- Jersey Cyber Security Centre Newsletter
- Posts
- JCSC News: Law guidance, conference tickets, and incident reporting
JCSC News: Law guidance, conference tickets, and incident reporting
Contents
Dear reader,
This summer I took a week to go sailing with my son. We made it over to St Malo and up the river Rance before returning to Jersey. One of the things this highlighted for me as we were navigating back from St Malo in the dark is the positive impact of clear signals and good communications. It’s not just what you can see or hear - it’s how you interpret the information.
This is equally critical in cyber security, and many organisations struggle with questions about what to communicate, how and when. Likewise, others can find it hard to interpret those messages and act quickly. For this reason we encourage rapid communications with JCSC because that helps us to support you and protect the community, and we’ve now outlined how organisations can best achieve this.
Clear signals are also important for delivering both within a team and as an Island community. It helps to have clear goals we are working towards together. For JCSC, those goals are set by Government, and in 2025 these are being reset through the proposed Cyber Security (Jersey) Law and the new Cyber Policy Framework. The policy framework is consultation is now completed, and we expect to see the finished document in October. As Deputy Morel noted in his speech to the Chamber of Commerce last week, the Cyber Law is now progressing through its final stages and we expect it to be lodged with the States Assembly any time from this month onwards.
Until next time,
New advice: How to embed reporting to JCSC in your incident management process
Our latest guidance explains how reporting cyber incidents to JCSC differs from reporting a cyber incident to a regulatory body. This article will help you and your organisation to:
Integrate incident reporting into your workflow so you’re never caught off guard.
Understand where reporting to JCSC is helpful, and how this differs from regulatory reporting.
Be ready for reporting under the Cyber Security (Jersey) Law if you are an Operator of Essential Services (OES).
Get more information on the Cyber Law
With the Cyber Security (Jersey) Law Jersey due to be lodged with the States Assembly, we’ve created a central information hub where you can find guidance and support on how the Law affects you. The web page includes roles, timelines for implementation, and an FAQ section which the JCSC team will maintain.
The Law is being lodged following the two public consultations in 2022 and 2023. If it’s approved by the States Assembly in the coming months, it could come into effect in 2026.
Once the proposed Law is published by Government we’ll work with industry to develop guidance to support them, and to outline and agree our approach. Watch this space for how you can participate.
“JCSC is not a regulatory body - we are here to support and advise in order to protect islanders and our economy. In doing so, we will work closely with NCSC in the UK as well as local regulators, law enforcement, and Government.
Reflections from ISF’s UK Chapter Meeting
Senior Analyst, James McLaren
I attended the ISF’s UK Chapter meeting in Manchester on 10 September as a day out of a pre-planned holiday. The Information Security Forum tends to be at the less hands-on, technical end of cybersecurity. Instead it, promotes good practices, better communication, and better risk management at a managerial level.
Two particular sessions stood out. One was led by the head of security education at a large insurance company. She explained that there are several different ways of talking to people when they’ve made a mistake like clicking a link on a phishing email, and you need to use the right one for the sort of personality you are dealing with.
Some people may be in denial; some may not know how to report the issue; some may be mortified at what they’ve done. The really good educator will use emotional intelligence to assess how to address these different types of response. Do this well, and you will get engagement.
The other was on an ISF report called Threat Horizon, which tries to predict what the near future may hold. The speaker noted that the increasing move towards authoritarian rule in several countries could affect cyber security efforts. They cited the recent threat to the CVE system which names and tracks all the vulnerabilities in software and hardware worldwide.
In April, the contact which provides CVE was cancelled by the Department for Homeland Security. And while another body has since provided funding, it does show that the data sources we rely on are dependent on political decisions.
Upcoming events
Channel Islands Cyber Security Conference - Thurs 16 October
Booking for the 2025 Channel Islands Cyber Security Conference is open. Join us and the Channel Islands Information Security Forum (CIISF) on Thursday 16 October for a new look conference with talks, demonstrations and networking opportunities.
Speakers for the day will include:
Deputy Moz Scott, Assistant Minister for Sustainable Economic Development
Rob Shapland, Director of Cyonic Cyber and Ethical Hacker
Andy Compton, CEO of Cortida Ltd
Peter Bassill, CEO of Cyber Defence
Places at the conference are always in demand, so book your ticket today.
Lunch and Learn for Hospitality: Monday 3 November
Don’t miss out on our next Lunch and Learn session, which is taking place on Monday 3 November between 2pm and 3pm. This session is aimed specifically at hospitality businesses, including pubs, bars, clubs, hospitals, restaurants and cafes.
As always, you can join us in person at 1 Seaton Place, or via Teams. These sessions are designed for people who aren’t cyber security specialists, and focus on basic controls that can prevent some of the most common cyber attacks.
Our final session of the year for small businesses and charities on Tuesday 2 December is fully booked, although you can join the wait list by visiting our Eventbrite page - just click the button below.
Can’t make these sessions? Want a bespoke session for your organisation or industry? Just email us at [email protected] to request another session.
Cybersecurity in the news
FBI warns against cyber attacks targeting Salesforce
The FBI has released a list of Indicators of Compromise (IOC) for data theft attack that targets client Salesforce, specifically its Drift application. If your organisation uses Salesforce, you should read the latest updates from Salesforce.
Jaguar Land Rover cyber shutdown continues
The car manufacturer has confirmed that it will extend a production shutdown for an extra week, following a cyberattack in late August. This is a good example of the cost of a cyberattack (likely to be billions for such a large company), and is the latest British retailer to be affected this year.
Jobs in Cyber
Are you recruiting for a cyber role locally? Tell us at [email protected] and we’ll share your job listing with the community.
Tool of the Month
Each month, we provide a round up of tools that our team have found useful, and which could be useful to cyber security professionals. If you’ve found a helpful tool you’d like to share, please email us and we’ll include it in a future newsletter.
VirusTotalDo you want to know if a file is malicious? Upload it and find out. VirusTotal powers most commercial services that do this, and you can use it for free (being cautious about sharing and confidential data, of course). |
Did you know? JCSC can also check potentially malicious files for you in our sandbox, but please let us know before sending them over.