The National Cyber Security Centre (NCSC), a part of GCHQ, is the UK’s technical authority for cyber threats.

Since the NCSC was created in 2016 as part of the Government’s five-year National Cyber Security Strategy, it has worked to make the UK the safest place to live and work online.

This Annual Review of its fourth year looks back at some of the key developments and highlights from the NCSC’s work between 1 September 2019 and 31 August 2020. As part of a national security organisation not all its work can be disclosed publicly but the review seeks to describe the year with insights and facts from colleagues and teams inside and out of the organisation.

• Crack the code

For the NCSC, as for the UK as a whole, this year has been dominated by the unprecedented challenge of the coronavirus pandemic. The organisation is dedicated to making the United Kingdom the safest place in the world to live and work online. During the pandemic it has tackled more cyber threats than ever before. This Annual Review shows how the NCSC took decisive action against malicious actors in the UK and abroad who saw the UK’s digital lifelines as vectors for espionage, fraud and ransomware attacks. The NCSC helped to protect NHS Trusts, the Nightingale hospitals and vital NHS systems, ensuring they were able to function remotely in spite of coronavirus.

In this year of complex challenges, the NCSC continues to react to swiftly evolving cyber threats. The organisation’s nationwide guidance to individuals and businesses on protecting their security proved invaluable. Its new service aimed at rooting out online scams saw the public respond with reports of over two million suspicious emails. This Review demonstrates two important messages about the NCSC’s work. First: we are all the targets of cyber criminals. While preventing crime is the NCSC’s priority, working in close partnership with law enforcement, it has also supported nearly 1,200 victims of 723 attacks this year that proved impossible to deflect. Second: cyber security is a team sport.

Government, industry and the public have an important role in building UK resilience to a spectrum of risks – hostile activity from state and non-state actors, terrorism and serious organised crime.At this pivotal time for the cyber sector, I want to welcome the NCSC’s new Chief Executive Officer, Lindy Cameron, and pass on my gratitude to her predecessor, Ciaran Martin. From the NCSC’s inception, Ciaran was instrumental in developing the UK’s National Cyber Security Strategy, striking the balance between economic opportunity and security. Lindy, with over two decades’ experience of national government security policy, is well placed to steer the NCSC from strength to strength.

The pandemic continues to affect how we live and work. It is vital that cyber security remains a priority. It will help us to stay ahead of changing technologies, seize the opportunities for the UK as an independent country outside the European Union, and harness cyber’s full potential to help drive economic recovery.

It is a great privilege to present the fourth Annual Review of the National Cyber Security Centre, a part of GCHQ. I am honoured to have been appointed as the NCSC’s second Chief Executive Officer, taking over from Ciaran Martin who was so pivotal in the development of this world-leading organisation.

This review outlines another impressive year of delivery for the NCSC from September 1st 2019 to August 31st 2020, largely against the backdrop of the shared global crisis of coronavirus. As you would expect, the pandemic features heavily in this Review. I am proud to lead an organisation of staff that both helped with the UK’s response to coronavirus and also sustained delivery of a nationally important brief, despite the challenges felt by us all this year.

The NCSC’s proactive measures to defend the UK from coronavirus-related threats fell into five strands of work:

1. Building NHS Resilience
2. Protecting vaccine and medicine research
3. Supporting remote working and tackling cyber crime
4. Securing the NHS Covid-19 app and large-scale data
5. Supporting Essential Service Providers

Building NHS resilience

During the pandemic, protecting healthcare was the NCSC’s top priority, and the organisation worked ceaselessly to support the NHS. The national objective was clear: to keep the system and its staff secure and resilient to cyber threats.

To achieve this, the NCSC introduced measures including the design of a new back-up service, pioneering discovery tradecraft and deploying analysts to look at NHS threat data. This was facilitated by the Department of Health and Social Care (DHSC) signing a “Direction” giving the NCSC consent to check the security of NHS IT systems.

As a result, more than one million NHS IP addresses were supported, over 160 high-risk and critical vulnerabilities were identified and shared, and threat hunting performed on 1.4 million endpoints. The NCSC supported the health sector through cyber security incidents, and ACD services were put in place to protect more than 235 NHS units, including Trusts.

Protecting vaccine and medicine research

Support to vaccines and therapeutic medicines was a clear priority for the summer. The NCSC supported the government Vaccine Taskforce, which controls decision-making on research funding and purchasing through to manufacturing and distribution, and several universities and pharmaceutical companies.

Work on vaccines and therapeutic medicines has an important supply chain component – particularly when it comes to manufacture and distribution – and this work will continue as an integral part of the NCSC’s mission.

Russian Espionage

In July, the NCSC revealed Russian cyber actors known as APT29 had been targeting organisations involved in coronavirus vaccine development. The NCSC assessed that APT29, also named “the Dukes” or “Cozy Bear” almost certainly operates as part of Russian intelligence services.

An advisory published on the NCSC’s website outlined a variety of tools and techniques, including spear-phishing and custom malware known as ‘WellMess’ and ‘WellMail’, were being used to steal valuable intellectual property. This not only exposed the hostile action directly but also demonstrated to a wide range of pharmaceutical companies that they needed to understand more about protecting themselves.

The assessment, which received front-page coverage globally, was supported by partners at the US Department for Homeland Security (DHS), Cybersecurity Infrastructure Security Agency (CISA) and National Security Agency (NSA), and the Canadian Communication Security Establishment (CSE).

Indicators of Compromise (IoCs) are pieces of data which identify potentially malicious activity on a system or network. These help network defenders detect and mitigate threat activity.

Before the NCSC created the IoC Machine last year, it took several hours for officials to share information relating to threats in the UK. The IoC machine can identify what can be shared in a matter of seconds – meaning the NCSC can share more threat information in real time.

With the improved ability to share IoCs and the need to protect the health and associated sectors during the pandemic, the NCSC exponentially increased the number of potential compromise tips to the NHS – with 51,910 shared by the end of August.

The shared IoCs were collated from the NCSC’s own declassified sources and from industry 100 (i100) secondees – our workforce initiative that sees companies loaning security-cleared experts to work alongside NCSC staff - from threat intelligence organisations. These i100 contributions have been significant and valuable, complementing the NCSC’s own collections and providing additional mitigation effects for the health sector. Secondees have worked alongside NCSC analysts to triage and investigate all IoCs before release, to ensure accuracy, validity and quality.

When many organisations moved to remote working because of coronavirus, the NCSC responded with new guidance on how to help employees work and communicate securely from home, including those who needed to use their personal IT for work.

The NCSC published advice for organisations moving their business online at pace. Advisories were issued about how cyber criminals were seeking to exploit the pandemic for profit, and guidance was updated on how to spot and deal with suspicious emails, calls and texts (including coronavirus-based scams).

The pandemic led to a huge increase in employees working from home, with many making rapid adjustments to their new “office” and learning new skills, such as coping with intermittent Wi-Fi, or handling the etiquette of virtual meetings on Zoom, Microsoft Teams or Skype. With more people using personal devices for work purposes came an increased vulnerability to cyber fraud, as criminals sought to exploit the changing circumstances. Some scams, frequently using phishing emails, claimed to have a “cure” for coronavirus, or sought donations to bogus medical charities. Many users found that clicking a bad link led to malware infection, loss of data and passwords.

Cyber criminals look to exploit any vulnerability to generate income – and coronavirus has been no exception. The NCSC has led the way throughout the pandemic to expose attack methods of those exploiting the virus online - and advise on ways to defend against them.

This year a significant proportion of attempted compromises have been related to coronavirus – whether it’s linking to bogus products or targeting people using their devices in a different way due to the pandemic.

The NCSC has disrupted thousands of attempts to trick people, from fake lures of PPE, testing kits and cures and even sham key worker badges to activate supermarket discounts. Coronavirus was the catalyst for the release of the NCSC’s Suspicious Email Reporting Service (SERS) – which has received more than 2.3 million reports from the public, leading to 22,000 malicious URLs being taken down.

Timeline of NCSC coronavirus-related interventions to support people and businesses

Securing the NHS Covid-19 app and large-scale data

The NCSC supported the NHS Test and Trace programme, the work of the Joint Biosecurity Centre (JBC) and the development of the NHS COVID-19 app to help curb the spread of the coronavirus.

The NCSC’s role

• Ensuring NHS teams had the information they needed to make decisions affecting users’ privacy and data security, including integrating a senior security architect to be the app Chief Information Security Officer
• Advising on cyber security best practice and how to implement it, helping the NHS teams to use the NCSC’s cyber security design principles as a guide
• Maintaining transparency and openness with the public about the privacy and security decisions made by the NHS, by blog posts on the NCSC website during development and to accompany trial and national launches
• Soliciting feedback from the cyber security community on the app, using our existing HackerOne Vulnerability Disclosure Programme (VDP) to gather input from outside experts
• Testing the efficacy of contact tracing using Bluetooth in lab and real-world scenarios

Threat modelling

A key area of NCSC support was supporting the threat modelling used by developers, helping them to understand the risk to the app from external threats, and helping them understand the potential implications of their security and privacy decisions. The NCSC ran multiple threat modelling workshops and supported the use of a consistent approach across the project, using the STRIDE model (Spoofing, Tampering, Repudiation, Informal disclosure, Denial of service, Elevation of privilege). This model has helped the NHS team implement more security measures in the app to support users’ privacy, data security, and resilience against misuse/abuse.

The balance of privacy and utility

The NCSC also supported the NHS to find the right balance between user privacy and utility. For example, the NCSC advised on the optimum level of analytical data collected so as not to de-anonymise users, but granular enough to provide meaningful insights into whether the app worked. Based on these discussions, the app team selected a minimum set of metrics which were chosen to fulfil the requirements – including postal district, isolation status and number of location check-ins. Where even these metrics could identify users, for example, postal districts with small populations, the analytics are aggregated into larger sets to reduce the risk of users becoming identifiable from the information they provide.

What are ESPs?

• ESPs are public, private and third sector organisations essential to the UK’s response to the coronavirus crisis
• They cover a wide range of areas including online supermarkets, haulage companies, ventilator manufacturers, healthcare suppliers, supply chain companies and charities
• They also include existing CNI partners such as communications, energy and financial organisations

How were they identified by the NCSC?

• At the start of the coronavirus outbreak the NCSC worked with government departments to identify and map ESPs
• Those already engaged with the NCSC were contacted, then the team worked with central government, trade associations and other organisations to bring together a portfolio of contacts
• The NCSC repurposed its CNI Knowledge Base, which maps the UK’s national infrastructure, to help government understand the interdependencies and connections between ESPs in certain sectors

What support were they given?

• 17 new items of guidance and a range of additional engagement material were produced to advise on the actions needed to reduce the risks of cyber attacks
• The NCSC liaised with 1,283 ESPs – enabling them to reach out to hundreds of additional supplier companies
• Incidents and cyber enquiries were managed and findings fed back into the NCSC’s products
• This work resulted in products being created to help the change in operating and working environment such as the ‘moving your business from physical to digital’ publication
• Bespoke offers of support were provided, such as the Cyber Essentials offer to small and medium sized businesses supporting healthcare

The challenge

Democracy relies on elected representatives meeting to debate, scrutinise and vote but restrictions on movement and contact meant MPs and peers were unable to do so in Parliament. Solutions had to be rapidly implemented to ensure Parliamentarians returning after Easter recess could conduct their business at a time when crucial decisions were being taken in Westminster.

Virtual debates

Technology was rapidly developed to allow Parliamentarians to debate from remote locations in a secure setting. This meant in addition to the 50 MPs allowed into the Commons, a further 120 were able to participate online. To counter the risk that hackers and online intruders could disrupt proceedings, the NCSC worked with Parliamentarians to upgrade awareness and training in cyber security. It provided advice to ensure the new system had the right balance of security controls to mitigate the threat posed by cyber criminals, while safeguarding important conventions and privileges.

Remote divisions

For centuries, voting in Parliament has been done in a very specific way: through the provision of physically entering one of the two lobbies on either side of the chamber to cast their vote.

With most MPs not in the chamber, a digital solution was required to allow votes to be cast remotely. A new system was built with multiple checks, to ensure a high level of confidence in the votes being cast.

Working together

The NCSC was just one part of a broader team that worked together to deliver virtual Parliamentary proceedings. Broadcasters, Parliamentary digital staff and staff across both Houses at Westminster collaborated to ensure appropriate cyber security controls were in place.

The 2019 general election

Protecting the UK’s electoral processes is one of the most important objectives of the NCSC. Supporting this aim sees the organisation working all year round – offering expert cyber security guidance and advice – to support political parties and parliamentarians. As part of the NCSC’s preparation the organisation monitored developments in the lead up to the vote and worked with international partners to learn from their experiences in mitigating the risk of cyber attacks against national ballots. During the election, the NCSC responded to a wide range of incidents, working behind the scenes to triage threats, investigate leads and providing advice and assistance where required.

Protecting the Register to Vote website

The NCSC supported the resilience and security of the online platform to allow citizens to access or update their details on the electoral register. The NCSC’s experts worked closely with the Register to Vote team at the Cabinet Office to review the site’s ability to withstand peaks in traffic.

On average, the Register to Vote website receives around 25,000 daily online submissions, but on 25 November, there was an unexpected spike in interest and the site received 366,000 applications.

Thanks to the groundwork done to ensure resilience, the service remained stable, despite the considerable increase in load, ensuring record levels of registrations.

Distributed denial of service (DDoS) attacks

Prior to the dissolution of Parliament, the NCSC hosted a seminar with the UK’s Parliamentary parties to brief them on the cyber security threat and the steps they could take to protect themselves.

Early in the campaign a series of DDoS attacks against political party websites became a major story. Whilst these were relatively low-capability attacks, the timing was concerning.

The fact these attacks were largely unsuccessful is a testament to the preparation done by the parties affected to defend themselves. The NCSC published relevant advice on its website and shared this guidance with the Parliamentary parties’ IT teams.

Support to new MPs

After the election, the NCSC provided guidance on best practice for all new MPs to ensure they and their staff were cyber security aware. Specific guidance on how to respond to targeted phishing attacks was given by the NCSC’s Incident Management (IM) team to more than 200 prominent figures – including government ministers.

Foreign interference

The UK Government is clear that any foreign interference in the UK’s democratic process is completely unacceptable, but certain states seek to exploit elections through cyber attacks, disinformation and other methods.

The NCSC is working with the Government in taking forward a programme to ensure there are robust safeguards against hostile state activity, foreign lobbying activity and third parties seeking to interfere in democratic processes. The UK will continue to identify and respond to malign activity alongside NATO and international partners.

Through guidance and training, the NCSC improves the level of cyber resilience among those in national and local government, ensuring that the public sector can rely on secure access to essential services, networks and data.

This year the NCSC has:

• Provided advice as part of the One Government Cloud Strategy, which will allow for unprecedented cross-organisational collaboration
• Supported HMRC with the introduction of coronavirus-related services including Job Retention, Self-Employment Income Support, and the Statutory Sick Pay Rebate Scheme
• Provided guidance on how to risk manage employees using IT devices while working from home and mitigated cyber security vulnerabilities in government departments’ systems
• Designed a new protocol which uses novel cryptography to allow public services to query sensitive databases on the cloud
• Overseen the secure delivery of data from departments as part of support to the Office of National Statistics in preparation for next year’s Census.

With government needing its personnel to be able to work remotely and securely on mobile devices, the NCSC’s Advanced Mobile Solutions (AMS) has given authorised users protected access to the most sensitive networks.

This year to ensure the safe connection between less secure remote devices to secret networks, AMS created new classes of “cross domain” technology, using highly innovative infrastructure security. The new approach has enabled methods of secure communication between individuals and groups, such as video conferencing, whether they are in protected facilities or working remotely. This provides a significant improvement in protection compared to standard security technology such as Web Application Firewalls.

Defence, Security & Resilience

The NCSC works closely with the Ministry of Defence (MOD) to ensure UK Armed Forces can operate with confidence based on reliable information shared safely with UK and international partners.

The UK’s most sensitive information and most important capabilities are protected using the NCSC’s Crypt-Key (an encryption management system), which is underpinned by the technical expertise the NCSC holds as the UK’s technical authority on cyber security.

Over the past year, the NCSC has worked with the MOD, NATO and other partners on the transformation that is required throughout the UK National Crypt/Key Enterprise and this vital collaboration will continue.

“At the NCSC, we are proud that our technical expertise helps to keep our armed forces safe and operating with confidence all around the world.”

Jacqui Chard, NCSC Deputy Director for Defence and National Security

UK Key Production Authority

At the heart of the NCSC’s security work is the expertise needed to create highly secure, encrypted communications for the government, military, industry and allies. Its research on improving these systems has led to significant new developments in Crypt-Key, transforming old, paper-based practices into modern, digital ones.

This year, the UK Key Production Authority (UKKPA) - a part of NCSC - replaced the long-standing method of producing cryptographic keys on punched paper tape with a more efficient capability for producing and distributing keys in an electronic, highly secure format, meeting the advanced requirements of national and international defence partners.

Eight-hole punched paper tape example

Defence of the realm

The NCSC worked to protect military personnel and the nation’s most important ground, naval and air assets, providing support with incident and threat reporting, and training for staff.

As part of this role, the NCSC provided advice on cyber security risks and policy to the Continuous At Sea Deterrent (CASD), including the mitigation of any potential supply chain vulnerabilities. Ongoing support is given to the Successor programme, which will deliver the replacement to the current Vanguard-class Trident Submarine.

The NCSC continues to provide NATO with “thought leadership” and technical expertise on cyber security and cryptography to help the organisation protect its communications and information infrastructure.

The NCSC led the development of NATO's action plan to protect its secure communications against the threat posed by future quantum computing and is providing ongoing assistance to NATO with the implementation of its plan.

HMS Vengeance, Vanguard-class submarine

Poseidon maritime patrol aircraft

The NCSC has been working with the MoD on all security aspects of the Boeing Poseidon P-8A Maritime Patrol Aircraft, which will offer a high level of sea defence to the UK due to its unique submarine-hunting capabilities.

Operating from RAF Lossiemouth, the aircraft successfully achieved its initial operating capability in April, contributing to maritime counter-terrorism, and will be able to support search and rescue operations worldwide.

Joint strike fighter

Defence’s fleet of new F-35B combat aircraft was being supported by the NCSC as they extend their operational ability with deployment into international areas of conflict. The NCSC is providing TEMPEST testing, ensuring the highest level of secure communications and has been involved in the development of Lightning Shield to maintain operational security. The latter ensures the F-35B’s Freedom of Action and is in operational use by the UK Lightning Force and Royal Australian Air Force.

The NCSC continues to review the cyber security of the aircraft’s international maintenance support and the rapid provision of the necessary key material to support carrier landings. It provides guidance to secure the international ground systems for the F-35B and provided technical expertise to mitigate the threat to the supply chain that supports the aircraft.

F-35B Lightning combat aircraft

Supporting the citizen

While the NCSC works to protect the UK’s national security and strategic interests around the world, closer to home it works to safeguard everyday citizens and communities from cyber crime and threats.

Every day billions of emails are sent globally, helping businesses to function efficiently and keeping people connected. While the vast majority are harmless, the small proportion that are malicious still account for millions of daily cyber threats.

“Phishing” attacks see criminals sending untargeted, mass emails asking for sensitive information (such as bank details) or encouraging recipients to visit a fake website. Such emails can be highly effective at mimicking an established organisation, and even highly skilled cyber experts can be fooled into clicking a link.

The NCSC has long been committed to making emails safe. While ACD measures make it harder to commit these attacks – and minimise the harm they cause – successful attempts still land in people’s inboxes.

That’s why this April the NCSC, in partnership with the City of London Police, launched the SERS, and encouraged people to forward emails they thought could be malicious. The response was immediate – with more than 5,000 reports within 24 hours. Four months after launching, the service had received 2.3 million reports – an average of 133,000 per week.

April to August 2020

This year there has been a growing trend of fake celebrity-endorsed investment scams.

The scams saw spoofed news articles featuring public figures such as Sir Richard Branson, Ed Sheeran and Martin Lewis promoting fake “get rich quick” schemes. The reader was encouraged to click a link to invest, but in reality the money went to cyber criminals. The NCSC’s Takedown team proactively searched for these scams and took definitive action to take down 300,000 malicious URLs created to trick people into losing money.

The NCSC’s Takedown team proactively searched for these scams and took definitive action to take down 300,000 malicious URLs created to trick people into losing money.

In March, the NCSC issued advice on the safe use of smart security cameras and baby monitors. This followed research by organisations like Which?, revealing that live feeds or images from smart cameras can in some cases be accessed by unauthorised users, putting the public’s privacy and security at risk.

Smart cameras are often configured so people can remotely access them and some are shipped with default (highly hackable) passwords set by the manufacturer. The NCSC’s advice included some simple steps for citizens to protect themselves and their families from this threat.

To counter the threats from vulnerable devices, the NCSC has supported the Department of Culture, Media & Sport (DCMS) in its development of legislation that will require manufacturers of connected consumer devices sold in the UK to:

1. Not include universal default passwords in their products
2. Have a vulnerability disclosure policy
3. Provide clarity to the consumer around how long a device will receive security updates for

The NCSC alert was accompanied by media briefings to ensure citizens had the necessary information to protect themselves, resulting in prominent press coverage and strong support from Which? and other influential commentators and individuals.

Financial Sector Cyber Collaboration Centre (FSCCC)

Working alongside the UK Government, NCA, financial regulators and institutions, the NCSC has been a leading player in a groundbreaking initiative to improve the resilience of the UK’s financial sector. This year, the NCSC supported the creation of the FSCCC, and hosted the new initiative.

What is the FSCCC?

The FSCCC is a partnership which identifies, investigates and coordinates the response to incidents that have potential consequences for the finance sector, by combining, analysing and distributing information from across the sector to produce timely outputs for the financial industry.

Last year, the NCSC launched the online tool ‘Exercise in a Box’, which enables businesses to test how resilient they are to cyber attacks. The toolkit offers a range of realistic scenarios organisations could face, allowing them to carry out drills in preparation for real-life events.

Due to the shift in the number of staff working remotely, in July a ‘Home and Remote Working’ exercise was released. It focused on three key areas of distributed working; how staff members can safely access networks, what services might be needed for secure employee collaboration, and what processes are in place to manage a cyber incident while working remotely.

As part of the exercises, staff members were given prompts for discussion about the processes and technical knowledge needed to enhance their cyber security practices. At the end, an evaluative summary was created, outlining next steps and pointing to the NCSC guidance.

Global take-up

The Exercise in a Box toolkit has at the end of August, more than 7,500 registered users with interest in the tool around the globe.

The top 10 countries by use with Exercise in a Box:

1. United Kingdom
2. United States
3. Ireland
4. India
5. Spain
6. Finland
7. Pakistan
8. Germany
9. Netherlands
10. Canada

The 10 scenarios you can test in Exercise in a Box are:

The NCSC’s Knowledge Base is the ‘Single Source of Truth’ that allows the government and CNI sector to better understand and manage the UK’s CNI, its supply chains, and the interdependencies between them all.

The Knowledge Base is a mapping tool (IT system) which helps analysts view the CNI data on a map or as a network diagram with each interdependency mapped across it. It was used to support the response to the coronavirus pandemic, and next year, the user base will be extended to help foster collaboration and discussion more widely across UK Government.

Both the criticalities approach (an assessment based on the importance of an organisation, supply chain or sub-sector) and the CNI Knowledge Base were developed and implemented by the NCSC on behalf of Cabinet Office (Civil Contingencies Secretariat) as part of the National Cyber Security Programme.

Most of the cyber threat to the public is in high volume, low sophistication, which can be prevented with basic actions. However, a considerable proportion of the public are not taking the simple steps to protect themselves. In 2019, it was reported that 23.2 million hacking victims had “123456” as their password. Without actively encouraging the adoption of protective behaviours, the UK will remain an attractive target for cyber crime.

The Cyber Aware campaign relaunched in April to build resilience to the increased cyber security threats related to the coronavirus outbreak. The campaign drove the public to a microsite with actionable guidance for staying secure online and advice on how to report a suspicious email.

With individuals spending more time online, and businesses moving increasingly from physical to digital practices, the Cyber Aware campaign will relaunch in November to encourage citizens and micro businesses to adopt the six behaviours that will help protect them from the most common attacks.

Cyber Aware Six Top Tips:

• Create a separate password for your email
• Create a strong password using three random words
• Save your passwords in your browser
• Turn on two-factor authentication
• Update your devices
• Turn on backup

Find out more at www.cyberaware.gov.uk

The NCSC is committed to raising cyber security maturity and resilience across every part of our national life. This includes supporting and empowering UK businesses, academia and the charity sector.

A snapshot of our partnership over the past 12 months:

The pandemic resulted in many organisations moving operations online. For sole traders or small business owners, establishing exactly what cyber security measures they needed to put in place was likely to be a challenge.

The NCSC stepped in and produced, in quick time, guidance to help organisations determine how ready they were for this digital transition and pointed the way to any new cyber security measures they should put in place.

The NCSC published its first analysis of the sports industry in July – which revealed 70% of sports institutions suffered a cyber incident in the past year, double the average for UK businesses.

‘The Cyber Threat to Sports Organisations’ report outlined measures recommended to prevent criminals cashing in on their industry.

Case studies in the report included;

• A member of staff at a racecourse losing £15,000 in a scam involving the spoofing of eBay.
• A Premier League club’s managing director was hacked before a transfer negotiation – meaning the £1 million fee almost fell into the hands of cyber criminals.
• An employee at an organisation holding athletes performance data had their email address compromised, allowing the hackers access to sensitive information over several months.
• An English Football League club suffered a ransomware attack which crippled their corporate and security systems. As a result of the attack the CCTV and turnstiles at their ground were unable to operate, almost leading to a game’s cancellation.

The NCSC continued its support for the academic sector this year as it saw a spate of ransomware attacks against UK schools, colleges and universities.

Through engagement with key institutions such as the Department for Education (DfE) and Jisc (a not-forprofit organisation providing digital and IT services to education and research institutions), rapid and tailored guidance was offered to the sector on how to improve cyber security.

Trusted Research

The UK has a thriving research and innovation sector that attracts investment from across the world – but the open nature of research collaboration also entails certain risks. ‘Trusted Research’ is the NCSC and Centre for the Protection of National Infrastructure’s (CPNI) latest advisory paper for UK universities and research institutions, which aims to help them make informed decisions about international collaboration and protect their own researchers and academic values.

Industry 100 – The private sector secondee initiative

The NCSC’s i100 scheme continues to expand, delivering results across all areas of the organisation. The initiative sees a variety of companies with unique insights and capability in cyber defence loan staff to the NCSC on a part-time basis to collaborate in defending the UK. The secondees are given a security clearance and sign an agreement that enables them to work alongside the NCSC’s staff, including on sensitive projects and investigations.

Cyber Security Toolkit

The NCSC’s Business Engagement team worked with over 80 new and established partners across the private sector, for example within construction, civil engineering, architecture and farming.

More than 150 legal firms were hosted by the NCSC in February for an event which articulated the threat to the legal sector and helped companies understand what mitigations they can put in place.

Cyber insurance

In consultation with major stakeholders and industry partners, the NCSC produced its first ever guidance on cyber insurance after calls for expert technical advice on the growing cyber insurance market.

The seven questions the guidance recommends senior leaders ask about cyber insurance are:

1. What existing cyber security defences do you already have in place?
2. How do you bring expertise together to assess a policy?
3. Do you fully understand the potential impacts of a cyber incident?
4. What does the cyber insurance policy cover (or not cover)?
5. What cyber security services are included in the policy, and do you need them?
6. Does the policy include support during (or after) a cyber security incident?
7. What must be in place to claim against (or renew) your cyber insurance policy?

Cyber Essentials is a Government-backed, industry-supported programme to help organisations protect themselves against common online threats. They can apply for two levels of certification;

1. Cyber Essentials – a self-assessment that gives an organisation protection against a wide variety of cyber attacks
2. Cyber Essentials Plus – a hands-on technical verification is carried to assess an organisation’s cyber security

In April, IASME Consortium Ltd became the NCSC’s sole delivery partner for Cyber Essentials. To ensure a smooth transition, they issued regular briefings for certification bodies, and they will work alongside the NCSC over the next 12 months to keep pace with the changing landscape and consider additional Cyber Essentials levels.

The NCSC’s acclaimed Cyber Accelerator programme works with dynamic startups to encourage new products, skills, jobs and growth. It is a collaboration between the NCSC, DCMS, and Wayra, Telefónica’s open innovation arm.

Based in Cheltenham, it offers mentorship to tech businesses that are creating solutions for the security industry and spurs innovation and competition to boost the country’s economic growth.

CYBERUK is usually a highlight in the NCSC calendar, bringing together both leaders and technical experts with an interest in cyber security from across the UK and abroad. CYBERUK 2020 was due to take place in Newport in May, but sadly had to be cancelled due to coronavirus.

The NCSC adapted to the challenges of the pandemic, switching from the physical to the virtual. It has set up a programme of work to build its capacity to continue to deliver bigger and better virtual offerings in the future. This will include a meeting of CYBERUK Leaders early in 2021.

While the NCSC works 24/7 with its partners to prevent cyber attacks, some will inevitably get through. In the last year the NCSC dealt with 723 cyber security incidents involving almost 1200 victims. These are the highest annual totals since the NCSC was formed.

This year’s total means that since the NCSC commenced operations in 2016, the organisation has coordinated the UK’s defence against a total of 2,528 incidents (annual totals of 590, 557, 658 and 723).

Several incidents came onto the NCSC’s radar proactively, through the expert work of its threat operations and assessments teams. Many others were raised by victims of malicious cyber activity and cyber attacks.

According to the DCMS ‘Cyber Security Breaches Survey 2020’, almost half of businesses (46%) and a quarter of charities (26%) reported having cyber security breaches or attacks over a 12-month period. Of the 46% of businesses that identified breaches or attacks, more were experiencing these issues at least once a week in 2020 (32%, vs. 22% in 2017).

The nature of cyber attacks has also changed since 2017. Over this period there has been, among those identifying breaches or attacks, a rise in businesses experiencing phishing attacks (from 72% to 86%), and a fall in attacks involving viruses or other malware (from 33% to 16%).

Incidents supported each year

The NCSC’s incident response to coronavirus-related cyber incidents

This map illustrates the broad geographic spread across the UK of all the cyber incidents the NCSC managed that may have had some bearing on the national response to the pandemic between February and July.

The location is indicative rather than a precise pinpoint of each incident. These incidents varied in terms of their severity and type.

Over the past year, the NCSC saw a significant rise in ransomware attacks on the UK, including an attack against Redcar and Cleveland Council which caused considerable damage and disruption.

There has also been a significant change in the way ransomware attacks are carried out. Rather than simply preventing access to data, criminals are stealing it and threatening to leak the most sensitive parts publicly. There are obvious business sensitivities to ransomware attacks, and there have long been fears the crime is underreported. The NCSC, in collaboration with the NCA, is committed to helping victims and tackling the wider issue, working as part of a team with law enforcement colleagues.

While the NCSC tracks trends and attempts to disrupt operations, it works closely with the NCA, which coordinates and leads the national law enforcement response to ransomware incidents. This includes supporting victims, successfully resolving incidents through a range of outcomes and pursuing criminal proceedings against those responsible.

So what is ransomware, why are criminals using it and how can you avoid being a victim?

What is ransomware?

Ransomware is a type of malicious software (malware) that prevents victims from accessing their device, or the data that is stored on it.

Once the malicious software is on a network, the criminals can encrypt data that would have an impact on the organisation’s services and then withhold it until a payment is made.

The system itself may become locked, or the data on it might be stolen, deleted or encrypted. Some ransomware will also try to spread to other machines on the network – such as the WannaCry malware that impacted the NHS in May 2017 – meaning it is untargeted and potentially viral.

The criminal ransomware model

Traditionally, the victim is told that they have been denied access to their own data which will not be restored until they make a payment in cryptocurrency, such as Bitcoin. Once this payment is made, the criminal will unlock their computer or allow access to the data.

The NCSC has seen an increase in the scale and impact of ransomware attacks and a new and growing trend to be more targeted and more aggressive than ever before.

What is the new trend?

Criminals are increasingly found lurking on a network, searching before ransomware is even deployed, looking for specific sensitive data that the victim would not want to be made public – such as a secret patent, or information about staff salaries.

Rather than simply seeking to withhold data, criminals are increasingly threatening to leak the most valuable information publicly unless the victim pays the ransom. This new trend to extort means that victims are at risk even if they have backed up their data, as they would not want the information published externally.

The data available suggests that the UK is not the most heavily targeted country, predominantly because British victims are traditionally less likely to pay the ransom than those from other parts of the world. However, the trends suggest that unless defences are improved, ransomware will increase globally and in the UK, with criminals developing new techniques to circumvent cyber defences.

What happens after a victim pays the ransom?

Even if the ransom is paid, there is no guarantee that victims will get access to their computer or files – or that the criminal won’t just charge again under threat of leaking the same information. It will also likely result in repeat incidents as criminals become emboldened in holding people to ransom.

Depending on the comprehensiveness of disaster recovery and business continuity plans in place, normal service can take weeks, if not months, to resume.

How to avoid being a victim?

The NCSC has updated its ‘Mitigating Ransomware and Malware Attacks’ guidance, recommending that organisations deploy a “defence in depth” strategy. By implementing a technical architecture with multiple defensive layers, if one mechanism fails another is there to thwart an attack.

Organisations should also have an incident response plan, which includes a scenario for a ransomware attack, and this should be exercised.

More generally, a good first step to avoid being a victim is making offline backups of data. The criminal will hold less power over an organisation or individual if they already have copies of the thing they are trying to withhold.

Threat operations

• Predict adversaries’ future behaviour and mitigate damage
• Consider both secret intelligence and open-source trends to assess cyber threats
• Share classified assessments wherever possible to UK defenders, on the NCSC website and threat sharing

Assessments

• Generating technical knowledge on the cyber threats facing the UK
• Discover and detect attacks proactively, through the NCSC’s unique intelligence and trusted partnerships
• Develop and deploy counter cyber campaigns that deter threat actors and make it harder for them to attack the UK

Incident Management

• Support for UK organisations that are the victims of the most damaging cyber attacks
• The IM team works closely with law enforcement, the UK intelligence community and the private sector
• Lessons learned from incidents are used to inform future assessments and public guidance to the sector

Under attack

In response to a significant and sustained cyber-attack, our company approached the NCSC to request support with the management of the investigation.

“The initial engagement consisted of information sharing, triaging and establishing a cadence for future meetings. This quickly evolved into a strong and beneficial partnership, based on mutual trust, transparency and a spirit of collective responsibility.”

Strengthening the defence

After appointing Cyber Incident Response (CIR) accredited suppliers and having further discussions with the NCSC’s Incident Management team, an introduction was made to Law Enforcement partners.

“This invoked a stream of investigative activity which not only served to stabilise a volatile and uncertain situation, but materially improved our understanding of the threat actor’s motives and intent.

“As a result, the company’s Executive Team were able to take appropriate risk-based decisions from a highly informed perspective, thereby minimising the impact of the attacker’s presence on the company’s operations.”

The NCSC’s role

“From a technical perspective, the NCSC’s Incident Response team provided significant support throughout the full investigative lifecycle.

“Operating as a central co-ordination unit, the team offered ongoing recommendations and guidance, ensuring that our continuity arrangements, eradication approach, evidence gathering, and cyber uplift activities were harmonised, prioritised and correctly orchestrated.”

Communicating with the public

A highly effective relationship was also built between communications team at our organisation, the NCSC and law enforcement. This ensured that consistent messaging was agreed and published in response to media speculation and enquiries from interested third parties.

“It also strengthened the assurances provided to our existing client base and perception of the partnership between the NCSC and the company to fully respond to the cyber-attack.”

“We owe a debt of gratitude”

“The overriding theme of the engagement was one of support, reassurance and effective team working.

“The professionalism, commitment and knowledge of the NCSC and Law Enforcement teams was exemplary throughout the incident.

“We owe a debt of gratitude to all those involved, who helped the company ensure critical operations continued to be provided to our customers during the incident and wider COVID-19 pandemic.”

The NCSC has regularly provided essential telecommunications advice to DCMS, Ministers and the wider public that has directly influenced UK policy. A prominent example this year has been the advice related to facilitating the country’s move from 4G to a more advanced 5G network.

In January, the UK Government announced plans to put in place additional safeguards and exclude high risk vendors, such as Huawei, from “core” parts of 5G and full-fibre networks. This decision, taken by the Prime Minister chaired National Security Council (NSC) was informed by detailed technical evidence from the NCSC as determined by the threat landscape at the time.

In a global first, detailed advice on this high-risk vendor decision was published to operators and the public, alongside a 30-page summary of the UK Government’s multi-year analysis into the risks to telecoms networks. This oversight has included the Huawei Cyber Security Evaluation Centre (HCSEC), which has been running for nine years.

Active Cyber Defence

The ACD programme seeks to stop a range of different attacks ever reaching UK citizens, institutions or businesses. Working in a relatively automated and scalable way, it removes the burden of action from the user and enables attacks to be taken down at scale.

There are six key programmes within ACD that have been rolled out in the public sector;

This year has also seen the NCSC build on previous successes with established tools. It has enhanced functionality of its Web Check and Mail Check services – which help owners of public sector websites to identify and fix common security issues. These have since been rolled out across the public sector and beyond.

Covid-19 themed takedowns

Since March, the NCSC has taken down 15,354 campaigns which used coronavirus themes in the ‘lure’. These were hosted globally.

Celebrity Endorsed Cryptocurrency Investment Scams Takedowns

Ecommerce

Security vulnerabilities are discovered all the time and people want to be able to report them directly to the organisation responsible. The NCSC has worked with organisations and those who find security vulnerabilities to make it easier to report and therefore quicker for the system owner to remediate the issue.

The NCSC runs three initiatives:

• Vulnerability Reporting Service allows vulnerabilities in UK Government services to be reported to the NCSC, if the system owner cannot be contacted. The NCSC will work to get the vulnerability information to the owner so the issue can be remediated. This year the NCSC has worked with over 150 UK Government organisations to remediate a range of security vulnerabilities

• The Vulnerability Disclosure Pilot aims to improve the UK Government’s ability to adopt vulnerability disclosure best practices. Departments signed up to the pilot gain access to a dedicated platform and a technical triage service. This year seven have launched their own vulnerability disclosure processes through the pilot
• The Vulnerability Disclosure Toolkit is designed for organisations of all sizes who want to learn more about implementing a vulnerability disclosure process. It contains the essential components they need to set up their own process

The service has grown over the past year to provide coverage for 130,000 government devices (up from 35,000 last year). The NCSC continues to provide a three-part service offering: Detect, Threat Surface, and Forewarn. In addition to detecting malicious and suspicious cyber activity within government, the NCSC has cumulatively provided over 170 ‘Threat Surface’ reports to its partners.

The Domain Name System (DNS) is one of the core technologies used on the internet, essentially acting as a phonebook or contact list to translate between human-readable domain names and machine-readable addresses.

Like all contact lists, errors can easily be introduced from causes such as human error or information simply becoming stale and inaccurate over time. In the context of DNS, this can lead to domain names pointing to resources that are unregistered.

The NCSC refers to these as “dangling DNS records”. Sometimes it’s possible for an attacker to register the resource that such a record points to, therefore giving them control over what is returned to anyone who visits the domain name. This attack, known as “subdomain takeover”, can have serious consequences and can result in victims being tricked into interacting with malicious websites, despite the domain name displayed in their web browser looking completely legitimate.

The NCSC has continued to grow its own internal specialists and talent pipeline, as well as supporting the Government Security Profession and wider government cyber security community. For the latter, the NCSC shared its Technical Reconnect programme with specialists from across government. The course teaches the latest NCSC guidance to ensure delegates are familiar with cyber security best practice and can recognise the drivers behind it. Delegates learn through highly practical hands-on opportunities to build, attack and repair the various technologies that are encountered in modern security environments.

The training is delivered periodically over six months, and instructor-led training, practical lab activities, group exercises and regular consolidation exercises. Together with the NCSC’s other cyber security training and development offerings, this offering quickly pivoted to online delivery as coronavirus took hold.

For the first time, a guide collating the knowledge of the world’s leading cyber security experts was created this year. Sponsored by the NCSC, the CyBOK is an 828-page resource offering a foundation for education, training and professional practice.

CyBOK was launched at London's Science Museum, January 2020

One of the most important programmes in the NCSC’s future skills agenda is CyberFirst, which encourages and supports young people into the world of cyber security.

It’s been an exciting year for the team and for the thousands of secondary and undergraduate students who took part in courses, competitions and applied for career-defining university bursaries to learn a host of interesting subjects such as digital forensics, ethical hacking, cryptography and cyber security challenges.

CyberFirst Students

CyberFirst Courses

Every summer, 1,100 free places are made available on five-day residential courses at universities across the UK. Courses were offered at three levels; Defenders (14 to 15-year-olds), Futures (15 to 16-year-olds), and Advanced (16 to 17-year-olds) – aimed at helping pupils develop the digital and problem-solving skills needed to operate in the field of cyber security.

In response to the pandemic the NCSC moved the summer courses online, with virtual classes led by instructors running from June through to August.

This year saw the highest number of applications yet (3,992) and an increase in applications from ethnic minority students (making up 23% of the total applicants) compared to previous years.

CyberFirst Girls' Competition Winners

CyberFirst Bursary and Academy

The CyberFirst bursary scheme continues to grow, attracting highly motivated and very talented undergraduates. There are over 900 hand-picked students either currently on or recently graduated from the scheme.

This summer, 165 undergraduates attended an eight-week virtual CyberFirst Academy programme and a further 224 students were placed with our industry and government members or on further online training programmes – providing invaluable work experience to help make the UK the safest place to live and work online.

Any company wishing to help develop and recruit these highly talented students and become a member of the CyberFirst community, should contact CFStakeholders@ncsc.gov.uk.

As part of its ongoing drive to increase female representation in cyber security, the NCSC worked with the South West division of Girlguiding UK to develop a badge and supporting activity pack called ‘On the Net’.

The initiative was launched in February at the University of the West of England (UWE), where 100 girls aged between 12 and 14 were invited to learn about online safety and how cyber skills can lead to career opportunities in cyber security – a field in which women remain underrepresented.

CyberFirst Girls’ Competition 2020

Diversity and inclusion

The NCSC partnered with KPMG to produce the first-ever review of diversity and inclusion in the cyber security sector. The report set an initial benchmark in the UK’s cyber security industry and began a long-term programme to make the profession more diverse and inclusive.

Inclusive Language:

In April, the NCSC published a blog post talking about the decision to stop using the terms ‘blacklist’ and ‘whitelist’ on our website. It’s a small change, but one that we hope is useful as part of our wider anti-racism efforts. The blog post resonated with many people across the UK – several got in touch to thank the NCSC for taking this step, and to say that this leadership has emboldened them to make similar changes in their own workplaces. The NCSC is proud to have added our voice to the wider discussion around the use of discriminatory terminology in tech - we want cyber security to be an inclusive and welcoming place for everyone, and our language should always reflect that.

Manchester Hub

In September a team from the NCSC joined its partners in GCHQ who have established a new research hub in the centre of Manchester. The aim of both organisations is to foster increased collaboration with the city’s burgeoning number of tech experts in business and academia.

Acknowledging that the city has one of the fastest growing digital and creative communities in Europe, the NCSC will be recruiting further personnel to join those experts already in place, with a brief to support its mission on protecting Critical National Infrastructure (CNI). The CNI mission at the Manchester Hub will include such areas as Energy, Transport, Finance and Smart Cities.

The NCSC’s technical expertise affords the UK a vital source of thought leadership and influence overseas. International engagement with our partners continues to be a central component of the NCSC’s work to enhance the UK’s cyber security and resilience. The NCSC regards cyber security as a global issue that is most effectively addressed together. By sharing information and working with international partners, not only can the NCSC better protect the UK, but it can also influence and assist its partners to do the same for their own countries.

Owing to the uniqueness of cyber security as a domain, the NCSC’s international collaboration goes beyond conventional forms of engagement, or cyber diplomacy.

Examples include:

• time-critical emergency response collaboration on live cyber incidents
• engaging with cyber security leaders on policy matters in global forums
• sharing best practice on operational technologies with overseas cyber security agencies
• working with companies headquartered overseas with links to the UK to ensure their cyber security practices are robust
• sharing ACD services

In October, then NCSC CEO Ciaran Martin led a UK delegation at one of the most significant cyber policy gatherings in the Asia-Pacific region: Singapore International Cyber Week (SICW). He was accompanied by representatives from the UK cyber industry, academia and government. At a bilateral meeting between the UK and Singapore, covering issues including information-sharing and collaboration on emerging priorities and technology, the two countries signed an IoT Security Statement. The signing demonstrated the UK’s international leadership in improvements in the security of smart consumer products, and strengthened the relationship with a partner in a region of strategic importance to UK interests.

The NCSC is proud to work with global partners to detect and disrupt shared threats. One of its key strengths in international collaboration is on cyber incident management and response, in which the ability to work alongside international partners is fundamental. For example, when investigating reports of a ransomware infection that had not been seen in the UK before, law enforcement colleagues in the NCA observed and reported that their investigations had shown a similar ransomware strain that had previously been decrypted by the Polish NCSC equivalent, CERT Polska.

The NCSC contacted the CERT Polska team to gain further information on the ransomware variant, and about the tool it had developed to decrypt it. The team at CERT Polska was open to collaboration and provided the NCSC with the code behind its decryptor, explaining how this could be turned into a standalone tool that could be used to support the UK victim.