Britain’s National Cyber Security Strategy

The British government’s has publishes it annual progress report on the National Cyber Security Strategy 2016-2021 (NCSS) and reflects on progress already made against the NCSS goals and outlines future priorities as the strategy enters its final year. 

The Covid-19 pandemic has highlighted the vulnerability of the UK’s Critical National Infrastructure (CNI) to disruption by malicious actors,and ensuring the resilience of such essential services will be a clear priority throughout 2021. 

The tumultuous events of the Coronavirus pandemic has done much to reinforce the importance of cyber security to the UK’s national wellbeing.  “Millions of us have been relying more heavily on digital technology to work, shop and socialise,” it says in the introduction. “It has been an empowering and liberating force for good at a time when people have felt confined. It has been a lifeline keeping people connected with family and friends, ensuring the most vulnerable receive medicines and food deliveries, and is underpinning the operational delivery of our ongoing response to the pandemic... alongside the clear benefits technology brings come growing opportunities for criminals and other malicious actors, here and abroad, to exploit cyber as a means to cause us harm."

In particular, the UK’s departure from the European Union presents over the life of the current 5 year strategy offers  new opportunities to define and strengthen Britain's position as independent country, including how the nation tackles existing and emerging cyber security threats at a time when the global landscape is rapidly changing.

In the past year, the government has run several initiatives to evolve and strengthen the approaches that CNI organisations take to cyber security, working across government, with various regulators and public and private sector organisations to build a collective understanding of the challenges faced by CNI owners, and develop new strategies to address them. This work has included improvements to cyber security regulatory frameworks and the establishment of a Cyber Security Regulators Forum, and the ongoing implementation of the Network and Information Systems (NIS) regulations, which a post-implementation review seems to suggest are proving quite effective at strengthening security approaches among operators of essential services. 

Throughout this year, the government will continue to work across CNI sectors to improve assessment and reporting processes, and plans to develop bespoke penetration testing frameworks to help telecom operators in particular defend against, manage and recover from cyber attacks. It will also put more energy into improving understanding of the UK’s supply chains and dependencies – which is especially vulnerable to disruption thanks to the government’s approach to Brexit. 

The report outlined plans to extend the deployment of the National Cyber Security Centre’s (NCSC’s) Active Cyber Defence (ACD) programme beyond traditional government sectors in support of private sector CNI. 

An ACD Broadening project will aim to build on the success of the programme and expand it out to a broader range of sectors to allow them to benefit from automated protection from commodity cyber threats. Currently, the service includes protective domain name services, web and mail checks, host-based capability, logging, vulnerability disclosure, the Exercise in a Box programme and the Suspicious Email Reporting Service (SERS). 

The NCSS progress report also outlined other key priorities for 2021, which include: enhancements to the UK’s threat intelligence capabilities; the expansion of cyber crime deterrence programmes such as the National Crime Agency’s (NCA’s) CyberChoices scheme. However, 2021 also marks the end of the NCSS in its current form, and there is still no clear idea as to what comes next. The NCSS has been heavily criticised, including by the National Audit Office, for missing targets and goals, and although the report made no mention of its misfires, it did highlight the need to plan for the future. 

The report highlighted several developing trends that will inform government strategy after 2021, notably: the increasing reliance on digital networks and systems as surfaced by the pandemic. 

The increasing pace of technological change and greater global competition; a wider range of cyber adversaries as more criminal groups gain access to commoditised attacks. State-backed actors enhance their capabilities; and competing visions for the future of the open Internet and the possible risk of its fragmentation, which the government said will make consensus on norms and ethics in cyber space harder to reach. 

The UK’s approach to these challenges are largely defined by the outcomes of the Integrated Review of Security, Defence, Development and Foreign Policy. “The achievements of the last four years mean we start from a position of strength,” wrote the report’s authors. “Cyber security is an area where the UK can genuinely claim to be world-leading. But a changing global context will require a renewed response.... The UK will need to strengthen our cyber resilience to drive economic recovery, get ahead of changing technologies, and enhance our international cooperation and engagement to work towards a more stable cyber space...  We will not achieve this unless we continue to work ever more effectively with partners in the UK and abroad, the devolved administrations, businesses, universities, local authorities, civil society, international allies and individual citizens, wherever they share our vision of the benefits that cyber space can bring."

The rapid evolution of the cyber landscape will constantly throw up new challenges as technology evolves which  Britain adversaries will act to exploit and the the strategy objective is to provide a range of policies, tools and capabilities that will ensure Britain can respond quickly and flexibly to each new challenge.

Gov.UK:     Gov.UK:     Security Newsdesk:      Computer Weekly:       Six Degrees:      Image: Unspalsh

You Might Also Read:

Britain's Cyber Force Toughens Up:

 

« Minimising The Impact Of Ransomware
The Qualities That Make A Successful Cyber Team »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Covenco

Covenco

Covenco is a data management and IT infrastructure specialist. Working with customers to transform their IT environments, with data protection and security at the forefront of everything we do.

Phoenix Contact Cyber Security

Phoenix Contact Cyber Security

Phoenix Contact Cyber Security is a leading manufacturer of network security appliances for use in industrial environments.

Rockwell Automation

Rockwell Automation

Rockwell Automation offer industrial security solutions to protect the integrity and availability of your complex automation solutions.

National Intelligence Service (NIS) - South Korea

National Intelligence Service (NIS) - South Korea

The NIS oversees policy on cyber security in South Korea by formulating and coordinating the execution of such policy and devising necessary schemes and guidelines.

CyberOwl

CyberOwl

CyberOwl builds on cutting-edge research and combines decades of experience in developing, securing and operating large distributed systems.

National Cyber Security Centre (NCSC) - New Zealand

National Cyber Security Centre (NCSC) - New Zealand

The role of the NCSC is to help New Zealand’s most significant public and private sector organisations to protect their information systems from advanced cyber-borne threats.

Idaptive

Idaptive

Idaptive delivers Next-Gen Access through a zero trust approach. Idaptive secures access everywhere with single sign-on, adaptive MFA, EMM and analytics.

Wizlynx PTE LTD

Wizlynx PTE LTD

Wizlynx PTE LTD is the Singapore branch of Wizlynx Group located in Singapore, offering Information and Cyber Security Services throughout the entire Asia Pacific (APAC) region.

DataDome

DataDome

DataDome offers real-time AI protection against all OWASP automated threats, including credential stuffing, layer 7 DDoS attacks, SQL injection & intensive scraping.

CryptoCurrency Certification Consortium (C4)

CryptoCurrency Certification Consortium (C4)

The CryptoCurrency Certification Consortium is a non-profit organization that provides certifications to professionals who perform cryptocurrency-related services.

IT Band Systems

IT Band Systems

IT Band Systems is an international provider of IT products and services including web server monitoring and web security consulting.

CleanCloud by SEK

CleanCloud by SEK

CleanCloud by SEK is a CSPM product focused on public cloud data protection and security regulations, with over 400 compliance checks for the market's leading frameworks and regulations.

Cognyte

Cognyte

Cognyte are a market leader in security analytics software that empowers governments and enterprises with Actionable Intelligence for a safer world.

Graylog

Graylog

Graylog provides answers to your team’s security, application, and IT infrastructure questions by enabling you to combine, enrich, correlate, query, and visualize all your log data in one place.

Rimstorm

Rimstorm

Rimstorm’s mission is to significantly improve the security of your data using award-winning, state-of-the-art technology combined with cyber managed security services.

Grindstone Ventures

Grindstone Ventures

Grindstone Ventures is a post-seed fund that supports post-seed equity and quasi-equity investments in early-stage innovation-driven and/or technology companies.