Host Based Capability

Endpoint monitoring services aim to understand, at a granular level, what is happening directly on IT endpoints and have become increasingly important in defending IT estates. As cyber adversaries continue adapting with changing tactics and threats, these services deliver a high level of accuracy in detecting vulnerabilities via behaviour analysis and identification of irregular data to mitigate cyber threats.

HBC is software suitable for OFFICIAL devices, collecting technical metadata for analysis by the NCSC.

Primarily available to the UK’s central government, provision of HBC is considered on a strategic case-by-case basis. These are usually received as internal NCSC referrals.

HBC's three-part service model seeks to provide value to government through:

Detect

• Our dedicated HBC Security Analysis function uses the range of NCSC's knowledge of indicators, adversary tactics, techniques and procedures against the data to detect malicious activity
• We identify or assist on incidents which are reported back to the departments for remediation
• We use expert techniques to analyse the data for anomalies, using each organisation as its own baseline

Threat Surface

Our Threat Surface reporting provides cyber security metrics to organisations regarding their cyber hygiene. We work with organisations to provide information that is insightful and actionable.

Forewarn

We seek to warn our organisations about major vulnerabilities that they may be exposed to. We use the data collected to understand each organisation’s exposure and inform them of our findings to help them take quick remedial action; identifying which devices have the vulnerability, which are not patched and providing independent assurance of which are effectively patched.

HBC benefits departments through:

• The unique value from the knowledge and tradecraft of the NCSC’s expert analysts
• Utilising the NCSC’s situational awareness to better inform detections on individual IT enterprises
• Providing information that helps organisations understand their IT strengths and opportunities to better secure their estate
• Offering a complementary service to organisations’ investment in their security (including use of commercial products)
• Providing a service at no charge to organisations

HBC is offered as a service to enhance your security posture alongside other tools/services; we do not recommend that you use HBC to rationalise other security products/tools on your estate.

If you think you are eligible for HBC, please speak to your main NCSC point of contact in the first instance. If you do not have a contact, please email [email protected].

If HBC can be provided to you, an agreement which explains the terms and conditions under which we can provide HBC must be signed. The HBC Team will work with you on all the steps and requirements to implement a rollout.

It is important to note that whilst HBC is free at the point of use from the NCSC, any implementation costs (e.g. change request fees) will need to be covered by the recipient organisation.