A Decade of the NCSC: Looking Back, Looking Ahead

If you rewind to 2015 and the start of 2016, the world of cybersecurity was focused on major data breaches in the retail and healthcare sectors, while ransomware was also attracting considerable attention.

The question was what kind of response nations could provide to these threats. Were attackers outwitting those tasked with defending industry and society? Steps were being taken, including the launch of CERT-UK in 2014, which was intended to “take the lead in coordinating the management of national cybersecurity incidents and will act as the UK central contact point for international counterparts in this field”.

Francis Maude, then Cabinet Office minister responsible for cybersecurity, said the government's most important task was to protect national security and ensure Britain was a safe place to work, live and do business.

“CERT-UK shows we want closer coordination between government, business and academia to share insight and advice, as well as better cooperation with our international partners.”

As a member of the press covering cybersecurity at the time, getting a government perspective on the subject was a challenge. Neither Francis Maude nor the late James Brokenshire was particularly easy to reach, and I often ended up calling the Cabinet Office and Home Office press teams for comment on specific issues.

The introduction of CERT-UK changed that. Suddenly, there was a new source of information on UK cybersecurity, offering the practical business advice we had been seeking.

Some two years later, CERT-UK became part of the National Cyber Security Centre (NCSC), which was established in October 2016. Bringing together several existing government cybersecurity functions, including those of CERT-UK and the information security arm of GCHQ, CESG, the NCSC created a central point of contact for UK cybersecurity.

The centre also brought together expertise from across government to provide guidance such as the 10 Steps to Cyber Security and the Cyber Assessment Framework, both of which offer practical direction to organisations.

On top of that, the NCSC provides cyber incident reporting services, guidance in response to major incidents and the CyberUK conference series. It is fair to say that the NCSC has made a significant impact on the UK's cyber posture.

Lisa Ventura MBE, chief executive and founder of the AI and Cyber Security Association, said that when she started out, nobody knew who to call when a cyber-attack hit.

“The NCSC changed that, and I'm grateful for everything the team has built over 10 years.

“The NCSC started speaking to people in plain English and in ways that everyone could understand. Guidance like the ‘10 Steps to Cyber Security’ and the ‘Small Business Guide’ is written for real people, not security specialists. When the NCSC told organisations to stop forcing regular password changes, I cheered. A government body admitting that old advice no longer worked was a brilliant step forward.”

The guidance provided by the NCSC has been invaluable. Before its formation, organisations seeking advice had to turn to international CERTs, vendors - where advice could come with an element of promotion - or the press and analysts. Social media also offered a new way to access advice, but this UK-specific centre provided straightforward, relevant guidance that the industry needed.

Ventura said the shift she valued most as a security awareness practitioner was the NCSC's move away from blaming people for incidents. Its work on the human side of security showed how people could become part of the defence when systems and training were designed around how they actually work.

“That approach has shaped how I run awareness programmes, and I see the difference in how people respond when you treat them with kindness and respect and when you adopt a no-blame culture if something goes wrong in your organisation.”

She also praised the Suspicious Email Reporting Service, Exercise in a Box and Early Warning, which have given smaller organisations access to support they might otherwise have struggled to afford.

Now that the NCSC is ten years old, what role does it play today? It continues to provide essential services and guidance, but where does it go next?

Ventura said: “The next chapter needs to be about reaching sole traders, small businesses and the people who need help the most, and reaching them before a cyber-attack happens rather than after one.”

These are ambitious aims, but achievable ones, and I suspect they are already on the NCSC's radar. The next ten years will be interesting to follow.

NCSC was invited to comment for this article, but no response was received at the time of publication.