NCSC challenges business leaders to learn the 'basics' of cyber security

GCHQ's cyber arm offers cyber security guidance to help business leaders curtail 'fear of feeling foolish’

The National Cyber Security Centre (NCSC) will launch fresh guidance for organisations as its CEO warned business leaders must embrace the technical detail of cyber security, or face a greater risk of attack.

Board-level members especially are duty-bound to ask questions, and engage with the technicalities of security, NCSC's Ciaran Martin warned, speaking at the Confederation of British Industry's (CBI's) fourth annual Cyber Security Conference.

The toolkit, which the GCHQ satellite organisation will roll out later this month, will provide guidance as to how business leaders can get to grips with a "mainstream business risk".

"People at board level need to understand the basics - and I stress, basics - of cyber attacks, cyber risks and cyber defences," Martin said in his keynote address.

"That's daunting, but it is doable. It's essential. And today is a significant moment in our efforts to equip the UK's major companies to do it."

Martin also trailed the toolkit with five key questions business leaders can ask their CIOs to ascertain a basic understanding of an organisation's security needs, saying "nodding to avoid feeling foolish can sometimes be the most foolish thing to do". 

These questions involved phishing attacks, privileges for IT systems, software patching, assessing cyber risk in the supply chain, and the authentication methods employed across the company.

"No-one in government is asking you to make cyber security your top priority. Your core business is your top priority," he continued.

"We do expect you, however, to be good enough at cyber security to take care of the things you care about. And that means you have to understand what they are, and what you can do to protect yourselves. This means you need to be - at least a little bit - cyber literate."

Underlining boardroom-level ignorance, and a lack of expertise across organisations of all sizes, are several common misconceptions, he added.

These include the notion that security is too complex, that it is too sophisticated and therefore impossible to stop, and that attacks are only targeted thus being low risk.

"Cyber security is no longer just the domain of the IT department," said TechUK president Jacqueline de Rojas.

"It can't be delegated. Those around the board table must understand the constant and persistent cyber threat to their businesses and to educate themselves of the steps they need to take to ensure that they are cyber-resilient.

"That is why the NCSC toolkit, specifically aimed at board members, is an important development.

"It will help demystify concerns around cyber security, enabling senior executives to discuss their cyber risk appetite in a confident and proactive manner."

Business leaders attending the CBI's annual event, hosted in Canary Wharf, London, also heard a keynote from the deputy commissioner for operations at the Information Commissioner's Office (ICO), James Dipple-Johnstone.

Both Dipple-Johnstone and Martin's addresses were followed with several panel discussions centred on cyber security trends.

ComXo's managing director Andrew Try lamented boardroom complacency while discussing key threats and lessons for cyber security in 2019, on a panel also comprising representatives from BAE, BT, AIB and UCL.

"There's a woeful lack, at board, an appetite to fire drill practice complete outages, complete loss of data; really worst case scenarios," Try said.

"We just put a tick in the box and say it's mitigated. But you're never actually going to your organisation - pulling the plugs out - and saying 'right it's gone dark - what are you going to do about it?'

"Because of that you're not going to be ready if you do get hit by a Petya type attack or a ransomware attack. It completely disables you - not just a loss of data, but a loss of everything.

"And I think boards need to raise their awareness these can come from anytime, from anywhere. You cannot protect against them, but you can prepare what you're going to do if that were to happen."

The ICO's James Dipple-Johnstone, meanwhile, dedicated his speech to reassuring businesses his organisation will not be handing out massive fines if reasonable measures are taken - and that the principles outlined in the General Data Protection Regulation (GDPR) - are followed.

Featured Resources

The definitive guide to warehouse efficiency

Get your free guide to creating efficiencies in the warehouse

Free download

The total economic impact™ of Datto

Cost savings and business benefits of using Datto Integrated Solutions

Download now

Three-step guide to modern customer experience

Support the critical role CX plays in your business

Free download

Ransomware report

The global state of the channel

Download now

Recommended

Senate report slams agencies for poor cyber security
cyber security

Senate report slams agencies for poor cyber security

3 Aug 2021
Most employees put their workplace at risk by taking cyber security shortcuts
cyber security

Most employees put their workplace at risk by taking cyber security shortcuts

27 Jul 2021
61% of organizations say improving security a top priority for 2021
cyber security

61% of organizations say improving security a top priority for 2021

29 Jun 2021
ProtectedBy.AI’s CodeLock blocks malware at source code level
software as a service (SaaS)

ProtectedBy.AI’s CodeLock blocks malware at source code level

9 Jun 2021

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

17 Sep 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

17 Sep 2021