Ciaran Martin, CEO of the National Cyber Security Centre

Cyber security is a tough, complex challenge. But the UK is making significant progress in strengthening our defences against those who seek to harm us online. This matters as we look to an ever more digital future for our prosperity.

In this report – GCHQ’s National Cyber Security Centre’s second Annual Review – we set out:

• the latest overview of the threats we face;
• the progress we’ve made in meeting them, including some world-leading initiatives to rectify some of the systemic security weaknesses of the modern Internet;
• the cyber security challenges facing families, businesses, critical network owners and government, and what they can do to meet them; and
• our plans for the future.

Active Cyber Defence (ACD) is a collection of services that aim to protect the UK from the high-volume commodity attacks that affect people’s everyday lives. These attacks involve using tools and techniques openly available on the internet that are relatively simple to use.

We have developed and tested our ACD services on government with great success. Our longer-term goal is to encourage solutions like these to be adopted across other sectors in the UK.

Mail Check

Government domains using DMARC

The NCSC’s international partnerships help us share information and combat common cyber threats. In our second year, we had the honour of hosting four Heads of Government during the Commonwealth Heads of Government Meeting in April.

We have welcomed delegations from 54 countries across six continents, and we have visited 18 countries for bilateral meetings and public engagements.

In partnership with the rest of government, we have furthered our cooperation overseas, and we aim to expand our reach in 2019.

To ensure the appropriate handler manages an incident, it must first be assigned an attack category. Since January 2018, the UK’s cyber community has implemented a new incident categorisation framework.

The new approach fully aligns the NCSC’s work with law enforcement agencies to defend against the growing threat, with incident responders now classifying attacks into six specific categories (C1-6) rather than the previous three. The new system ranges from targeting the Government and critical national infrastructure through to individual citizens.

A rare glimpse of the inner workings of the UK’s strongest asset against cyber attacks

The NCSC’s first ever podcast gives a rare peek behind the curtain of our world-class incident management service. You will hear from six members of the NCSC team who talk through the methodology behind the tactics they have deployed in more than 1,000 incidents since launching two years ago.

It is well known that the NCSC provides incident management support to UK victims, but the tactics its experts deploy is much less understood. This is partly due to the covert nature of some of the intelligence agencies they can draw on, and partly because the NCSC promises confidentiality to the companies who work with them.

The podcast includes;

• A narrator talking you through NCSC processes during an active cyber incident
• Paul Chichester, the NCSC Director of Operations
• Adrian, the NCSC’s Head of Incident Management
• Nicky Hudson, the NCSC’s Director of Communications
• ‘Jill’ – pseudonym for one of our Incident Handlers (voiced by an actor)
• ‘Jamie’ – pseudonym for one of our Incident Reporters (voiced by an actor)
• ‘Tom’ – pseudonym for one of our Incident Co-ordinators (voiced by an actor)

Central Government

Alongside HMRC, the Home Office, the Department for Work and Pensions, the Ministry of Defence, and the Foreign and Commonwealth Office, the NCSC is a key stakeholder in the Transforming Government Security Programme. This initiative transforms the way that the Government addresses its most challenging security problems. As part of this, we delivered training for the new Senior Security Advisors, who are the focal points for security in government, to ensure they are equipped to deliver the right advice on cyber security.

Devolved Administrations

We continue to help the UK’s devolved administrations raise cyber resilience across all sectors. We promote the adoption of ACD, CiSP and CyberFirst; provide bespoke technical consultancy; and present at cyber security events. We have helped to deliver a secure platform for devolved benefits in Scotland; supported the Welsh Government with their plans to raise cyber resilience within their 22 local authorities; and supported the Northern Ireland administration with workshops designed to link their incident management process to the national framework.

Regional Organised Crime Units

Regional Organised Crime Units (ROCUs) are trusted partners of the NCSC that form the Cyber PROTECT Network. The national policing network of Cyber PROTECT officers aims to raise awareness of the threats posed by cyber crime and provide advice to organisations and individuals on how to protect themselves. The Network is made up of over 60 officers and staff who provide communities with specialist policing capabilities for cyber security. Cyber PROTECT is a critical route for the NCSC to get its message into – and a source of feedback from – local communities. The PROTECT network coordinator and engagement lead are both seconded into NCSC to embed this partnership fully.

Digital Government Lofts

Digital Government Lofts are events where NCSC experts brief representatives from other areas of government and the public sector to improve regional engagement. The Lofts take place across the country and, this year, they were held in Shipley, Glasgow, Bristol, Cardiff and London, with up to 80 people attending each event.

Events in London and Cheltenham

We have hosted more than 80 stakeholder events at our London headquarters and at GCHQ in Cheltenham. These have ranged from regular Information Exchanges with representatives from critical national infrastructure sectors to CyberFirst activities, international visits, and training events.

The UK’s critical national infrastructure (CNI) supports nearly every aspect of our daily life. Our CNI is becoming increasingly digital, which brings real benefits, but also raises cyber security risks. To combat these threats, we work with thousands of systems and hundreds of organisations across the UK.

Over the past year, we have supported many of these organisations to secure their systems. In the transport sector, our advice has helped to secure the next generation of vehicles. In the energy sector, our experts have helped design the security of a new sustainable national grid.

In the telecoms sector, our work with the Department for Digital, Culture, Media and Sport (DCMS) has helped pave the way to faster 5G networks. And as we enter the ‘Great British Space Age’, we are helping to design four new UK spaceports to help an already successful industry reach for the stars.

National Security

The national security sector faces unique threats as it processes the UK’s most sensitive data and runs its most sensitive systems. The NCSC is working hard to support them. Far from being limited to securing the sector, the NCSC’s robust encryption systems help ensure the UK Government stays secure today and in the future.

Securing Britain’s Secrets

From the rise in mobile working to the emergence of quantum computing, the national defence landscape is changing all the time. In response, we have developed secure systems that our government partners and allies can trust. These solutions ensure government missions achieve their outcomes.

Government Missions

The NCSC works with the defence sector and UK intelligence agencies to help preserve the national security of the UK. Our encryption expertise enables the NCSC to protect the UK’s national defences in a range of ways.

Defending Defence

The NCSC continues to support the Defending Defence Programme, which was established in 2014 with the aim to make the defence sector a more difficult target for those that threaten our national security.

Working with Industry

We cannot do any of this alone. Our industry partners provide a vital service to keep our communications secure.

Supporting our Citizens and Economy

The NCSC is committed to helping everyone stay safe online – from the smallest organisations to the biggest global brands. We have begun in-depth research to inform the content that we deliver to our varied audiences. We have listened to users and will be incorporating their feedback into the launch of our new website. The new website will have a focus on protecting individuals and families, businesses, charities, and government.

We aim to expand and develop our offer across the UK. We are developing a toolkit to help boards better understand the cyber threat and mitigate risks. And we are working with our Industry 100 partners to create innovative new ways to raise the level of cyber security across the UK.

CYBERUK 2018

CYBERUK is the UK Government’s flagship cyber security event. CYBERUK is all about promoting a national conversation around cyber security and building a community that works together.

We were delighted to bring CYBERUK 2018 to Manchester, a city synonymous with innovation, creativity and technology.

Over the three days in April, we had engaging speakers, thought provoking topics and a plethora of talent in attendance. We were committed to putting diversity at the heart of CYBERUK 2018. This meant ensuring that we had diversity of thought in the programme, and provided a positive learning environment for all participants.

The conference brought together 2,500 delegates with combined expertise across multiple disciplines and professions. The event offered a wealth of content on the technical aspects of developing and implementing cyber security in the face of complex problems and threats.

We are pleased to announce that CYBERUK 2019 will be held in Glasgow.

CYBERUK 2018 in Manchester

Industry 100

The NCSC’s Industry 100 initiative brings together public and private sector talent to generate innovative ideas and collaborate on some of the latest cyber security challenges across a wide range of NCSC placements.

Since the programme began, we have been pleased to welcome 132 professionals from 60 organisations who have come together to enhance the cyber security of the UK.

Contributors have included representatives from sectors including legal, finance, aerospace, telecoms, academia, IT, oil and gas, nuclear and engineering.

People

The NCSC’s single greatest asset is our people. At a time of rapid change in our industry, we are helping students of all ages develop the skills they need to grow to work across the UK and have a rewarding and interesting career in cyber security.

CyberFirst Girls Competition Final

CyberFirst Bursaries

The CyberFirst Bursary project continues to grow, and in autumn 2018 more than 500 students will have joined the initiative. Each student receives £4,000 a year and a minimum of eight weeks’ paid cyber security work experience or training each summer with industry or government.

CyberFirst Degree Apprenticeships

In September 2017, we ran a recruitment exercise for our brand new Cyber Security Degree Level Apprenticeship which will see young people working within the NCSC’s parent organisation, GCHQ. Successful applicants will start a degree apprenticeship, learning everything from code to emerging technologies, with a potential full-time role upon graduation.

The apprenticeships give students exposure to some of the most cutting-edge technologies and practical insights into the innovative ways we use them. In our first year, we have already made over 100 offers of an apprenticeship and were pleased to welcome our first intake in September 2018. We hope this programme will open up a career in cyber security for a wide range of people – not just those who choose to go to university.

CyberFirst Courses

This year, we held CyberFirst courses in Edinburgh, Belfast, Cardiff and Southampton as well as 23 free, week-long summer courses at universities across the UK.

CyberFirst Girls Competition

Women make up only 11% of the global cyber security workforce. Through the CyberFirst Girls Competition, we are working to increase the number of young women in the cyber industry.

This year’s CyberFirst Girls Competition attracted over 4,500 girls aged 12-13. The finalists overcame 170 challenges of varying difficulty and the top ten teams qualified for a head-to-head final in Manchester. As part of their prize, all the finalists were then invited to Buckingham Palace to meet His Royal Highness The Duke Of York.

In 2019, we are hoping to build on this year’s success by expanding the CyberFirst Girls Competition to over 1,000 schools.

Research

We worked with external partners to support programmes that put the UK at the forefront of cyber security research. This gives us access to world-class experts and helps the NCSC to discover new ways to keep the UK’s information safe.

Quality

Organisations need confidence that the people, products and services that help them manage their risk will improve their security, not undermine it. Working with our external assurance partners, we operate a number of commercial initiatives that give organisations the evidence to help them differentiate the good from the bad.

Innovation takes new thinking and insights and turns them into the things we need to live and do business in cyberspace. We work with DCMS to create an ecosystem that will transform ideas into real world solutions. This brings our experts together with small businesses to help solve the cyber security challenges we face today. At the heart of this is the NCSC’s Cyber Accelerator.