NCSC Annual Review 2024

Cyber security is how individuals and organisations reduce the risk and impact of cyber attacks.

Its core function is to defend the services we rely on and the devices we use – both at home and at work – from disruption, theft or damage. It's also about preventing unauthorised access to the vast amounts of data and personal information stored online and on these devices. 

Cyber security is important because most organisations in the UK are dependent, directly or indirectly, on digital technology to function. Cyber security ensures organisations, including the UK’s critical national infrastructure, can operate effectively in our increasingly connected world, and that governments can continue to provide the essential services that citizens depend upon.

Crucially, good cyber security facilitates better cyber resilience; the ability of an individual or institution to protect itself from, respond to, and recover from a cyber attack, data breach or service outage. All of these can cause huge financial losses and reputational damage.

On an individual level, smartphones, internet of things (IoT) devices, computers and the internet are now such a fundamental part of modern life that it's difficult to imagine how we would cope without them. Cyber security can prevent cyber criminals from accessing our accounts and services, keep our devices secure, and help us to navigate our online lives, safely and with confidence.

The National Cyber Security Centre (NCSC) was formed in 2016 by combining separate parts of government, MI5 and GCHQ, to create the UK’s technical authority for cyber security. Our mission is to make the UK the safest place to live and work online.

The NCSC supports the most critical organisations in the UK, the wider public sector, industry, small and medium-sized organisations and the public. We also work collaboratively with law enforcement organisations, the UK’s intelligence and security agencies, the National Protective Security Authority (NPSA), international allies and government partners. 

The NCSC reduces cyber risks to the UK by helping secure public and private sector networks, and reduces the cyber threat by seeking to understand and disrupt it. When incidents do occur, we provide effective incident response to minimise harm to the UK and help victims to recover.

We also coordinate activities across industry, government and academia to develop the UK's cyber security skills, technologies and capabilities. 

Any organisation relying on digital technology, directly or through its supply chain, is at risk of a cyber incident. The majority of cyber attacks are untargeted and opportunistic in nature. As the high profile cyber attack on the British Library illustrates, criminals will exploit weaknesses in an organisation without any regard for the sector it operates in, its size, or who is impacted.

Despite how they are frequently described in the media, most cyber breaches are not a result of 'complex and sophisticated attacks'. The vast majority of cyber attacks are still based upon well-known techniques exploiting commonly understood weaknesses. This means that organisations employing basic cyber security standards, such as Cyber Essentials, can successfully defend themselves from the most common online threats. Some cyber attacks are highly sophisticated, and these are usually conducted by hostile foreign states for espionage or wider state objectives.