NCSC Annual Review 2021
Pages
Page 12 of 44
Incident Management
While the NCSC does all it can to prevent attacks in the first place, it works continuously with its partners to respond to breaches, while helping victims to recover. The NCSC’s operations and incident response team, which works closely with law enforcement and intelligence partners, handled high volumes of incidents as well as major attacks that affected thousands of victims.
Incident Management response model:
- 1
NCSC becomes aware of incident
- NCSC’s 24/7 incident management function
- Incident is reported to NCSC by victim
OR
- Incident is reported to NCSC by partner organisation
OR
- Incident is detected by NCSC
- 2
NCSC triage incident
- Initial engagement with the victim to fully understand the incident
- Determine if further response merited and a ticket assigned
- A preliminary decision on the categorisation of the incident
- Determine whether NCSC support is appropriate
- 3
NCSC support victim
- Deliver effective real world response to minimise harm
- Facilitate the technical response to an incident, drawing on X-NCSC teams including:
- Industry partners
- Technical specialists
- Communications
- Work with law enforcement in support of a criminal investigation
- 4
X-HMG coordination
- Lead the National Incident Response including liaising with:
- Whitehall
- Law Enforcement
- Industry
- International partners
- To manage the incident and ensure coherence of response
- 5
Incident closure & insight sharing
- Alongside NCSC Resilience team, provide aftercare and inform “Lessons learned” for wider UK resilience
- Provide incident insight to inform Whitehall policy
- Develop exercising & red teaming to respond effectively to similar incidents in future
It was a record year for incidents dealt with by the NCSC. The team managed 777 incidents, another increase on the previous record, breaking 723 total from last year. The NCSC supported the NHS during 8 high severity alerts from April 2020 to March 2021.
777
incidents dealt with by the NCSC this year
This year’s total means that since the NCSC commenced operations in 2016, the organisation has co-ordinated the UK’s response to a total of 3,305 incidents (annual totals of 590, 557, 658, 723 and 777). Several incidents came onto the NCSC’s radar proactively, through the expert work of its threat operations and assessments teams. Many others were raised by victims of malicious cyber activity.
While the NCSC has world-leading capabilities in identifying, confronting and responding to cyber threats and deterring those responsible for them, it is just as important to improve defences to stop attacks getting through in the first place, and when they do, that organisations are better able to recover and limit the impact. The next chapter will describe how the NCSC is helping to create.