NCSC challenges business leaders to learn the 'basics' of cyber security

GCHQ's cyber arm offers cyber security guidance to help business leaders curtail 'fear of feeling foolish’

The National Cyber Security Centre (NCSC) will launch fresh guidance for organisations as its CEO warned business leaders must embrace the technical detail of cyber security, or face a greater risk of attack.

Board-level members especially are duty-bound to ask questions, and engage with the technicalities of security, NCSC's Ciaran Martin warned, speaking at the Confederation of British Industry's (CBI's) fourth annual Cyber Security Conference.

The toolkit, which the GCHQ satellite organisation will roll out later this month, will provide guidance as to how business leaders can get to grips with a "mainstream business risk".

"People at board level need to understand the basics - and I stress, basics - of cyber attacks, cyber risks and cyber defences," Martin said in his keynote address.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"That's daunting, but it is doable. It's essential. And today is a significant moment in our efforts to equip the UK's major companies to do it."

Martin also trailed the toolkit with five key questions business leaders can ask their CIOs to ascertain a basic understanding of an organisation's security needs, saying "nodding to avoid feeling foolish can sometimes be the most foolish thing to do". 

These questions involved phishing attacks, privileges for IT systems, software patching, assessing cyber risk in the supply chain, and the authentication methods employed across the company.

"No-one in government is asking you to make cyber security your top priority. Your core business is your top priority," he continued.

"We do expect you, however, to be good enough at cyber security to take care of the things you care about. And that means you have to understand what they are, and what you can do to protect yourselves. This means you need to be - at least a little bit - cyber literate."

Underlining boardroom-level ignorance, and a lack of expertise across organisations of all sizes, are several common misconceptions, he added.

Advertisement - Article continues below

These include the notion that security is too complex, that it is too sophisticated and therefore impossible to stop, and that attacks are only targeted thus being low risk.

"Cyber security is no longer just the domain of the IT department," said TechUK president Jacqueline de Rojas.

"It can't be delegated. Those around the board table must understand the constant and persistent cyber threat to their businesses and to educate themselves of the steps they need to take to ensure that they are cyber-resilient.

"That is why the NCSC toolkit, specifically aimed at board members, is an important development.

Advertisement
Advertisement - Article continues below

"It will help demystify concerns around cyber security, enabling senior executives to discuss their cyber risk appetite in a confident and proactive manner."

Business leaders attending the CBI's annual event, hosted in Canary Wharf, London, also heard a keynote from the deputy commissioner for operations at the Information Commissioner's Office (ICO), James Dipple-Johnstone.

Advertisement - Article continues below

Both Dipple-Johnstone and Martin's addresses were followed with several panel discussions centred on cyber security trends.

ComXo's managing director Andrew Try lamented boardroom complacency while discussing key threats and lessons for cyber security in 2019, on a panel also comprising representatives from BAE, BT, AIB and UCL.

"There's a woeful lack, at board, an appetite to fire drill practice complete outages, complete loss of data; really worst case scenarios," Try said.

"We just put a tick in the box and say it's mitigated. But you're never actually going to your organisation - pulling the plugs out - and saying 'right it's gone dark - what are you going to do about it?'

"Because of that you're not going to be ready if you do get hit by a Petya type attack or a ransomware attack. It completely disables you - not just a loss of data, but a loss of everything.

"And I think boards need to raise their awareness these can come from anytime, from anywhere. You cannot protect against them, but you can prepare what you're going to do if that were to happen."

Advertisement - Article continues below

The ICO's James Dipple-Johnstone, meanwhile, dedicated his speech to reassuring businesses his organisation will not be handing out massive fines if reasonable measures are taken - and that the principles outlined in the General Data Protection Regulation (GDPR) - are followed.

Featured Resources

Transform the operator experience with enhanced automation & analytics

Bring networking into the digital era

Download now

Artificially intelligent data centres

How the C-Suite is embracing continuous change to drive value

Download now

Deliver secure automated multicloud for containers with Red Hat and Juniper

Learn how to get started with the multicloud enabler from Red Hat and Juniper

Download now

Get the best out of your workforce

7 steps to unleashing their true potential with robotic process automation

Download now
Advertisement

Recommended

Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/security/vulnerability/354309/patch-issued-for-critical-windows-bug
vulnerability

Patch issued for critical Windows bug

11 Dec 2019
Visit/hardware/354193/buy-it-to-grow-not-slow-your-business
Sponsored

Buy IT to grow, not slow, your business

25 Nov 2019
Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/security/antivirus/354328/microsoft-to-scrap-security-essentials-when-windows-7-reaches-end-of-life
antivirus

Microsoft to scrap Security Essentials when Windows 7 reaches end-of-life

13 Dec 2019