InfoSec News & Tutorials
Refreshed 'cyber security toolkit' helps board members to govern online risk I am delighted to announce the launch of the NCSC’s refreshed https://www.ncsc.gov.uk/collection/board-toolkit" target="_self">cyber security Board Toolkit. Originally published in…
New ‘supply chain mapping’ guidance Supply chain mapping is the process of recording, storing and using information gathered from suppliers who are involved in a company’s supply chain. Building on…
Zero trust migration: How will I know if I can remove my VPN? As your organisation makes the transition to zero trust, you may begin to question whether you still…
Phishing and ransomware amongst biggest threats to charity sector A new threat report published today reveals why the charity sector is particular vulnerable to cyber attacks, the methods used by…
Using MSPs to administer your cloud services Any conversation about securing cloud services will swiftly turn towards the cloud shared responsibility model, which boils down to ‘both you and your…
Telling users to ‘avoid clicking bad links’ still isn’t working Let's start with a basic premise: several of the established tenets in security simply don’t work. One example is advising…
Preparing for the long haul: the cyber threat from Russia In January 2022, ahead of Russia’s invasion of Ukraine, we asked all UK organisations to bolster their cyber defences. We…
Why vulnerabilities are like buses There's an old saying that you wait ages for a bus, and then several come at once. A growing trend is the mass exploitation of…
Using secure messaging, voice and collaboration apps With 'hybrid working' (a combination of working from home and the office) now a way of life for many, the NCSC is frequently…
Log4j vulnerability: what should boards be asking? The Log4Shell critical vulnerability in the widely used logging tool Log4j has caused concern beyond the cyber security community. This is because Log4j -…
Cyber Security in the Built Environment - considering security throughout a buildings lifecycle A building being designed today is, as you can expect, lightyears away from one designed only a…
The Technology Assurance principles In this blog post I want to introduce a new family of principles, the Technology Assurance Principles. These will help you to gain confidence in the…
'Transaction monitoring' & 'Building and operating a secure online service' guidance published If you're responsible for the designing and running government online services, you'll probably be familiar with GPG43 and…
Zero Trust migration: where do I start? Following our ‘Zero Trust: is it right for me?' blog, this second installment focuses on how to start your zero trust architecture journey.…
The Cyber Assessment Framework 3.1 This latest version of the Cyber Assessment Framework (CAF), 3.1, supports the CAF's core users - organisations within the UK Critical National Infrastructure (CNI), those subject…
New SOC guidance 101 Security operations centres (or SOCs) are notoriously difficult to design, build and operate. But they're also an important feature in many organisations and not always implemented…
Relaunching the NCSC's Cloud security guidance collection This week we have launched the updated NCSC’s cloud security guidance. It’s more evolution than revolution, as it collates and refreshes all of…
Avoiding crisis mismanagement Every day, an eclectic range of cyber attacks take place across the UK. No two attacks are the same – they vary in nature, severity, perpetrator and…
Mythbusting cloud key management services The NCSC’s recently-updated cloud security guidance includes a new section on how to configure and use a KMS for secure key management in the cloud.…
ACD the 5th Year: report now available to download The aim of the NCSC's Active Cyber Defence (ACD) programme is to “Protect the majority of people in the UK from…
Protect your customers to protect your brand We're pleased to publish a brace of documents that will help organisations to protect their customers from a range of cyber-enabled crimes, including…
The security benefits of modern collaboration in the cloud When using cloud services, it is important to balance the need to ‘open up’ access to information (to allow collaboration) with…
Introducing our new machine learning security principles Artificial intelligence (AI) and machine learning (ML) systems are increasingly used in every aspect of life, from providing the 'smart' in your smartphone,…