Paul Hopkins

Cyber Assessment Framework (CAF) 3.2 Released! 🚀 This week, NCSC announced the latest update to the Cyber Assessment Framework (CAF), Version 3.1, which continues to support and enhance cyber resilience across the UK's Critical National Infrastructure (CNI), organisations adhering to the Network and Information Systems (NIS) Regulations, and those dedicated to cyber-related public safety. Here's your whistle-stop tour of the CAF, and the changes released this week: ❓ What is the CAF? The CAF is a set of guidelines developed to help UK organisations (usually CNI or within the NIS scope) improve their cyber resilience. It provides principles, outcomes, and indicators of good practice for organisations to assess and improve their cybersecurity measures, promoting a risk-based approach to managing cyber threats. 🔍 What’s New? Language Enhancements: NCSC has made revisions to improve clarity and consistency across the Framework’s Principles, Contributing Outcomes, and Indicators of Good Practice. Significant Updates: In alignment with the new Government Cyber Security Strategy, which places the CAF at its core, they have introduced a "Partially Achieved" level for the IGP concerning Media/Equipment Sanitisation. This update recognises the unique data confidentiality risks managed by public sector organisations. 💡 NCSC's Pro Tip: Always use the supporting guidance alongside the Framework. The added context is invaluable for interpreting and applying the Framework effectively. #CyberSecurity #CAFUpdate #CyberResilience #UKCNI #PublicSafety #NISRegulations #RiskManagement #CyberAssessmentFramework

30

2 Comments

So today I am posting the 6th in the NCSC CAF series. The document isn’t technical - it’s not meant to be, it's written to explain a concept that forms part of a holistic cyber posture, chunked into the CAF principles - this one is about Identity & Access Control. 5 minute read - two pages of text - come on you can do it!! Key takeaways: What is it - in simple terms How does it work - as a physical scenario What should you consider - at really high level I am interested in constructive feedback - so if you have any whack them in the comments or DM me. If you want me to expand my view, just reach out. Happy Cyber Awareness Month!!!

10

1 Comment

Have you heard of Quishing? Quishing is a form of phishing which uses QR codes to lure targets to criminal websites! CyberScotland has just released this new blog giving great advice - https://lnkd.in/d54kzAQE How do you currently test if the QR code you are scanning is safe? #qrcodes #scams #cybersecurity #securityeverywhere

30

18 Comments

The UK government via the NCSC (National Cyber Security Centre) have released some help and guidance for Incident Management in OT environments, there are some good suggestions in here, including the 6 step process.   • Preparation • Identification • Containment • Eradication • Recovery • Lessons Learned   See more via this link https://lnkd.in/eHARSrhp   ISF members can combine this with the ICS Insights: OT Cyber Incident Management report https://lnkd.in/eBgYm_8K and this will give organisations a strong response process in case of any incidents.   The NCSC guidance does not cover many of the areas we covered as part of the research, having spoken to ISF Members we felt these areas were key to effective response.   ISF Members can also look at the whole ICS Insights: Collection https://lnkd.in/eYfysNFe for more help on security both OT and ICS

12

1 Comment

Interesting to see this peddled again “a lack of basic cyber hygiene”. Reviewing the latest #CyberBreach survey from HMG is sobering reading. 75% of UK business report #Cyber as being a key area for the board, yet this (again) results in total lack of #Governance: - 33% of businesses have a formal security policy - 31% have conducted a risk assessment - 30% have a board member with cyber responsibility (this has returned to the levels of 2016-18) - 27% have asset management activities - 13% are aware of the NCSC 10 Steps Guidance, but only 3% have actioned all 10 steps - 11% have conducted a pen test - 11% have reviewed their supply chains - 12% are aware of CyberEssentials (up from 8% in 2016) - 3% review NCSC/ICO guidance on Cyber (up from 2% since 2016) This is damning, we have excellent guidance on the NCSC website for Cyber and on the ICO website for Data Protection. 41% of the business are consulting externally, so why are those consultants not advising their clients correctly? I have a real issue when we fete the current #CyberSecurity strategy yet in every demonstrable metric it’s failing to engage and inform. I hope that the new government looks to reset the foundations before pushing on with anything else. Within our clients, we place baseline guidance for Cyber and Data Protection at the centre of the engagement. This ensures that governance is reset and a solid foundation can be provided for improvement.

2

2 Comments

This is a great report on the cyber aspects of data breaches the ICO has seen and what could have been done to prevent them. Well worth a read. https://lnkd.in/d8nu6vyH

87

5 Comments

New figures from the ICO, show 347 #cyber incidents were reported in the education & childcare sector in 2023 - an increase of 55% on 2022. Government data, suggests most schools & colleges have identified a #Cybersecurity breach in the past year.

2

Interesting details on the pg 14....... Gordon Cowan, Gerry Kennedy #responsibility #accountability "Myth 1: Cyber insurers pay ransoms to save money Critics say cyber insurers pay ransoms because it’s cheaper than incurring the other business disruption costs. However, insurers often incur higher incident costs than the initial ransom demand, spending more on crisis response and recovery expenses.Data shows that a fraction of claims costs go toward ransom payments because insurance providers prioritize and fund strategies to avoid paying. " "Myth 2: Cyber insurers are undermining resilience A ransom payment ban might make sense if businesses were at a reasonable level of cybersecurity maturity, especially if cyber insurance providers were making businesses more likely to pay the ransom. Yet, the number of businesses that opted to pay declined from 80% in 2019 to a record low of 31% in 2023.12" "Myth 3: Cyber insurers have encouraged the ransomware epidemic Naysayers focus on how cyber insurance providers shape negotiation strategies, but studies show the industry had a neutral impact.13 If anything, insurers have been actively reducing the rate of compromise to prevent infections that force the payment decision." "A ransomware payment ban is not the answer Complex problems are rarely solved with binary solutions; ransomware is no different. A payment ban would limit options available to victims with little evidence that doing so will end the ransomware problem. The government already has a policy lever to ban payments to ransomware gangs, which Coalition supports and enforces. In all other cases, we support policyholders in making the decision for themselves based on their situations." https://lnkd.in/eXX-niRG

2

We're gearing up for our first lot of beta testing with the latest escape room scenario from Esc - The Cyber Escape Room Co.... This one focuses on Insider Risk but there are some great other components we've added to entertain, engage and educate... 📝 Origami Puzzle - a physical representation of how data encryption works. Fold it wrong, and you'll get the wrong code for the book safe... 📕 Book Cipher - a historical way of encoding messages, dating as far back as The American Revolution... 📑 Ransom Note - written in morse code, so your team can get to grips with decoding information... Which puzzles are you most excited about trying out?!

17

2 Comments

Need help with #NIST, or #ISO27001 compliance? I've seen a rapid rise in businesses demanding these accreditations from their suppliers and Punk Security Limited has a lot of experience in performing Gap analysis and implementation for both.

8

While there is nothing in particular within this article to disagree with, it is very slightly misleading in its theme. The cyber attack in June was carried out against a third-party supplier to the NHS. Not specific against the NHS trust(s) themselves. Which makes we wonder where the NHS DTAC comes into all this? NHS DTAC was introduced with a core purpose to: “…be used by healthcare organisations to assess suppliers at the point of procurement or as part of a due diligence process, to make sure digital technologies meet our minimum baseline standards.” This includes criteria such as Data Protection and Technical Security. The DTAC should be rigorously applied to existing suppliers as well as new/as part of procurement. https://lnkd.in/eEEdws2i

1

I have been convinced that HM Government will pass the onus of keeping data safe to the keepers of that information, i.e. businesses. Very soon it may become compulsory to be Cyber Essentials accredited in the hope that businesses will be more careful about data protection and avoid subsequent GDPR fines. C4 Secure offer a guided route to assured success of achieving accreditation. Book a chat by clicking the link below: https://lnkd.in/e_dGg64s #strongertogether #thisisnorthants #cyberessentials #gdpr Cyber Tec Security

2

The UK's National Cyber Security Centre #NCSC launched a series of useful tools and services back in 2017 to help primarily public sector organisations protect themselves against the rising tide of attacks. This early innovation has stagnated a little in recent years so I'm pleased to see the announcement of Active Cyber Defence 2.0. The NCSC are taking a welcome change of tack here, rather than trying to reinvent the wheel themselves, they are open to collaborating with academia and industry. They will focus on providing services that the commercial market isn't able to - and will look to divest successful services to the private sector. This is a sensible approach. Most successful attacks are still due to people failing on the basics - passwords, patching and phishing. Hopefully this new collaborative approach will raise the baseline of cyber maturity across the UK public and private sector. The recent NHS blood transfusion ransomware attack on Synnovis has proven that the only way to protect our critical national infrastructure is with a systemic approach which considers the whole supply network, not focusing solely on the public sector. https://lnkd.in/euhMvMUN

28

1 Comment

Cyber Essentials is a Government-backed scheme that focuses on helping organisations protect themselves against the most common online threats. If you’re a supplier planning on bidding for UK government contracts involving handling certain sensitive and personal information, it's a mandatory requirement. However, even if you are not planning on working as a government supplier, the Cyber Essentials certification aims to provide businesses with a baseline of cybersecurity controls. At Lucid, we can help you to put the controls and measures in place that will allow you to secure cyber essentials certification, and maintain it in the future. To find out more or to discuss how we can help, please feel free to drop me a message or get in touch with our team at lucidgrp.co.uk #LucidGroup #CyberEssentials #CyberSecurity #TechSupport

2

The more I read about the extensive PII leak from NPD the more I’m frustrated. At this point in time countless companies want your PII but there are no laws, incentives, regulations etc in place to ensure they are doing right with their cybersecurity to ensure your data is safe. NPD managed to leak 237 million individuals PII because they had a clear text zipped up document hanging on their website that listed usernames and passwords (many using the same default password issued across the board that was only 6 characters). This is 100% unacceptable and people shouldn’t continue to be victims to companies that can’t or won’t pay for proper cybersecurity.  What has to take place for companies to take this seriously? Is it immense fines per individuals data? Jail time? What are your thoughts? https://lnkd.in/eTG_ksWq

12

7 Comments

Useful info on #OperationalTechnology - we forget how important this stuff is as its often in the background and forgotten about. It's also relevant in non CNI situations - our testers often get involved in assessing building management systems, CCTV, fire control systems and physical access controls. These systems can be connected to data networks but not managed by the same IT teams resulting in less stringent governance and poor security controls being applied. https://lnkd.in/edyGcX7k #OTassessments #cybersecurity

12

If true, the cheapest bidder knew the impact of their box-ticking minimum effort and the subsequent fallout. Achieving Cyber Essentials and Cyber Essentials Plus is what ANY business should do - the clue is in the name - as these are merely the ESSENTIALS to combat the low-level threats. These certifications are just snapshots of a business’s technical controls and if there is no further effort towards continuous improvement and the only effort is to achieve the essentials, this is what happens. Once again, a supply chain weakness where the value of the data they held wasn’t fully understood has potentially weakened our armed forces. Yes, it’s “just” payroll data but that’s more jigsaw pieces that have been thrown into the box for an automated system to pick up and build a more complete picture.

35

22 Comments

Cyber Essentials is a Government-backed scheme that focuses on helping organisations protect themselves against the most common online threats. If you're a supplier planning on bidding for UK government contracts involving handling certain sensitive and personal information, it's a mandatory requirement. However, even if you are not planning on working as a government supplier, the Cyber Essentials certification aims to provide businesses with a baseline of cybersecurity controls. At Lucid, we can help you to put the controls and measures in place that will allow you to secure cyber essentials certification, and maintain it in the future. To find out more or to discuss how we can help, please feel free to drop me a message or get in touch with our team at lucidgrp.co.uk #LucidGroup #CyberEssentials #CyberSecurity #TechSupport

3