Big case handling @ NCSC-FI

The talk looks at how the National Cyber Security Center Finland handles its largest cases, which are run as operations under a major incident management process. It covers how many such operations ran in 2024 and 2025 and the range of cases involved, from long-running data breaches and submarine cable failures to one-day events such as a faulty security update. The speaker argues that cases should be started early, before the scope is clear, because breaches often grow from day one.

The middle of the talk is a tabletop-style exercise. The audience plays a duty officer facing a critical remote code execution flaw in a VPN device, with about 300 vulnerable organizations in Finland, and must rank which to contact first. The speaker then uses the Helsinki data breach as an example, where an outdated Cisco ASA VPN was the entry point, and notes that hundreds of similar end-of-life devices were still exposed weeks later. Reasons given for slow patching include lapsed licenses and remote-work dependence.

The closing section lists practical lessons: name a case coordinator and a documenter before an incident, keep the process short enough that people will actually start it, and plan communications for when normal tools such as email or chat are down. A misdirected data-leak notification is described as an example of how a process can fail in several places at once. The talk ends with advice to patch, monitor, keep logs, and share indicators with the national center.