In early December 2024, the UK's National Cyber Security Center (NCSC) released its eighth Annual Review. While the report's primary focus is to recap the NCSC's activities over the past year, it also offers invaluable insights into how the UK thinks about and plans to act on cybersecurity. In this article, we'll look at a few of its key takeaways.
UK in "A Contest for Cyberspace"
The overarching theme of the NCSC Annual Review 2024 is the enormous scale of the cyber threat to the UK and the government's increasingly serious attitude towards it. This is best exemplified in the foreword by the NCSC's new CEO, Richard Horne, who states that the UK is now "in a contest for cyberspace" – by far the punchiest language the cybersecurity agency has used in this context to date.
The idea of cybersecurity as a geopolitical contest echoes throughout the report, particularly in the earlier sections outlining what the NCSC sees as some of the greatest threats to the UK's cybersecurity: China, Russia, Iran, and North Korea. The key takeaway here is that, amidst an increasingly tumultuous geopolitical landscape, the UK sees cybersecurity as instrumental to its cyber resilience and position on the world stage.
Significant Incidents Surge, CEO Calls for Action
Unsurprisingly, the NCSC's Annual Review reveals a significant increase in the number of security incidents faced by UK organizations. The agency's Incident Management (IM) team handled 430 incidents from September 2023 to August 2024 - up from 371 in the previous reporting period – 89 of which were nationally significant. More concerning still, 12 of those nationally significant incidents were "at the top end of the scale and more severe in nature," triple that of the previous year.
These statistics came shortly after Horne described the cyber risks to the UK as "widely underestimated" and called for collective action against an increasingly complex array of threats. Again, the idea of cybersecurity as a contest rears its head here:
"What has struck me more forcefully than anything else since taking the helm at the NCSC is the clearly widening gap between the exposure and threat we face and the defenses that are in place to protect us. And what is equally clear to me is that we all need to increase the pace we are working at to keep ahead of our adversaries," said Horne.
Focusing on Cyber Resilience
So, what is the NCSC doing about these claims? Focusing on resilience. According to its Annual Review, the agency is "prioritizing the cyber resilience of the UK's critical systems against the most advanced and sophisticated threats" by:
- Delivering transformational active cyber defense services and interventions
- Supporting legislative and regulatory reform
- Growing the UK's cyber ecosystem
- Influencing the security standards for new and emerging technologies
Moreover, the NCSC has stated that it is looking to move away from "traditional, anecdotal, incomplete, and slow approaches" to cyber resilience and adopt data-driven methods to help it respond better to emerging threats.
Developing the Cyber Ecosystem
The NCSC dedicates much of the Annual Review to outlining and celebrating the success of initiatives designed to develop the UK's cyber ecosystem and "future-proof" its national security. Key initiatives include:
- CyberFirst Girls Competition: This competition is designed to inspire girls aged 12-13 to explore cybersecurity and address the lack of diversity in the UK cyber workforce. Last year's competitions attracted more teams and schools than ever.
- CyberFirst Regional Ecosystem: This initiative includes CyberFirst Ambassadors, who act as a bridge between schools and industry, the CyberFirst Bursary, which helps undergraduates kickstart their cybersecurity careers, and the CyberFirst Hackathon.
- NCSC for Startups: This program aims to help young cybersecurity businesses shape their products and services.
- CYBERUK 2024: The UK's first cybersecurity conference that boasted:
- £2m boost to the local economy
- 2,380 in-person delegates from 55 countries
- 150 speakers across 45 sessions
These initiatives are encouraging because they reflect the NCSC's desire to not only protect against immediate threats but also nurture the UK's cybersecurity infrastructure. While we can only speculate as to their long-term success, it is, at the very least, heartening to see the NCSC take such a forward-thinking view of cybersecurity.
Summing Up
The NCSC's 2024 Annual Review paints a stark picture of the cyber threat landscape, emphasizing the urgency of collective action. Perhaps the most important takeaway here is that the UK views cybersecurity as a geopolitical contest: the recent surge in significant incidents underscores this perspective and will likely shape further action in the years to come.
Resilience is the other key theme of the report. The recently appointed NCSC CEO, Richard Horne, clearly feels that the NCSC has thus far not done enough to protect the UK from evolving and emerging threats. If the Annual Review is anything to go by, we're about to see NCSC efforts ramp up significantly.
Editor’s Note: The opinions expressed in this and other guest author articles are solely those of the contributor and do not necessarily reflect those of Tripwire.
