Transcription
NATIONAL CYBER SECURITY CENTRECYBERTHREATREPORT2020/21The National Cyber Security Centre is hosted withinthe Government Communications Security Bureau.
CONTENTSNgā KaupapaForeword/ Whakapuakitanga1By the numbers / Mā ngā tau2Overview / Tirohanga Whānui3About our work / Mō ā mātou mahi4Aotearoa New Zealand threat landscape /Te āhuatanga o ngā tuma i Aotearoa10International landscape / Te āhuatanga i te ao17Conclusion / Whakakapi22Glossary / Rarangi kupu24
CYBER THREAT REPORT 2020/2021FOREWORDWhakapuakitangaThe National Cyber Security Centre (NCSC) is part of the GovernmentCommunications Security Bureau (GCSB). Our purpose is to create asafer digital world for Aotearoa New Zealand to prosper. We achievethis by supporting nationally significant organisations to protect theirnetworks. The NCSC works to provide preventative advice on, and todeter, detect, and disrupt, the types of malicious cyber activity thatcould affect the country’s national security or economic wellbeing.The NCSC’s annual Cyber ThreatThe NCSC welcomes increased publicmaking our insights available throughReport focuses on our analysis ofawareness about the seriousnesscommercial partners.incidents we have prevented, detected,the cyber threat poses to Aotearoaor disrupted. It draws on and informsNew Zealand and the work we dothe wider functions and objectivesto counter it. Through our efforts tothe NCSC delivers on to lift the cyberrespond to incidents and reduce theirsecurity of nationally significantimpact, we provide significant benefitsorganisations.and cost-avoidance. In the 2020/21In the 2020/21 year, the NCSCrecorded 404 incidents with a possiblenational impact, or affecting AotearoaNew Zealand’s nationally significantorganisations. The increase indisruptive, criminally motivatedactivity among our incidents reflectsthe harm caused by ransomware andextortion campaigns. This activityincreasingly targets critical serviceyear, NCSC intervention or adviceprevented an estimated 119 millionworth of harm to nationally significantorganisations by either preventingincidents, or providing assistance andadvice that helped those significantorganisations detect, respond, andrecover from malicious cyber activity.Since June 2016, this is an estimatedtotal of 284 million.providers and organisations withThe consent, ongoing co-operation,no tolerance for extended periodsand collaborative approach of ourof disruption. While less obviouslycustomers and partners is critical todisruptive, state-sponsored maliciousthis success. By working together,cyber activity remains a focus for thethe NCSC gains greater visibility andNCSC, with 28% of recorded incidentsawareness about the types of seriousshowing links to suspected state-malicious cyber activity affectingsponsored actors.Aotearoa New Zealand’s organisations.A major part of our work is supportingorganisations to increase their cyberresilience. The NCSC provides adviceand guidance to network defendersand decision makers. In the 2020/21year, the NCSC released publicationsabout two of the biggest cybersecurity challenges facing AotearoaNew Zealand’s organisations: supplychain security and incident readiness.The best-prepared organisationsunderstand the value and importanceof their information systems, haveassessed their cyber security risks anddependencies, and are prepared torespond when incidents do happen.Malicious cyber actors remaindetermined and well-resourced,and our nation’s most significantorganisations are not immune. I hopethe NCSC’s insights are valuable toanyone with an interest in AotearoaNew Zealand’s security and wellbeing.We use this information to strengthenLisa Fong (she/her)everyone’s defences. The NCSC’sDirector, National Cyber Security Centrenewest major defensive initiative,Malware Free Networks, will help usprotect even more organisations by1
2CYBER THREAT REPORT 2020/2021BY THE NUMBERSMā ngā tau404incidents affecting nationallysignificant organisationsA 15% INCREASE FROM THE 352INCIDENTS RECORDED IN 2019/20113IN THE 2020/21 YEARTHE NCSC AND GCSBReceived 141 notifications ofnetwork change proposals under TheTelecommunications (Interception Capabilityof those, or 28%, indicatedlinks to suspected statesponsored actorsCOMPARED TO 30% IN THE2019/20 YEARand Security) Act 2013 (TICSA)incidents, or 27%, werelikely criminal or financiallymotivatedConducted 29 assessments of regulatedspace activities under the Outer Space andHigh-altitude Activities Act 2017 (OSHAA) 119mConducted 69 assessments under theIn 2020/21 the NCSCprevented an estimated 119 million worth of harmto Aotearoa New Zealand’snationally significantorganisationsOverseas Investment (Urgent Measures)Amendment Act 2020 (OIAA)THE NCSC IN A TYPICAL MONTHDetects 13 cyber intrusionsaffecting one or more nationallysignificant organisations through theNCSC’s cyber defence capabilities110A TOTAL OF 284 MILLIONSINCE JUNE 20162000The NCSC disrupted over2000 malicious cyberevents as part of theearly phase of MalwareFree NetworksTHE NCSC INCREASED AOTEAROANEW ZEALAND’S COLLECTIVECYBER RESILIENCEReceives 21 new incidentreports or requests for assistanceunrelated to the NCSC cyberdefence capabilities.Recorded 1872 engagementswith customersCo-chaired 22 sector-based SecurityInformation ExchangesPublished 23 reports and advisoriesfor general customersDelivered 94 incident reportsto customers
CYBER THREAT REPORT 2020/2021OVERVIEWTirohanga WhānuiThe Cyber Threat Report 2020/21 provides an overview of theNCSC’s work during the year 1 July 2020 to 30 June 2021. It aimsto highlight trends and observations about the nature of cyberincidents affecting Aotearoa New Zealand’s organisations. The reportalso provides a review of the international cyber threat landscapeand the context it sets for Aotearoa New Zealand.The report first outlines the NCSC’sdescribes how the NCSC defines anto make any assessment aboutmission, and describes the servicesincident, and how severity ratingsthe type of actor responsible, orthe NCSC offers to Aotearoa Neware assigned using an incidentrepresented proactive, preventativeZealand’s nationally significantcategorisation matrix. The year’s threeefforts undertaken by the NCSC.organisations. Much of the workmost severe incidents were ratedThese incidents reflect the difficulty ofcarried out in the 2020/21 yearcategory 2 or ‘C2’ – highly significantattributing activity to a particular actor,focused on supporting theseincidents. These comprise the Waikatoand the NCSC’s focus on engagingorganisations to strengthen theirDistrict Health Board ransomwareearly. The NCSC often preventsawareness and resilience, andincident; a series of distributed denialcompromises long before it is possibleprepare for threats to their networksof service incidents targeting Aotearoato assess anything about the actorand information systems. The workNew Zealand’s stock exchange; andresponsible or their motivation.programme involved significanta data breach affecting the Reservenew service provider partnershipsBank of New Zealand. All threeto address security in digital supplyattracted significant media attention.chains. The NCSC also has a role inA number of other case studiesassisting the government to ensureillustrate the range of incidents thethe secure delivery of major eventsNCSC handles.such as the General Election, theCOVID-19 vaccination rollout, anddigital hosting of the Asia-PacificEconomic Cooperation (APEC) forum.Malicious cyber activity in AotearoaNew Zealand largely matchesinternational trends, with bothransomware and rapid exploitationof internet-facing services andapplications a common trend inOf the 404 incidents recorded, 28%the 2020/21 year. A review of theshowed links to suspected state-international context, and some of thesponsored cyber actors. While theglobal issues attracting political andproportion of incidents showingmedia attention, provides the finalIn the 2020/21 year, the NCSCconnections to state-sponsored actorssubstantive section of this report. Forrecorded 404 incidents – an increasehas reduced relative to previous years,readers unfamiliar with any of theof 15% on incidents recorded inthis still amounts to 113 incidents.terms used, or how the NCSC defines2019/20. A section dedicated to theA further 27% indicated suspectedthem, a glossary is provided after theAotearoa New Zealand cyber threatcriminal or financially motivatedreport’s conclusion.landscape provides insights aboutactivity. The remaining incidentsthese incidents. This section alsoeither had insufficient information3
4CYBER THREAT REPORT 2020/2021ABOUT OUR WORKMō ā mātou mahiThe NCSC’s purpose is to create a saferdigital world so Aotearoa New Zealand canprosper. The information security serviceswe provide support the protection, wellbeing,and prosperity of Aotearoa New Zealand.What the NCSC doesand signs of compromise oninformation security posture, withAs the lead organisation forThe NCSC disrupts malicious cybercustomers including governmentresponding to cyber threats that couldactivity by sharing threat informationagencies, critical nationalhave an impact on national securityacross our customer base, interveninginfrastructure providers, majorand wellbeing, the NCSC works towhen a threat is detected, blockingeconomic generators and intellectualreduce the chances that a significantspecific threats to customer networks,property generators. We increasinglycyber incident will happen in Aotearoaand deploying our incident responsework with suppliers to nationallyNew Zealand. When incidents doteam if necessary. The NCSC’ssignificant organisations, and we arehappen, the NCSC takes action toincident responders help organisationsavailable to assist whenever a cyberreduce the impact and prevent futureevict malicious cyber actors fromincident has the potential to causeharm. To meet our strategic objectivestheir networks, restore services,serious harm or disrupt the country’swe act in four ways: advise, deter,and recover.security and economic wellbeing.detect, and disrupt.Our focus is on assisting nationallysignificant organisations to lift theirHigh-impact security incidents haveeconomic and social consequencesthat can have a lasting effect.Our strategicobjectives Defend National Security Raise Cyber Resilience Facilitate Digital Transformation Support Economic Recovery Improve Aotearoa New Zealand’sWellbeingAdvising means understanding thethreat environment and preparingconsenting customer networks.Building resilienceour customers for what might happenThe NCSC helps organisationsthrough a range of resilience-buildingunderstand their cyber security riskservices and advisories. This workand provides guidance about how toalso involves securing national supplymanage it. By proactively engagingchains through regulatory security riskwith organisations from a range ofassessments.sectors, the NCSC aims to increaseDeterrence discourages malicious cyberactors from targeting Aotearoa NewAotearoa New Zealand’s cyberresilience.Zealand by making it harder for themIn the 2020/21 year, the NCSC releasedto operate here. Deterrence can rangetwo publications for business leadersfrom protecting the government’sand cyber security professionals:most sensitive information, to publiclySupply Chain Security: In Safe Handsattributing malicious activity.and Incident Management: Be Resilient,The NCSC’s cyber defensivetechnologies and services findand share indications of maliciouscyber activity by detecting anomaliesBe Prepared. They are part of a seriescreated by analysing 250 AotearoaNew Zealand organisations for thebiggest cyber security challengesfacing NCSC customers.
CYBER THREAT REPORT 2020/2021What’s theharm?In 2020/21, detectionand disruption activitiesundertaken by the NCSCprevented an estimated 119 million of harm to NewZealand’s organisations ofnational significance. Thisfigure reflects incidentswhere NCSC engagementsprotected nationallysignificant networks fromimminent threats thathad the capacity to causemany of the victims affectedsuch as losses causedserious harm, or whereby 2020/21 incidents.by intellectual propertyour response prevented orreduced the harm caused bysophisticated and targetedattempts to compromisecustomer organisations.The increase from 2019/20’s 70 million dollar harmreduction calculationreflects the increase inrecorded incidents, as wellas the scope of the NCSC’sassistance to victims, andthe critical economic rolesand services provided byIn 2020/21, the NCSC recorded 1872engagements with 200 organisations,and published a range of securityadvisories about threats to AotearoaNew Zealand organisations. Securityadvisories for general customersshare information about specificvulnerabilities or types of maliciouscyber activity seen targeting AotearoaNew Zealand networks. They mayincorporate technical indicators andmitigation advice that security teamscan use to strengthen their defences.Threat information and best practiceguidance are also generated bypublic and private organisations andthe information security industry.The NCSC assists the facilitationof information sharing amongorganisations facing similar threatsand challenges – especially wheresharing requires a high level of trust.This primarily happens throughSecurity Information Exchanges (SIEs)focused on critical infrastructure. In2020/21, the NCSC co-chaired 22 SIEs.Participants include key organisationsin the energy, finance, networkprovider, government, transportand logistics, and tertiary educationsectors.theft, including copyrightIn 2016, the NCSCcommissioned independentresearch to devise a modelthat could measure thebenefits provided by ourinterventions. The modelwas reviewed and updatedin 2020 to ensure it betterreflects internationalstudies about the averagecost of cyber incidents tospecific sectors. It factorsin important impacts,and patent infringement.While assigning a dollarvalue to harm preventioncan provide a usefulbenchmark, many of theimpacts of cyber harmare intangible. Loss ofpublic confidence andtrust, reduced health andwellbeing, and hesitance toadopt new technologies canall eventuate when cyberresilience is low.Support tomajor eventsparties and candidates in the lead-upPlanning for major national eventsNovember 2021, Aotearoainvolves preparing for the possibilityNew Zealand hosted the virtual APECthat a cyber security incident could2021 forum. The NCSC assistedcause disruption and reputationalagencies involved to ensure the virtualharm. The NCSC has a framework inhosting platforms used to facilitateplace for supporting the cyber securityonline meetings were secure, andrequirement of major events. Thisthat risk assessment and mitigationinvolves proactively evaluating andprocesses were in place to protectpreparing for cyber threats from state-participants. By successfully adaptingsponsored actors, issue-motivatedto hosting APEC virtually, Aotearoagroups, and criminals.New Zealand played a leadershipIn 2020/21, three significant eventsdrew NCSC involvement. In additionto supporting the COVID-19 vaccineto the election.Between November 2020 androle in championing the APEC goal ofbuilding an open, dynamic, resilient,and peaceful Asia-Pacific community.rollout, the NCSC provided servicesand advice to ensure the October2020 General Election was freefrom cyber interference. Free andfair elections are integral to ourdemocracy. While the GCSB does nothave any role in monitoring politicaldiscussion or free speech in AotearoaNew Zealand, it is alert to the factthat foreign interference is a growingthreat globally and domestically.The NCSC worked with the ElectoralCommission to help protect its coresystems and online presence. TheNCSC also worked alongside relevantagencies to provide protective securityand cyber security advice to politicalRansomware is a type ofmalicious software (malware)designed to disrupt the use ofcomputer systems and files untila ransom is paid. Crypto malwareis a specific form of ransomwarethat encrypts files and requiresa key – usually held for ransomby the malicious cyber actor – toreverse the encryption.5
6CYBER THREAT REPORT 2020/2021Supporting theCOVID-19vaccine rolloutvaccine rollout. The NCSCacknowledged involvementa threat to people’s safetyidentified points in thein the DHB’s recoveryand wellbeing. Part ofvaccine supply chain thatefforts. The reasons for thethe NCSC’s role was tocould be vulnerable toNCSC’s participation weresupport the DHB in safelyAs part of Aotearoa Newmalicious cyber activity.twofold: first, the NCSCrestoring services. TheThis information fed intowas ready to respond toNCSC also co-ordinatednational risk managementany malicious cyber activitya wider defensiveplanning.that had the capacityresponse, working to shareto disrupt the country’sinformation, and manageCOVID-19 response.cyber security risk toSecond, the incidentthe rest of Aotearoadegraded healthcareNew Zealand’sservices and representedhealthcare sector.Zealand’s response toCOVID-19, the NCSCextended support andadvice to healthcare,logistics, transport, and ITsystem suppliers involvedin all aspects of the nationalIn May 2021, the WaikatoDistrict Health Board (DHB)experienced a ransomwareincident. The NCSC publiclyWho the NCSCworks withThe NCSC works with a number ofpartner organisations to build acohesive line of cyber defence. Ourprimary international relationshipsare with the cyber securitycomponents of the Australian SignalsDirectorate (ASD), the CanadianSecurity Establishment (CSE), theUnited Kingdom’s GovernmentCommunications Headquarters(GCHQ) and the National SecurityAgency in the United States (NSA).Aotearoa New Zealand’s CyberThe NCSC values keySecurity Emergency Response Planpartnerships with the private(CSERP) sets the framework for thesector. During incidents, thegovernment’s response to a cyberNCSC typically works with supplierssecurity emergency, and prescribesto the affected organisations duringthe NCSC as the lead agency inthe secure restoration of services.Aotearoa New Zealand for incidentsThe NCSC is partnering with servicecategorised as cyber emergencies.providers to deliver more securityThe NCSC works with CERT NZ,offerings and enhanced securitywhich provides general supportcapabilities.to businesses, organisations, andindividuals affected by cyber securityincidents, and with New Zealand Police,which is responsible for investigatingcrimes that happen online.At a broader scale, the NCSC supportsthe government’s wider digital anddata goals in support of the nation’seconomic recovery and AotearoaNew Zealand’s wellbeing. This workRespectively, their cyber securityCyber security resilience is centrallyincludes contributing to some keycomponents include the Australianimportant to ordinary businessstrategies: the Digital Strategy forCyber Security Centre (ACSC), theoperations. The NCSC works closelyAotearoa, the Strategy for a DigitalCanadian Centre for Cyber Securitywith technology and investmentPublic Service, the Data Investment(CCCS), the United Kingdom’s Nationaladvisors, including the MinistryPlan and the National Cyber SecurityCyber Security Centreof Business, Innovation andStrategy, led by colleagues in the(UK NCSC) and NSAEmployment (MBIE) and the OverseasDepartment of Internal Affairs,Cybersecurity.Investment Office.MBIE, Statistics New Zealand and theNational Cyber Policy Office.
CYBER THREAT REPORT 2020/2021Cloud securityRegulatoryfunctionsAs part of the GCISO’s role to build and maintain a high level of cyberAotearoa New Zealand’sresilience and awareness in the public sector, in 2020/21 the NCSC beganbuilding NZISM baseline cloud security templates. These templates,developed in partnership with cloud service providers, better enablegovernment agencies which are adopting cloud services to identify howtheir security controls and principles can be brought in line with bestpractice standards outlined in the NZISM. By using these templates,organisations will better understand their environments’ level ofcompliance with relevant principles and controls, and be able to easilyimplement and continuously monitor their cloud services use to ensurethey are maintaining a base level of protection.telecommunications networksare a core part of New Zealand’scritical national infrastructure.Organisations and individuals relyon network providers for safe andsecure access to digital capabilities,and the secure provision oftelecommunications services.The purpose of theTelecommunications (InterceptionCapability and Security) Act 2013The Government ChiefInformation SecurityOfficer (GCISO)The GCISO’s efforts are also focused(TICSA) in relation to network securitytowards supporting the secureis to prevent, mitigate, or removedigital transformation of the publicsecurity risks arising from the design,service. The GCISO uses specialisedbuild, and operation of publictelecommunications networks, orThe Director-General of the GCSBknowledge of international bestpractice and Aotearoa New Zealand’sfrom the interconnection of publiccyber threat landscape to help informtelecommunications networks tothe information security standardsnetworks in Aotearoa New Zealandfor the public sector so they areor overseas.holds the role of the GovernmentChief Information Security Officer(GCISO), and is responsible forproviding leadership and advice aboutinformation security risks across thepublic sector. The GCISO functiondraws on the technical capabilitiesof information security professionalsfrom the GCSB, particularly the NCSC.Leveraging this expertise, the GCISOidentifies solutions to commonsecurity challenges, ensures effectivepolicy settings are in place across thepublic sector, and supports nationalincident response efforts.appropriate, responsive, and relevant.GCISO develops and maintains theNew Zealand Information SecurityManual (NZISM), enabling digitaltransformation by setting highstandards for information technologyand communication systems. Asthe keystone information securitypolicy-setting organisation, GCISOworks closely with the functional leadsincluding the Government Chief DigitalOffice (Department of Internal Affairs),Government Chief Data Steward(Statistics New Zealand) and theCloud Services provideconvenient, on-demand networkaccess to shared pools ofcomputing resources (such asservers, storage, and applications).Government Protective SecurityLead (New Zealand SecurityIntelligence Service (NZSIS)).7
8CYBER THREAT REPORT 2020/2021Privacy Act 2020Cyber defencetelecommunications networkOn 1 December 2020, AotearoaAotearoa New Zealand’s reputationoperators are required to engageNew Zealand’s new Privacy Act 2020as a place to invest, innovate,with the GCSB, via the NCSC, aboutcame into force. Organisationsand embrace technology needs anetwork changes or developmentsthat carry out business in Aotearoacyber security culture that peoplethat intersect with national security.New Zealand are bound by the Actrespect and trust. The NCSC buildsMany of these changes are currentlyregardless of where they are based.collaborative relationships with ourdriven by cloud adoption, increasedThe law requires organisations thatcustomers, and offers defensivedemand for remote working, thesuffer a significant breach that eithertools and capabilities to consentingrollout and expanded capacity ofhas caused or is likely to cause anyoneorganisations that choose to consumefibre optic cabling, and the transitionserious harm to report that incident tothem. Increasingly, the NCSC is seekingto 5G services. In the 2020/21 year,the Privacy Commissioner.out innovative ways to provide threatPart 3 of TICSA establishes aframework under whichthe GCSB received 141 notificationsfor assessment of network changes.A significant number of these relatedto the rollout of 5G and full-fibreWhile not every breach of privacy isthe result of a cyber security incident,many organisations affected byinformation to organisations involvedin supplying IT or network services toNew Zealanders.cyber security incidents will need toThe NCSC can deploy defensivereport privacy breaches. When highcapabilities, including those developedThe GCSB’s other regulatory mandatesimpact incidents prompt the NCSC’sthrough the CORTEX project, toare derived from the Outer Spaceassistance, incident responders canparticipating nationally significantand High-altitude Activities Act 2017provide the forensic support andorganisations. These services(OSHAA), and the Overseas Investmentexpertise required to identify whetherare tailored to meet the network(Urgent Measures) Amendment Actpersonal information has likely beenconfiguration and risk profile of each2020 (OIAA). Under OSHAA, NCSCleaked or stolen, and to what extent.organisation. The NCSC’s defencesand GCSB assist NZSIS and otherThis helps organisations understandaim to keep customers ahead ofagencies in assessing space andthe potential harm a breach couldsophisticated, advanced persistenthigh altitude activities for nationalcause and advise those affected.threats. If malicious cyber activitynetworks.security risks. In the 2020/21 year, theis detected on one customer’sGCSB conducted 29 assessments ofnetwork, the NCSC can derive threatregulated space activities. The GCSB’sgrowing regulatory role also includessupporting the NZSIS to provide adviceto the Overseas Investment Officeabout any national security risksassociated with proposed overseasinvestment; in 2020/21 the NCSCconducted 69 assessments underthe emergency notifications regimeof the OIAA.Personal Information isinformation about an identifiableindividual. The purpose of thePrivacy Act 2020 is to promoteand protect individual privacy.information from the incident anduse it to mitigate the threat to othercustomers. The principle of sharinginformation to strengthen everyone’sdefences underpins the NCSC’snext major initiative: Malware FreeNetworks.
CYBER THREAT REPORT 2020/2021Malware FreeNetworksIncident responseservicesMalware Free Networks (MFN) is aWhen an incident does happen, themalware detection and disruptionNCSC’s 24/7 incident coordination andcapability that will empower the NCSCresponse team assists organisationsto scale up our network protectionto respond and recover. The teamservices and block malicious cybercan draw on all the NCSC’s resourcesactivity before it affects Aotearoato support and coordinate responseNew Zealand organisations. The goalefforts. If necessary, the NCSC’sis to disrupt sophisticated maliciousincident responders are deployedcyber activity as early as possible,on-site, working side-by-side withfor as many networks as possible.victim organisations and their serviceThrough MFN, the NCSC generatesproviders as they recover. Theand shares cyber threat intelligenceNCSC provides forensic analysis andwith participating organisations.investigation capabilities to map theCustomers can receive the MFN threatpathways a malicious cyber actor hasintelligence feed via MFN partners,taken, and evaluate the extent andsuch as internet or managed serviceimpact of an intrusion. The NCSC canproviders.also provide advice and guidanceIn 2019/2020, the NCSC successfullycommenced the initial rollout of thelive service, which has been operatingfor a small number of consentingNCSC customers since August 2020. ByJuly 2021, MFN had already disruptedover 2000 malicious indicators beforethey had the chance to cause harm.The NCSC aims to scale the availabilityof MFN through growing partnerships;the intention is to partner withindustry organisations – from largetelecommunication providers, to midsized managed service providers andsmall technology integrators – to makethe MFN service available to as manyorganisations as possible. The NCSCanticipates MFN will grow to blockmore malicious traffic over time, andwill provide unique threat insights andintelligence in support of increaseddetection.on managing communications andkeeping stakeholders informed duringan incident.In 2020/21, the GCSB publiclydisclosed the NCSC’s involvement inthree high-profile incidents. Theseincluded assisting the Reserve Bank ofNew Zealand following a data breach,providing support to the WaikatoDistrict Health Board following aransomware incident, and advisingNZX with respect to a series ofdistributed denial of service incidentstargeting Aotearoa New Zealand’sstock exchange. All three of theseincidents were rated as C2 incidents,or highly significant, and all attractedwell-warranted public concern.Generally, to protect relationships ofconfidence and trust, the NCSC doesnot comment publicly on incidents orvictims of malicious cyber activity.A Denial of Service (DoS)incident is an attempt to makean online service unavailable byoverwhelming the service withmore traffic than it can handle.9
10CYBER THREAT REPORT 2020/2021AOTEAROA NEW ZEALAND THREAT LANDSCAPETe āhuatanga o ngātuma i AotearoaWhile major disruptive incidents like denial of service andransomware incidents dominated cyber news headlines in2020/21, Aotearoa New Zealand’s nationally significant organisationsfaced a broad range of cyber threats, including espionage andinformation theft.Aotearoa New Zealand has arelative level of wealth, high digitalinterconnectivity, and niche technologyexports. These factors contribute tothe attractiveness of Aotearoa NewZealand as a target for motivated,well-resourced malicious cyber actors.Malicious cyber actors of varying levelsof sophistication and motivation targetAotearoa New Zealand networks andcreate new and fast-moving challengesfor network defenders. The NCSC’sfocus is on assisting customersthrough early warnings, prevention,harm reduction, and prompt servicerecovery.How theNCSC definesincidents2020/21 NCSCincidentsIn the 2020/21 year, the NCSCrecorded 404 cyber incidents.Because of the NCSC’s focus ondefending nationally significantorganisations, this number representsa small but impactful portion of allcyber security incidents affectingAotearoa New Zealand.these organisations. Some aregenerated through reports orrequests for assistance received fromvictims;
deter, detect, and disrupt, the types of malicious cyber activity that could affect the country's national security or economic wellbeing. The NCSC's annual Cyber Threat Report focuses on our analysis of incidents we have prevented, detected, or disrupted. It draws on and informs the wider functions and objectives
