Whilst no specific threats to UK organisations have been detected, companies are urged to intensify cybersecurity over fears activity could move beyond borders. Credit: LPETTET / Getty Images The UK’s National Cyber Security Centre (NCSC) has urged UK businesses to reinforce their cybersecurity in response to recent malicious cyber incidents in Ukraine, which it has likened to the NotPetya attack of 2017. The guidance comes the week after the NCSC updated its advice for companies outlining actions to take when cyberthreats are heightened.NCSC links cyber incidents in Ukraine to Russia“The NCSC is investigating the recent reports of malicious cyber incidents in Ukraine. Incidents of this nature are similar to a pattern of Russian behaviour seen before in previous situations, including the destructive NotPetya attack in 2017 and cyberattacks against Georgia. The UK Government has attributed responsibility for both these attacks to the Russian Government,” it wrote in a posting on its website.While the NCSC has not detected any specific threats to UK organisations, it encouraged companies to follow steps to reduce the risk of falling victim to an attack over fears activity linked to the conflict in Ukraine could move beyond its borders. These include patching systems, improving access controls and enabling multi-factor authentication, testing backups and restore mechanisms, ensuring that online defences are working as expected, and keeping up-to-date with the latest threat and mitigation information. Commenting on the situation, Paul Chichester, NCSC director of operations, said, “The NCSC is committed to raising awareness of evolving cyberthreats and presenting actionable steps to mitigate them. Over several years, we have observed a pattern of malicious Russian behaviour in cyberspace. Last week’s incidents in Ukraine bear the hallmarks of similar Russian activity we have observed before.” Addressing heightened cyberthreatsThe cyberthreats that organisations face can vary over time and, during periods when risk levels are heightened, they should intensify their security strategies to help mitigate hazards, the NCSC wrote. “An organisation’s view of its cyber risk might change if new information emerges that the threat has heightened. This might be because of a temporary uplift in adversary capability, if for example there is a zero-day vulnerability in a widely used service that capable threat actors are actively exploiting. Or it could be more specific to a particular organisation, sector or even country, resulting from hacktivism or geopolitical tensions,” it added.The most important action for companies of all sizes is to ensure the fundamentals of cybersecurity are in place to protect their devices, networks, and systems, the NCSC stated. These include incident planning, phishing response, and briefing the wider business about threats. “An organisation is unlikely to be able to make widespread system changes quickly in response to a change in threat, but organisations should make every effort to implement these actions as a priority,” the NCSC wrote. “The campaign targeting the Ukraine is classified as pseudo ransomware, and as such, organizations should anticipate such threats since their impact can be so debilitating,” Raj Samani, chief scientist at Trellix, tells CSO. “In particular, they should consider a response strategy that can revert quickly in the event that systems become completely unavailable. Furthermore, they should ensure appropriate segmentation and monitoring is in place, so should the environment become compromised, the impact will not be as severe as it could be.” Related content news Okta confirms recent hack affected all customers within the affected system Contrary to its earlier analysis, Okta has confirmed that all of its customer support system users are affected by the recent security incident. By Shweta Sharma Nov 30, 2023 3 mins Data Breach Cyberattacks Cybercrime news Top cybersecurity product news of the week New product and service announcements from Wiz, Palo Alto Networks, Sophos, SecureAuth, Kasada, Lacework, Cycode, and more. By CSO staff Nov 30, 2023 17 mins Generative AI Security feature How to maintain a solid cybersecurity posture during a natural disaster Fire, flood, eathquake, hurricane, tornado: natural disasters are becoming more prevalent and they’re a threat to cybersecurity that isn’t always on a company’s radar. Here are some ways to prepare for the worst. By James Careless Nov 30, 2023 8 mins Security Operations Center Data and Information Security Security Practices news analysis Attackers could abuse Google's SSO integration with Windows for lateral movement Compromised Windows systems can enable attackers to gain access to Google Workspace and Google Cloud by stealing access tokens and plaintext passwords. By Lucian Constantin Nov 30, 2023 8 mins Multi-factor Authentication Single Sign-on Remote Access Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe