Issue - meetings

That Detective Constable Nicholas Hawe be thanked for his attendance and presentation.

The Chairman welcomed Detective Constable (DC) Nicholas Hawe to the meeting to share an overview of the work of the North Wales Cybercrime Unit.  The two main types of cybercrime were:

·         ‘CEO fraud’ where an attacker was able to spoof a message from a senior officer to trick others at the same organisation into wiring funds to a fraudulent account.

·         ‘Ransomware’ (or crypto locker) involving the covert installation of computer malware onto a victim’s device and demand a ransom (via bitcoin payments) from the victim for the decryption of their data.

DC Hawe highlighted the importance of safeguarding against these increasing cyber threats and said that 80% of cases were avoidable by taking simple precautions.  A further risk to organisations was the introduction of new Data Protection regulations from May 2018 on the disclosure of breaches to data security.  Whilst many larger organisations were adopting a proactive stance to safeguarding against these risks, smaller businesses and members of the public remained the most vulnerable.  The recommended approach was for businesses to identify critical data as part of a security plan and regularly backup files away from the network and carry out testing.  Any anti-virus software should be kept updated and the workforce trained to raise awareness of how to deal with suspicious emails.  Anti-ransom software could offer another layer of protection but there were no failsafe guarantees.  Businesses could opt to purchase accreditation of the ‘Cyber Essentials’ scheme, which was endorsed by the UK Government and offered basic controls to mitigate the risk of internet-based threats.

In the event of a computer becoming infected, the advice was to remain calm and take steps to isolate the infection from the network.  Cases should be reported to the Cybercrime team and the ‘Action Fraud’ centre to establish if the relevant decryption keys were recorded.  The website ‘nomoreransom.org’ also held a list of regularly updated decryption keys.

The Chairman gave an example of a member of the public who had been the victim of ransomware, demonstrating that individuals were at risk as well as businesses.  He also commented on the danger of using scanned signatures.

To reassure Members, the Chief Executive said that the Council’s IT expertise and infrastructure reduced the level of risk.  Information was shared with the workforce on the need for individual vigilance to help reduce the amount of phishing emails which occasionally filtered through the system.

In response to comments from Councillors Marion Bateman and Ian Smith, a cautious approach was recommended when accessing seemingly genuine websites and when sharing personal information on social media.

DC Hawe responded to Councillor Paul Shotton’s query on support for schools and the all-Wales approach through the ‘schoolbeat.org’ programme.  He spoke about the team’s links with the regional and national teams but highlighted the under-reporting of cases, particularly by businesses, as a risk area.  He agreed to a request to give the presentation to the Deeside Forum.

Remarks from the Chairman on the security of data held by Members prompted discussion on ransomware  ...  view the full minutes text for item 93