Cyber Security
Published 2 November 2020
© Crown copyright 2020
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/crowded-places-guidance/cyber-security
1. Introduction
Many organisations rely upon information systems to carry out business or nationally critical functions and employ digital technologies to manage safety, security and engineering systems. As a result, businesses can become vulnerable to threats that undermine their confidentiality, integrity or accessibility. The consequences of such incidents can be significant to organisations, leading to loss of reputation, damage to assets, regulatory fines or result in physical injury.
In order to understand the cyber risk to your business, you should conduct a Cyber Risk Assessment. This will help to ensure that your approach to cyber security is proportionate. Whilst there is no prescribed format for this, it should be based on the Risk Management processes detailed below. Note that the risk assessing is a continuous, on-going process which you will need to revisit as your business changes and / or threats evolve.
2. Assessing the risk
The following three step process will help you identify:
- The digital technologies and systems which are critical to your business
- Who might attack them
- How they might be vulnerable
This information will allow you to narrow down what you must protect.
2.1 Impact: what are you trying to avoid?
Your approach to cyber risk management should be driven by the ‘Impacts’ you are trying to avoid. Start by identifying the systems, data and technologies on which your business relies. The type of questions you might want to ask are:
- Is there technology that must be available for the business to function? (e.g. payment systems, access controls)
- Do physical security systems rely on digital technology? How are they protected?
- Are you processing sensitive data? (personal, financial) If so, what if this data is lost, stolen or unavailable?
- Are you reliant on third-party systems? If so, which systems are central to your business?
If you take a systematic approach, you should be able to produce a prioritised list. You then need to consider the impact of these systems being compromised or becoming unavailable. This basic understanding of what you care about and why it’s important, will help you identify what you must protect.
For further information:
Go to the National Cyber Security Centre’s (NCSC) Risk Management guidance
Go to the Supply Chain Security guidance
2.2 Threats: what type of attacks can you expect?
A ‘Threat’ is the individual, group or circumstance, which could cause a given impact to occur.
It can be challenging to develop an accurate assessment of the threat to your business without undertaking an appropriate analysis.
However, the following will help you develop a baseline threat picture:
- Commodity Attacks: All organisations and events, regardless of profile and size, are at risk from commodity attacks that exploit basic vulnerabilities using readily available hacking tools and techniques. Mass phishing campaigns are one example of such an attack. Many of these threats can be mitigated by following advice in the NCSC Small Business Guide.
- Targeted Attacks: Some businesses will be targeted by cyber criminals who, for example, intend to steal financial or personal information e.g. spear phishing. See How Cyber Attacks Work for further information about targeted attacks.
- Methodology: Most attacks are preventable and use well-known techniques. The NCSC Cyber Threat to UK Business and Weekly Threat Reports will help you understand the latest trends.
- Insider Threat: Not all threats are external. It is essential that internal threats are incorporated into your assessment. See the CPNI Reducing Insider Risk for further information.
- Learn from Experience: Has your business or similar businesses previously experienced cyber-attacks? How could those attacks have been prevented?
- With some research, you should be able to develop a baseline threat assessment. For example, you may decide that your business is unlikely to be deliberately targeted, therefore commodity attacks exploiting basic vulnerabilities are the main threat.
- Alternatively, you may discover that businesses of similar profile have been targeted by organised crime groups, therefore the threat is heightened and specific defensive measures are required.
- It should be noted that most targeted attacks still use basic techniques, such as phishing emails, to enable attacks. Good basics are always the first layer of defence.
3. Vulnerabilities: How secure are the computers, networks and systems you rely upon?
A ‘Vulnerability’ is a weakness that would enable an impact to be realised, either deliberately, or by accident.
The final stage of the process is identifying your vulnerabilities.
You should start by overlaying your critical systems (see ‘Impact’, above), with the expected capabilities of any attackers (see ‘Threats’, above).
Next, focus on establishing whether the security controls for each critical system are appropriate for the threat. Remember, most cyber-attacks are preventable if basic controls are in place - see the NCSC ‘Common Cyber Attacks: Reducing the Impact’.
For systems supplied by third parties
Identify who is supplying your critical systems and establish a clear picture of each supplier’s cyber security posture.
A good starting point is to ask whether your suppliers hold any existing security certifications (e.g. Cyber Essentials, Cyber Essentials Plus, ISO 27001). Holding a certification indicates that the supplier has a proactive approach to cyber security.
If suppliers do not hold any certifications you will need to invest time to understand more about their security posture. From an IT infrastructure perspective, you may wish to use the Cyber Essentials themes as discussion points:
- Firewalls
- Secure Configuration
- User Access Control
- Malware Protection
- Patch Management
For providers of online services, you may wish to focus your discussion on the common web application security issues. The Open Web Application Security Project (OWASP) Top 10 is a good starting point.
There are other sources of useful information relating to systems supplied by third parties:
- Specifically for Video Surveillance Systems (CCTV systems), the Surveillance Camera Commissioner operates the Secure by Default self-certification scheme.
- For more complex physical security systems, CPNI has developed the CAPSS (Cyber Assurance of Physical Security Systems)
- The NCSC Mobile Device Guidance offers advice on the purchase and use of different operating systems, biometrics and advice to the end user.
If any of your suppliers are unable to meet your security expectations, you should update your Risk Register and consider mitigations. The NCSC Supply Chain Security collection offers detailed advice on how to manage supply chain risk.
4. Use NCSC guidance
Beyond the advice signposted above, the NCSC website has a collection of guidance suitable for organisations of all sizes. Included within this guidance is a Board Toolkit, which provides resources designed to encourage essential cyber security discussions between the Board and their technical experts.