Ngā Whatunga Pūmanawa Kino Kore Malware Free Networks

About Malware Free Networks 

Our Malware Free Network (MFN) service uses near real-time threat intelligence to protect New Zealand businesses and organisations against a broad range of cyber threats and malicious activity such as:

• malware,  
• remote scanning or exploitation, and  
• phishing.

The service is delivered through a threat intelligence feed curated from a range of sources, including our international cyber security partners and our cyber defence capabilities. 

When used in combination with other threat intelligence systems, platforms and feeds, it can help to defend against the wide spectrum of cyber threats impacting New Zealand. 

MFN is additional to CORTEX, which is a cyber defence capability provided by the NCSC to New Zealand’s nationally significant organisations.  

CORTEX

MFN was the winner of the:

• 2022 iSANZ Award for Best New Zealand Security Product or Service.
• Spirit of Service Awards 2023 - Te Kawa Mataaho Public Service Commission.  External Link

MFN partners

We have partnered with a range of local internet service providers (ISPs) and cyber security service providers to roll out MFN to their customers.  

MFN takes our cyber threat information and very quickly turns it into actionable threat intelligence — via STIX/TAXII — for these companies to deploy. NCSC does not charge partners for the supply of MFN — how much they charge their customers depends on the type of cyber security service they offer.  

Our partners are progressively offering the MFN service as part of their managed security products. We suggest that you ask your ISP or service provider about gaining access to our MFN threat intelligence service.

Our partners include:

If you’d like to become an MFN partner yourself and offer the service to your customers, or if you’d like a referral to one of our MFN partners, please get in touch with at  services@ncsc.govt.nz. 

Information for organisations

Once signed up to MFN, the threat feed will run through a commonly used industry standard for sharing threat information. Your current cyber security capabilities may support integration with this feed. 

If you use an internet service provider (ISP) or managed service provider (MSP) for your online security, they may offer services that utilise the MFN threat feed.

MFN can be integrated with other cyber security capabilities to protect against threats that operate and propagate through:

• domain name system (DNS)
• internet IP addresses, and  
• web URLs.

How to check if MFN is actively protecting your organisation

MFN has been developed to help defend against malicious activity impacting a broad spectrum of users.  

Once you have signed up with an MFN partner, you can test whether it is working correctly in your environment and protecting you from threats, by clicking on the links below:  

• Check if you are protected against URL threats External Link
• Check if you are protected against domain name threats External Link
• Check if you are protected against IP address threats External Link

In some situations, your network or device settings may bypass the MFN protections. This may be because your environment does not restrict the use of:

• virtual private networks (VPN),  
• alternative domain name servers (DNS), or  
• it may be due to your browser's compatibility and/or device settings.  

If you are working directly with an MFN partner to enable protections and you receive an unexpected result from these tests, we recommend contacting your MFN partner to understand how the MFN service can best work for you.

Data and privacy

The telemetry we receive through MFN is stored securely on NCSC systems, and no physical infrastructure needs to be deployed inside your network. MFN is delivered purely as a threat feed.

We do receive some analytical feedback from partners, which helps us to increase the effectiveness of the feed. The analytical feedback contains no personal information. Information passed back to us includes:  

• the partner’s name,  
• which indicator was triggered, and  
• the date and time of the event.

If a customer has consented, we can receive information about when an MFN indicator has been seen and disrupted on the consenting customer’s network.