Lessons From The UK Government Foreign Office Cyber Incident

When news broke that the United Kingdom Foreign, Commonwealth and Development Office (FCDO) had suffered a cyber incident, the writer’s immediate reaction was not surprise, but concern; not just for government systems, but for what this episode illustrates about the evolving cyber risk landscape.

As a solicitor who regularly advises organisations in the immediate aftermath of cyber incidents, the writer sees first-hand how disruptive and costly these events can be. The FCDO incident, reportedly involving unauthorised access to IT systems but with a “fairly confident” assessment that individual personal data was not at high risk (which as a side note, the writer finds surprising given that it was principally visa data that was accessed and such data must have an abundance of personal data protected by the data protection legislation), is a useful reminder that even well-resourced, security-conscious organisations are not immune. Put simply, if the UK government can become a victim of a cyber-incident, any businesses and/or individuals are at risk.

The legal, operational and reputational issues raised by incidents like this are strikingly similar across sectors, whether you are a government department, a professional services firm or a growing SME. Whilst you cannot guarantee that you will not become a victim, there are steps that you can take to reduce your risk and planning that can be put in place to allow your organisation to recover quickly if the worst were to happen.

What the incident tells us

Public reporting indicates that:

In the writer’s experience, identifying the breach itself is often only half the problem. The response, particularly in the first 72 hours, can significantly affect legal exposure and, more importantly, whether the organisation survives the attack.

The legal reality after a cyber incident

When organisations call us after discovering a breach, they are usually grappling with three urgent questions:

Even where risk to individuals is ultimately assessed as low, organisations must be able to show that they followed a structured, documented decision-making process. Regulators are far more forgiving of a breach that is well-managed than one that is poorly documented.

How to reduce the risk of falling victim to a cyber incident

Whilst no system is completely immune, there are clear, practical steps organisations can take to reduce their likelihood of becoming the next headline.

1. Strengthen access controls

Many incidents we have advised upon stem from compromised credentials rather than sophisticated exploits (i.e. it is human error as opposed to a physical weakness in the system). This can be mitigated significantly by:

2. Keep systems updated and patched

Out-of-date software remains one of the most common entry points for attackers.

• Apply security patches promptly, particularly for internet-facing systems;
• Maintain an accurate asset register so nothing is “forgotten”; and
• Monitor for known vulnerabilities relevant to your environment.

Failure to patch is frequently cited by regulators as evidence of inadequate security measures. Obviously, not every organisation is large enough to have its own in-house IT department. In the absence of such a department, an independent IT/cyber-security expert should be engaged to review systems and advise on steps that could be taken to strengthen security.

3. Encrypt sensitive data

Encryption is one of the most effective legal risk-reduction tools available.

If encrypted data is accessed, the legal assessment of risk to individuals is often significantly reduced, as hackers would most likely be unable to read or use the data accessed.

4. Train staff to recognise threats

As stated above, human error remains a leading cause of breaches.

• Provide regular phishing and cyber-awareness training;
• Encourage staff to report suspicious activity without fear of blame; and
• Run simulated phishing exercises to test readiness.

From a solicitor’s perspective, training records can be invaluable evidence of compliance if a breach occurs. There is no such thing as too much training in respect of cyber-security.

5. Have an incident response plan and test it

Many organisations technically have a response plan, but it has never been tested and rather has been prepared as a box ticking exercise! A detailed and tested plan should be implemented, including:

A rehearsed response often makes the difference between a contained incident and a prolonged crisis, which could potentially jeopardise the future existence of the organisation.

6. Involve legal advisers before, not just after, a breach

Early legal involvement helps ensure that:

Too often, we are brought in after key decisions have already been made, sometimes creating avoidable risk. It is also often helpful to involve lawyers in the formulation of internal policies and procedures prior to any incident occurring. This will mean you have an appropriate legal team in place and familiar with your systems prior to any incident occurring, and will assist in mitigating any regulatory investigation that may follow an incident.

Remember, prevention, preparation and documentation are your strongest legal defences when the worst happens.

If you would like assistance reviewing your cyber incident response plan, staff training framework or regulatory readiness, our expert team would be happy to assist.