NCSC Annual Review 2023

The NCSC continues to support government, public and private sector critical national infrastructure (CNI), citizens, and organisations of all sizes across England, Wales, Scotland and Northern Ireland to raise awareness of cyber threats and improve resilience for the whole of society.

Cyber resilience is essential to the UK’s economic and national security interests. The NCSC’s services and interventions are working to enhance the UK’s ability to prepare, respond, recover, and learn from cyber attacks, to make the UK the safest place to live and work online.

August 2023 marked 18 months since the publication of the National Cyber Strategy 2022, and it remains at the heart of the government’s comprehensive plan to keep our country safe online and grow our cyber industry. As outlined by the Deputy Prime Minister Oliver Dowden, “since its publication, we have become more secure against cyber attacks, and we have taken decisive action against our adversaries”.

Central to these efforts are a whole of society approach, bringing together private and the public sectors, “defending as one so we can prosper as one ”. This is in line with the government's approach to resilience as set out in the government’s Resilience Framework

Central to our whole of society approach, the NCSC has ensured long-lasting and meaningful impact by building ‘trust groups’; industry-specific communities of Chief Information Security Officers (CISOs) in businesses and organisations. This is now an established model that sees us work in collaboration with the trust groups on raising the cyber resilience in their sectors for:

• those larger organisations that make up the groups
• the thousands of smaller organisations that sit within their supply chains
• those citizens that are their customer base

This approach ensures engagement and nuance, allowing businesses, large and small, to access guidance and information, while also participating in a supportive community.

When it comes to raising the resilience of citizens and small organisations, our programmes of work focus on securing citizens and small organisations online at scale, reducing the burden on them to act.  Our Takedown Service in this programme is approaching 10 million takedown records for malicious infrastructure. By taking down malicious domains quickly, it reduces the number of people who fall victim to scams. To further strengthen those protections, the NCSC is building the Share and Defend capability. This capability will enable the sharing of government and industry data around malicious domains, at scale and in near real time, enabling the protection of citizens and small organisations upstream by their service providers. We are currently sharing data tactically with several major UK ISPs, whilst working collaboratively with industry to develop the capability, identify relevant datasets and place protections where they will have the most impact for users.

Appetite for the NCSC’s Cyber Essentials scheme continues to grow. The number of Cyber Essentials certificates awarded in the past year has increased by 21% to 28,399 overall; while the total number of Cyber Essentials Plus certificates awarded was 9,037 – an increase of 55%. In total 141,712 Cyber Essentials certificates have been awarded since the scheme began. The scheme is proving its efficacy too, with data suggesting that 80% fewer cyber insurance claims are made when Cyber Essentials is in place.

This year, the new Cyber Advisor scheme was launched to consumers, offering small organisations a network of 56 NCSC-assured providers (as of August 2023), to help with reliable, cost-effective cyber security advice and practical support. This work aims to improve basic cyber security in small organisations and reduce the likelihood of the most common cyber attacks.

Existing schemes continue to grow. Following an update that puts industry at the heart of the scheme, Assured Cyber Security Consultancy now has 26 providers offering risk management and security architecture consultancy. While the CHECK scheme now has 44 assured pen-test providers, who responded to over 4500 requests last year.

In August, a new Level 2 service was introduced to our assured Cyber Incident Response (CIR) scheme. Its aim is to support a wider range and larger number of victim organisations, by providing access to high quality, assured incident response services. With 13 providers assured across Levels 1 and 2, now more organisations can have confidence that the company they use has the right expertise to help them.

Now in its sixth year, the Active Cyber Defence collection of products and services continues to make the UK measurably safer from cyber attacks. Threat actors come and go, and the types of vulnerabilities being introduced and exploited continue to evolve. However, most of our ACD initiatives address enduring cyber security challenges: sharing knowledge of threats, closing down vulnerabilities, and responding to breaches. We believe that automation is the best way of generating the scale and reach required to tackle these challenges of today and tomorrow.

For all these reasons, we see ACD as a core part of how the NCSC will improve the UK’s cyber resilience over the coming years, as we continue to build services designed to protect UK citizens and organisations.

When ACD was launched in 2016, we developed services with the protection of government organisations specifically in mind. However, at the core of the UK’s National Cyber Strategy is a ‘whole of society’ approach, which is why we’ve broadened the utility of ACD products and services to a wider range of users, from small business owners to the education and charity sectors to citizens being able to report scam emails to the NCSC’s Suspicious Email Reporting Service (SERS). This conscious shift to designing and developing ‘radically simple' digital services, (with accessibility and ease of use as core design principles) can help provide the benefits of vulnerability checking to those individuals and organisations that do not have a dedicated security function.

We also want to make it simple for users to find, sign up to and manage our services, whilst reducing duplication and providing a smoother, more integrated user experience. We built the MyNCSC platform to turn that vision into reality. The platform brings several ACD products and services together into a single, coherent experience tailored to show the content, vulnerabilities, and alerts most pertinent to each user. These are currently Mail Check and Web Check. We plan to gradually increase the number of ACD products and services integrated with MyNCSC and have started migrating our customer organisations’ use of Early Warning to the platform.

This year’s ACD report noted the challenges of developing new services, which included improvements in levels of defensive capability, the need for a more dynamic commercial cyber security services market , and the growing sophistication of commodity threats. This has meant embracing different ways of ‘getting things done’, whether that’s building services ourselves, contracting with market-leading UK companies, or engaging with collaborative projects.

In March 2023, we launched Check Your Cyber Security (CYCS), our first free active service specifically for small organisations and sole traders. Through IP and browser checks, CYCS identifies and provides advice on common vulnerabilities. To date, approx. 24% of CYCS users have an out-of-date browser and the most common browser used is Google Chrome. FTP and MySQL have been identified as the most common IP vulnerabilities reported to users. The NCSC is investigating repeat users to track effectiveness of mitigation advice and additional support required.  Currently, 4% of users have subscribed to reminders, signalling a desire by users to utilise the tool on a regular basis to monitor their cyber security enduring usage.   

Looking beyond ACD, we’ve also ‘badged’ certain assured industry services to help organisations that don’t have the necessary skills differentiate quality. We’ll keep investing in proven delivery models but stay attuned to new approaches as the consumption of IT services shifts (for example, through cloud provision).  However, whilst we can identify quality, we can’t drive quantity; that comes from market demand. Ensuring there are enough providers offering quality services needs the full range of government and industry levers to be used. For example, larger organisations asking for Cyber Essentials in their supply chain will not only improve resilience, but will incentivise more providers to offer the service, upskilling their staff in the process. This will help build a thriving cyber sector, discussed further in this report.