From Infrastructure Security to Trust Preservation: Cyber Police Recommendations for Cryptocurrency Exchanges

Given the increase in cyberattacks, the security of virtual space infrastructures and the protection of online businesses have gained special importance. The head of the Cyber Police emphasized the necessity of strengthening infrastructures and urged managers of internet platforms to be prepared for attacks, crisis management, and user communication.

Brigadier General Vahid Majid announced at the internet platforms conference that over 160,000 businesses are active in the virtual space and are exposed to various cyber threats. According to him, updating infrastructures based on security indicators and reducing vulnerabilities are among the main axes of protecting these businesses.

From Access to Information to Disruptions in Exchanges

The head of the Cyber Police explained that businesses are categorized into five levels: normal, significant, important, sensitive, and critical, based on the number of users, app installations, area of activity, importance of services, and volume of stored data.

Cyber incidents also vary in severity and consequences, ranging from temporary disruptions in internal services and support systems to exploitation of vulnerabilities, access to information, malware contamination, and widespread service disruptions. In sensitive and critical levels, issues such as the release of sensitive information, intentional data destruction, and serious service disruptions are raised.

Majid identified some financial platforms and exchanges as businesses where disruptions could have a national impact and provoke widespread user reactions.

He also warned that even when no attack has occurred, the spread of rumors can create the perception in public opinion that an infrastructure has been targeted. According to Majid, a media appendix has been developed and provided to important businesses for organizing communication during incidents.

One-Hour Deadline for Critical Incidents

Based on the timeline outlined by the head of the Cyber Police, in ordinary incidents, internal communication and documentation must be completed within 24 hours, and public announcement is not necessary. At the significant level, if there are public concerns, limited communication must occur within 12 hours at most.

In important incidents, issuing an official statement on the website and engaging with specialized media for clarification and maintaining public trust is anticipated. The notification deadline for sensitive incidents is 3 hours, and for critical incidents with financial and national consequences, it is one hour.

Majid emphasized that communication about an attack should be conducted after expert review and in accordance with the type of incident. In incidents with national security dimensions, coordination with the National Cyber Space Center, Cyber Police, and judicial authority is essential.

Formation of a Crisis Team to Maintain User Trust

The head of the Cyber Police also called for the formation of a cyber crisis management team including the CEO, information security officer, public relations manager and spokesperson, legal advisor, marketing and user communication officials, social media experts, and customer support representatives.

According to him, pre-attack preparedness should include training, simulations, official content preparation, and media monitoring. During an incident, initial verification and assessment, determining the level of attack, examining its effects, controlling access, correcting misinformation, and responding to users are crucial.

Majid stated that maintaining user trust, preventing customer attrition, and avoiding economic consequences are among the goals of this process, adding that after resolving disruptions, technical reconstruction and rebuilding user trust should be pursued simultaneously.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.