In a new joint blog post, the two authorities urge companies to not “feed the cycle” of cybercrime, and to be up front about possible and confirmed cyber-attacks.

The NCSC and ICO argue that transparency is a net-positive, not least because the authorities can appropriately assist victim firms with navigating their situations.

To help companies feel more comfortable about reporting cyber-attack incidents, the NCSC and the ICO laid out a series of misconceptions about incident reporting — especially when it comes to ransomware.

They are as follows:

1. If an attack is covered up, everything will be ok
2. Reporting to the authorities makes it more likely the news will go public
3. Paying a ransom makes the incident go away
4. If there are good offline backups, a ransom won’t need to be paid
5. If there’s no evidence of data theft, the ICO doesn’t need to be informed
6. A fine will only happen if data is leaked

While writing about the first misconception — that everything will be fine if the cyber-attack is covered up — the blog’s authors used the analogy of a home burglary to illustrate the importance of incident transparency.

“Imagine that you come home from work to find your house has been burgled,” they wrote. “Instead of reporting it to the police and seeking support, you quickly tidy everything up and carry on as if nothing had happened, hoping no one finds out, and without investigating further.

“The next week your neighbour is burgled too, although you might not know about it because they don’t mention it. And then the burglars return to your place again because you didn’t spot that the unlocked window is still unlocked, so it’s easy for them to get back in.

“This is often how it works in a cyber incident, particularly ransomware. Every successful cyber attack that is hushed up, with no investigation or information sharing, makes other attacks more likely because no one learns from it. Every ransom that is quietly paid gives the criminals the message that these attacks work and it’s worth doing more.”

When it comes to another misconception — that reporting an incident to the authorities makes it more likely the news will go public — the NCSC mentioned that it doesn’t proactively make information public, nor does it share information with regulators without the victim firm’s consent.

Meanwhile, the ICO said they don’t disclose details beyond confirming whether or not an incident has been reported to them, but they wanted to remind firms that there may be a regulatory requirement to report.

Recommended

• Comment: Digital Skills and Access Key to Getting More Women in Tech
• New Study Reveals Cost of Vulnerable Software Supply Chains
• Scots Eye Test Tech Firm Lands £4.5M to Launch into US Market

Another myth the two authorities wanted to dispel is that a fine is only issued if data gets leaked. On this, the authors wrote: “A data leak isn’t the only reason for a fine, and you won’t always be fined if data is leaked,” and that the ICO ultimately looks at “the context of each individual case – it’s not just about whether or not data was leaked.”

“As a fair and proportionate regulator, the ICO understands that helping organisations to improve their data protection practices is also the best way to protect people’s data. If we find serious, systemic or negligent behaviour that puts people’s information at risk, enforcement action may be an option. But this isn’t a blanket approach.”

To read the blog post in full, click here.

The post comes as CISOs and other cybersecurity professionals are feeling increasingly worried about the potential ramifications following a cyber-attack.

Earlier this week, DIGIT reported on the news that 62% of CISOs are concerned about being held personally liable for successful cyber-attacks at their company.