analysed and stored o If possible, have a witness to the process of the forensic evidence being taken. o Secure system logs to prevent them being overwritten or deleted until the security incident has been closed. o If relevant, undertake forensic copies from computer memory to a file, and take a back -up of the file. o If relevant, take a forensic image (copy) of the computer hard drive(s), which will be used for further analysis, to ensure that the evidence on the original system is unharmed. o Forensic evidence of a breach or suspected breach must be secured within 24 hours. o Forensic evidence must only be gathered by trained personnel or specialist third parties o Untrained employees must not attempt to gather forensic evidence, (ICT employees use post titles please and above will be assigned this task)
Page 21
21 OFFICIAL A forensic imaging guide has been provided within Section 5. Appendix A for the purpose of forensically preserving data. *If in any doubt advice should be sought from Police Scotland specialists on handling evidence. 4.5 Step 6 – Eradicate The objective of the eradicate step is to: Correct the incident by addressing its symptoms (e.g., healing malware infections or correcting access control lists). Prevent its immediate reoccurrence by addressing its root cause. For example: changing networking rulesets, moving the target host to a different network segment and/or IP address, or constraining access to the target data to the minimum possible subset of users. Cyber Incident Playbooks provide details of eradication considerations for specific attacks and should be referred to as appropriate 4.6 Step 7 – Recovery Actions can be taken to restore services back to the pre-incident state once the CIRT or Core IT CIRT confirm the remediation actions have been successful. However careful monitoring of the estate should be taken to ensure any vulnerabilities have been successfully closed. The recovery actions will include the following: Ensure that the impacted services are accessible again Ensure performance is in line with known (pre-attack) baseline Switch back traffic to the original network Restart stopped services Continue to monitor the performance/activities of the affected systems Confirm application behaviour is as expected Conduct vulnerability scan if deemed appropriate 4.7 Step 8 & 9 – Reporting and Lessons Identified All cyber incidents will have a cyber incident report created. Cyber incidents will be fully reported and reviewed within 5 days of the incident resolution. Summary reports of all incidents will be reviewed at the next ICT Steering board/Resilience meeting whose members will decide on actions to take forward from the cyber incident report. A cyber incident review is important so the business and CIRT can improve the systems and procedures to reduce the impact of future cyber incidents. Where external partners have been involved in the incident management process, consideration should be given to their involvement in the post incident debrief (which will form the lessons identified). Where appropriate the Resilience Lead from the Civil Contingencies Service will be tasked with sharing the lessons identified with the wider Resilience Partnerships through the Local and Regional Partnership structures. Details to be captured in a cyber incident report include:
Page 22
22 OFFICIAL Following the publication of a given Incident Report, the Information Security Officer will: Seek recipient feedback in relation to the incident report Confirm the viability of each security control change/addition recommended in the incident report Identify a proposed action owner and action target date for delivering each proposed recommendation Identify the proposed funding route for each proposed recommendation that requires financial expenditure Seek the ICT Managers endorsement of the proposed actions and associated funding routes Seek the action owner’s acceptance of the relevant actions and target dates Review, at not less than monthly intervals, progress with each action with each action owner Notify the ICT Manager of any action at risk of not being delivered prior to its target date Consider sharing the lessons identified with appropriate external partners, including but not limited to Police Scotland, Scottish Government (CRU and lead Policy team), Resilience Partnerships, SGoRR, ScoRDS and NCSC
Page 23
23 OFFICIAL 5. Appendix A – Forensic Imaging Guide The steps listed below are a guide to assist in the capture of forensic images. Forensic evidence must only be gathered by trained personnel. Failure to follow the correct procedure when creating a forensic image can result in the image being inadmissible as evidence If a forensic bridge/write blocker is available, remove the HDD from the machine and attach it to the write blocker which in turn is connected to an imaging machine. Proceed to take a forensic image using forensic imaging software which should be installed on the imaging machine and refer to the official user guide if required If a forensic bridge is unavailable or it is impractical to remove the HDD from the machine then boot the machine to a live Linux distribution, such as Raptor v3.0. Ensure that the boot options are known for that particular machine and that the BIOS is configured to allow booting from USB or disc. To help ensure Windows does not boot if the live boot is missed, be prepared to disconnect from the power immediately (always remove the battery from laptops) Once successfully booted, the imaging wizard should automatically launch. Attach a destination drive where the forensic image is to be copied to and proceed to image using the wizard and refer to the official Raptor user guide if required For both forensic imaging software and Raptor, ensure the verification option is checked and hash values produced (see image on next page) Enter the machine’s BIOS settings and record (take photo) as a minimum of the system clock settings For cases involving theft, fraud, computer misuse, unauthorised access and other cases involving where the user is under investigation, check optical drives for discs, USB ports for other media which should be labelled, placed in an evidence bag and placed in locked storage pending an investigation. Do NOT browse these devices live If unable to capture a forensic image using the provided tools secure the device and seek advice from Head of Digital & Community Safety as soon as practically possible as third parties may need to be informed Do NOT boot the machine and perform a live analysis unless all other methods have been exhausted and advice sought from the Head of Digital & Community Safety If the infected machine is remote, instruct the user accordingly: o For malware, remove from the network. If forensic imaging software is available instruct the user how to image RAM and hard drive, disconnect power and return the machine and RAM/drive image to IT for further imaging and analysis o For other types of investigation, such as misuse, inform a line manager to disconnect the power and seize the machine for return to IT, ensuring all actions have been recorded and that no one interferes with the evidence If the suspected user(s) is no longer an employee and the machine is not in use, consider seizing and place in an evidence bag after a forensic image has been captured, record all details and place in locked storage. If the machine needs to be re-introduced into the business (i.e. issued to another user) the HDD should be removed and placed in an evidence bag, then a new HDD placed in the machine ready for re-issue. If not then the HDD must be securely erased rather than simply formatting and re-building with the corporate image. If the machine is currently in use by another user, capture a forensic image (RAM not required) and record details of when the new user came into possession of the machine. Virtual servers – Forensic image is not required, but obtain a snapshot or clone (VMSN, VMDK) for investigation and reset to last known good state
Page 24
24 OFFICIAL 6. Appendix B – Cyber Incident Response Team (CIRT) Contact Information Name Job Role Email Phone Redacted 7. Appendix C – Crisis Resilience Management Team (CRMT) Contact Information Name Job Role Email Phone Office Hours Refer WDC’s IMCD (Incident Management Contact Details)
Page 25
25 OFFICIAL 8. Appendix D – Third Party Support Services Contact Information Supplier Description of Services Email Phone Refer ICT BC/DR plans
Page 26
26 OFFICIAL 9. Appendix F – Notifiable Reporting Form First point of notification should always be via Chief Officer People and Technology and the SIRO and/or CEO, thereafter; Notifiable Scottish Public Sector Cyber Incidents are defined as incidents or attacks against Scottish public sector network information systems which: have the potential to disrupt the continued operation of the organisation or delivery of public services; and/or carry a likelihood that other public, private or third sector organisations may experience a similar attack, or that the incident could spread to those organisations; and/or could have a negative impact on the reputation of the Scottish public sector or Scottish Government; and/or carry the likelihood of Scottish Parliament or national media interest. Scottish public sector organisations who are impacted by notifiable cyber incidents should complete the notifiable cyber incident reporting form below as early as possible and, if email services are available, send the completed form simultaneously to the following addresses in addition to those relevant to your own organisational requirements: The National Cyber Security Centre (NCSC): Incidents@ncsc.gov.uk The Scottish Government Cyber Resilience Unit (CRU): cyberresilience@gov.scot Police Scotland: C3DivisionServiceOverview@scotland.pnn.police.uk SGOR: SGORRInformation@gov.scot These services are available 24 hours a day, 7 days a week, and can be contacted at any time in the event of a notifiable cyber incident. The ‘follow up’ numbers are as follows: The National Cyber Security Centre (NCSC): 03000 200 973 The Scottish Government Cyber Resilience Unit (CRU): 0300 244 4000, ask for CRU Duty Officer Police Scotland : 101 and ask for the Cyber Crime Unit On Call Officer SGoRR: 07623 514719 (pager) SGoRR Duty Officer Where public sector organisations are aware that sector / network-specific co-ordinating bodies also have an interest, or role to play, in a notifiable cyber incident, they should copy these bodies into the email. In the event that any central co-ordinating body (SG CRU, Police Scotland, NCSC) is notified of a notifiable cyber incident involving a Scottish public sector organisation that has not been reported through the “Report it Once and Follow Up” procedure outlined above, it will seek agreement from the organisation affected to inform the other central coordinating bodies and sector/network-specific coordinating bodies.
Page 27
27 OFFICIAL PLEASE DO NOT FILL THIS FORM IN ON ANY NETWORK YOU BELIEVE HAS BEEN COMPROMISED. USE A SEPARATE SYSTEM TO FILL THIS IN. Your Name Your Phone Number Your Contact Email Address (The email address from an uncompromised system that all further correspondence should be sent to.) Your Company Email Address (The email address from an uncompromised system that all further correspondence should be sent to.) What Organisation are you reporting an incident for? What is your Role? Summary of Incident Are you sharing this with us for information or do you require advice and assistance from Police Scotland (investigation) NCSC (Incident Management) or SG CRU (Ministerial awareness or threat sharing) If assistance please specify Do you have an Internal ID for the incident? Investigation so far Impact Description of Impact Current state of incident
Page 28
28 OFFICIAL Notification: Have you reported this to: Scottish Government Cyber Resilience Unit? Yes No NCSC? Yes No Police Scotland? Yes No Information Commissioner’s Office (ICO) as a GDPR obligation? Yes No N/A Relevant Competent Authority (CA) as a NIS Directive obligation? Yes No N/A Who else has been notified? e.g external specialist response providers, Resilience Partners Do you have any further data or samples to aid this incident? Yes No Information Sharing: Has any information been shared on the CISP? Yes No Do you have information you wish to have shared across the CREW network ? Yes No If yes please provide the message content providing information that would enable other network defenders to take mitigating action. Are there Media lines prepared is so can they be provided?
Page 29
29 OFFICIAL 10. Appendix G – NCSC Incident Categorisation Framework NCSC defines the following: Cyber-attack: Attempts to damage, disrupt or gain unauthorised access to computer systems, networks or devices. Small & medium sized organisations: Businesses, charities, clubs and schools with up to 250 employees. Likely to not have a dedicated team managing cyber security. Large organisations: Businesses, charities and critical national infrastructure with more than 250 employees. Likely to have a dedicated team managing cyber security. Category Category definition Who responds? What do they do? Category 1 National cyber- emergency A cyber-attack which causes sustained disruption of UK essential services or affects UK national security, leading to severe economic or social consequences or to loss of life. Immediate, rapid and coordinated cross- government response. Strategic leadership from Ministers / Cabinet Office (COBR), tactical cross- government coordination by NCSC, working closely with Law Enforcement. Scottish Government Resilience Room (SGoRR) activated and would take a co-ordination role working with COBR. Coordinated on-site presence for evidence gathering, forensic acquisition and support. Co-location of NCSC, Law Enforcement, Lead Government Departments, Devolved Administrations and others where possible for enhanced response. SGoRR undertakes multi agency co- ordination role in Scotland. Category 2 Highly significant incident A cyber-attack which has a serious impact on central government, UK essential services, a large proportion of the UK population, or the UK economy. Response typically led by NCSC (escalated to COBR if necessary), working closely with Law Enforcement as required. Cross-government response coordinated by NCSC. SGoRR activated and would take a leading co-ordination role working with COBR if activated. SG CRU would act as the interface with the NCSC. NCSC will often provide on-site response, investigation and analysis, aligned with Law Enforcement criminal investigation activities. SGoRR undertakes multi agency co- ordination role in Scotland. SG CRU acts as the interface with the NCSC. Category 3 Significant incident A cyber-attack which has a serious impact on a large organisation or on wider / local government, or which poses a considerable risk to central government or UK essential services. Response typically led by NCSC, working with Law Enforcement as required. SGoRR likely to be activated and would take a leading co-ordination role. SG CRU would act as the interface with the NCSC. NCSC will provide remote support and analysis, standard guidance; on-site NCSC or Law Enforcement support may be provided. SGoRR undertakes multi agency co- ordination role in Scotland. SG CRU acts as the interface with the NCSC.
Page 30
30 OFFICIAL Category 4 Substantial incident A cyber-attack which has a serious impact on a medium- sized organisation, or which poses a considerable risk to a large organisation or wider / local government. Response led either by NCSC or by Law Enforcement dependent on the incident. SGoRR may be activated and, if so, would take a leading co-ordination role. SG CRU would act as the interface with the NCSC. NCSC or Law Enforcement will provide remote support and standard guidance, or on-site support by exception. SGoRR (if activated) undertakes multi agency co-ordination role in Scotland. CRU acts as the interface with the NCSC. Category 5 Moderate incident A cyber-attack on a small organisation, or which poses a considerable risk to a medium- sized organisation, or preliminary indications of cyber activity against a large organisation or the government. Response led by SG CRU, Law Enforcement working with Organisation as appropriate SG CRU working with Lead Policy Area to provide co- ordination role, inc. considering Ministerial briefing and intelligence sharing opportunities. Law Enforcement will provide remote support and standard guidance, with on-site response by exception. Scottish Government CRU working with Lead Policy Area to co -ordinate briefings to Scottish Ministers encourage intelligence sharing, and accessing appropriate advice and guidance from NCSC and Police Scotland. Category 6 Localised incident A cyber-attack on an individual, or preliminary indications of cyber activity against a small or medium-sized organisation. Response led by SG CRU, Law Enforcement working with Organisation as appropriate SG CRU working with Lead Policy Area to provide co- ordination role, inc. considering Ministerial briefing and intelligence sharing opportunities Remote support and provision of standard advice. On-site response by exception. Scottish Government CRU working with Lead Policy Area to co -ordinate briefings to Scottish Ministers encourage intelligence sharing, and accessing appropriate advice and guidance from NCSC and Police Scotland.
Page 31
31 OFFICIAL 11. Appendix H – List of Abbreviations Abbreviation Meaning CIRP Cyber incident Response Plan CIRT Cyber incident Response Team CISO Chief Information Security Officer CiSP Cyber Information Sharing Partnership CMDB Configuration Management Database CMT Crisis Management Team COBR Cabinet Office Briefing Rooms CONOPS Concept of Operations CRO Chief Risk Officer DDOS Distributed Denial of Service DNS Domain Name System DPO Data Protection Officer HR Human Resources ICO Information Commissioner’s Office IP Internet Protocol ISM Information Security Manager ISO Information Security and Digital Risk Officer IT Information Technology MAC Media Access Control MITM Man in the Middle NCIMP National Cyber incident Management Policy NCSC National Cyber Centre NIST National Institute of Standards and Technology RACI Responsible / Accountable / Consulted / Informed SG CRU Scottish Government Cyber Resilience Unit SGoRR Scottish Government Resilience Room SIEM Security Information and Event Management SPoC Single Point of Contact TTX Testing, Training, & Exercise
Page 32
No embedded text on this page.