Updating our guidance on security certificates, TLS and IPsec
The NCSC has updated 3 key pieces of cryptographic guidance. Here, we explain the changes.
Using IPsec to protect data
Guidance for organisations wishing to deploy products that use IPsec.
Provisioning and managing certificates in the Web PKI
How service owners should securely provision and manage certificates in the Web PKI.
Using TLS to protect data
Recommended profiles to securely configure TLS for the most common versions and scenarios, with additional guidance for managing older versions.
Pattern: Safely Importing Data
An architecture pattern for safely importing data into a system from an external source.
Technical report: Responsible use of the Border Gateway Protocol (BGP) for ISP interworking
Technical report on best practice use of this fundamental data routing protocol.
What makes a responsible cyber actor: introducing the Pall Mall industry consultation on good practice
Calling vulnerability researchers, exploit developers and others in the offensive cyber industry to share their views.
Zero trust 1.0
Zero trust architecture design principles 1.0 launched.
Sextortion emails: how to protect yourself
Advice in response to the increase in sextortion scams
Shopping and paying safely online
Tips to help you purchase items safely and avoid fraudulent websites.
How to recover an infected device
Advice for those concerned a device has been infected.
Recovering a hacked account
A step by step guide to recovering online accounts.
Data breaches: guidance for individuals and families
How to protect yourself from the impact of data breaches
How to spot scammers claiming to be from the NCSC
Check that you’re talking to a genuine NCSC employee, and not a criminal.
A method to assess ‘forgivable’ vs ‘unforgivable’ vulnerabilities
Research from the NCSC designed to eradicate vulnerability classes and make the top-level mitigations easier to implement.
Prompt injection is not SQL injection (it may be worse)
There are crucial differences between prompt and SQL injection which – if not considered – can undermine mitigations.
Building trust in the digital age: a collaborative approach to content provenance technologies
Joint NCSC and Canadian Centre for Cyber Security primer helps organisations understand emerging technologies that can help maintain trust in their public-facing information.
What makes a responsible cyber actor: introducing the Pall Mall industry consultation on good practice
Calling vulnerability researchers, exploit developers and others in the offensive cyber industry to share their views.
It’s time for all small businesses to act
The NCSC’s Cyber Action Toolkit helps you to protect your business from online attacks.
NCSC handing over the baton of smart meter security: a decade of progress
Why transferring the Commercial Product Assurance scheme to industry ownership marks an important milestone.
Choosing a managed service provider (MSP)
An SME’s guide to selecting and working with managed service providers.
Advanced Mobile Solutions (AMS) guidance trailer
Chris P explains how AMS will enable high-threat organisations to stay connected ‘on the go’.
Vulnerability Scanning: Keeping on top of the most common threats
Vulnerability Scanning solutions offer a cost-effective way to discover and manage common security issues.
Cyber Security and Resilience Policy Statement to strengthen regulation of critical sectors
New proposals will combat the growing threat to UK critical national infrastructure (CNI).
NCSC to retire Web Check and Mail Check
By 31 March 2026, organisations should have alternatives to Mail Check and Web Check in place.
Strengthening national cyber resilience through observability and threat hunting
How organisations can improve their ability to both detect and discover cyber threats.
Creating the right organisational culture for cyber security
Calling cyber security professionals, culture specialists and leaders to drive uptake of new Cyber security culture principles.
Software Code of Practice: building a secure digital future
New voluntary code of practice for technology providers defines a market baseline for cyber security.
Advanced Cryptography: new approaches to data privacy
A new NCSC paper discusses the suitability of emerging Advanced Cryptography techniques.
Cyber Resilience Audit scheme open to applications
A new NCSC scheme assuring providers of CAF-based audits is now open for potential members.
Watch all the plenaries from CYBERUK 2024 live, and for free
Key talks from the UK government’s flagship cyber security event will be livestreamed from Birmingham’s ICC.
Interactive administration in the cloud: managing the risks
Tips to help you secure and reduce interactive access to your cloud infrastructure.
Cyber security is business survival
The NCSC co-signs Ministerial letter to major British businesses including FTSE 350 companies.
There’s a hole in my bucket
…or ‘Why do people leave sensitive data in unprotected AWS S3 buckets?’
Moving your business from the physical to the digital
Security questions to ask your IT service providers when considering a digital transition
Strengthening national cyber resilience through observability and threat hunting
How organisations can improve their ability to both detect and discover cyber threats.
Phishing attacks: defending your organisation
How to defend your organisation from email phishing attacks.
Maintaining a sustainable strengthened cyber security posture
How organisations can avoid staff burnout during an extended period of heightened cyber threat.
RFC 9794: a new standard for post-quantum terminology
The NCSC’s contribution to the Internet Engineering Task Force will help to make the internet more secure.
Putting staff welfare at the heart of incident response
Guidance for staff responsible for managing a cyber incident response within their organisation.
Understanding your OT environment: the first step to stronger cyber security
If you can’t see your entire operational technology environment, you can’t defend it. New guidance from the NCSC will help you gain that visibility.
Early Years practitioners: using cyber security to protect your settings
How to protect sensitive information about your setting and the children in your care from accidental damage and online criminals.
Products on your perimeter considered harmful (until proven otherwise)
As attackers’ tactics change, so must network defenders’.
New online training helps board members to govern cyber risk
The NCSC’s CEO, Richard Horne on the new cyber governance resources giving Boards the tools they need to govern cyber security risks.
Setting direction for the UK’s migration to post-quantum cryptography
Why the key milestones for PQC migration are part of building and maintaining good cyber security practice.
Navigating the different cyber services from the NCSC
If you don’t have the inhouse expertise to keep your organisation cyber secure, the NCSC offers services and tools to help organisations guard against commodity threats.
RITICS: Securing cyber-physical systems
Discover the Research Institute in Trustworthy Inter-connected Cyber-physical Systems.
NCSC’s Cyber Advisor scheme milestone
Cyber Advisor scheme for small organisations welcomes its 100th advisor, but more still needed!
EASM buyer’s guide now available
How to choose an external attack surface management (EASM) tool that’s right for your organisation.
External attack surface management (EASM) buyer’s guide
A guide to choosing the right EASM product for your organisation, and the security features you need to consider.
Buying, selling and donating second-hand devices
How to erase the personal data from your phone, tablets, and other devices (and why it’s important when you’re buying and selling them).
Cyber resilience matters as much as cyber defence
Why planning and rehearsing your recovery from an incident is as vital as building your defences
“If you have knowledge, let others light their candles in it.”
Why sharing lessons learned from cyber security incidents and ‘near misses’ will help everyone to improve
The future of telecoms in the UK
NCSC Technical Director Dr Ian Levy explains how the security analysis behind the DCMS supply chain review will ensure the UK’s telecoms networks are secure – regardless of the vendors used.
Protecting internet-facing services on public service CNI
How operators of critical national infrastructure (CNI) can use NCSC guidance and blogs to secure their internet-facing services.
ACD 2.0: Insights from the external attack surface management trials
We publish the results of our ACD 2.0 external attack surface management (EASM) trials
Cyber Essentials Plus is for charities too!
Sara Ward, the CEO of Black Country Women’s Aid, discusses her organisation’s experience of gaining Cyber Essentials Plus certification.
From bugs to bypasses: adapting vulnerability disclosure for AI safeguards
Exploring how far cyber security approaches can help mitigate risks in generative AI systems
Social Media: how to use it safely
Use privacy settings across social media platforms to manage your digital footprint.
So long and thanks for all the bits
Ian Levy, the NCSC’s departing Technical Director, discusses life, the universe, and everything.
TLS 1.3: better for individuals – harder for enterprises
The NCSC’s technical director outlines the challenges that TLS 1.3 presents for enterprise security.
NCSC IT: There’s confidence and then there’s SaaS
Raising a cheer for SaaS vendors who respond to our cloud security principles.
Pathways: exploring a new way to achieve Cyber Essentials certification
For large, complex firms struggling with the prescriptiveness of Cyber Essentials, ‘Pathways’ will provide a new route to certification.
New techniques added to the NCSC’s ‘risk management toolbox’
Refreshed guidance published to help practitioners manage cyber risk.
“If you have knowledge, let others light their candles in it.”
Why sharing lessons learned from cyber security incidents and ‘near misses’ will help everyone to improve
Why more transparency around cyber attacks is a good thing for everyone
Eleanor Fairford, Deputy Director of Incident Management at the NCSC, and Mihaela Jembei, Director of Regulatory Cyber at the Information Commissioner’s Office (ICO), reflect on why it’s so concerning when cyber attacks go unreported – and look at some of the misconceptions about how organisations respond to them.
Cyber security for high profile conferences
Managing the cyber security of high profile events in the real and virtual worlds.
Actions to take when the cyber threat is heightened
When organisations might face a greater threat, and the steps to take to improve security.
Cyber Assessment Framework v4.0 released in response to growing threat
Updates to the CAF helps providers of essential services to better manage their cyber risks.
Cyber Assessment Framework v4.0 released in response to growing threat
Updates to the CAF helps providers of essential services to better manage their cyber risks.
The problems with patching
Applying patches may be a basic security principle, but that doesn’t mean it’s always easy to do in practice.
The security benefits of modern collaboration in the cloud
By exploiting cloud services, organisations no longer have to choose between ‘more security’ and ‘better usability’.
The problems with forcing regular password expiry
Why the NCSC decided to advise against this long-established security guideline.
Smart devices: using them safely in your home
Many everyday items are now connected to the internet: we explain how to use them safely.
The cyber threat to Universities
Assessing the cyber security threat to UK Universities
Securing your devices
How to ensure your devices are as secure as possible.
What is an antivirus product? Do I need one?
Detect and prevent malicious software and viruses on your computer or laptop.
Active Cyber Defence (ACD) – the fourth year
The year four report covers 2020 and aims to highlight the achievements and efforts made by the Active Cyber Defence programme.
Active Cyber Defence (ACD) – The Third Year
The year three report covers 2019 and aims to highlight the achievements and efforts made by the Active Cyber Defence programe.
The logic behind three random words
Whilst not a password panacea, using ‘three random words’ is still better than enforcing arbitrary complexity requirements.
The future of Technology Assurance in the UK
Chris Ensor highlights some important elements of the NCSC’s new Technology Assurance strategy.
The Cyber Assessment Framework 3.1
Latest version of the CAF focusses on clarification and consistency between areas of the CAF.
Cyber Essentials: are there any alternative standards?
Can an equivalent cyber security standard deliver the same outcomes as the NCSC’s Cyber Essentials scheme?
Configuring Microsoft Outlook 365’s ‘Report Phishing’ add-in
How to report emails to the NCSC’s Suspicious Email Reporting Service (SERS) using the ‘Report Phishing’ add-in for Microsoft Outlook 365.
How the NCSC thinks about security architecture
Richard C explains how an understanding of vulnerabilities – and their exploitation – informs how the NCSC assesses the security of computer systems.
The future of Technology Assurance in the UK
Chris Ensor highlights some important elements of the NCSC’s new Technology Assurance strategy.
The Cyber Assessment Framework 3.1
Latest version of the CAF focusses on clarification and consistency between areas of the CAF.
Reducing data exfiltration by malicious insiders
Advice and recommendations for mitigating this type of insider behaviour.
What is an antivirus product? Do I need one?
Detect and prevent malicious software and viruses on your computer or laptop.
Summary of the NCSC analysis of May 2020 US sanction
A summary of the NCSC’s analysis of the May 2020 US sanction which caused the NCSC to modify the scope of its security mitigation strategy for Huawei.
‘NCSC Cyber Series’ podcast now available
Listen to all five episodes now, covering a wide range of cyber security topics.
Getting your organisation ready for Windows 11 upgrade before Autumn 2025
Why you should act now to ensure you meet the new hardware standards, and prioritise security.
The Cyber Assessment Framework 3.1
Latest version of the CAF focusses on clarification and consistency between areas of the CAF.
Thanking the vulnerability research community with NCSC Challenge Coins
Reflecting on the positive impact of the Vulnerability Reporting Service – and introducing something new for selected contributors.
Motivating developers to write secure code
The ‘Motivating Jenny’ project is helping to change the conversation about security in software development.
NCSC For Startups diaries: PORGiESOFT
We caught up with George Brown, founder of PORGiESOFT, about his first few weeks in NCSC For Startups…
Smart devices: new law helps citizens to choose secure products
Download the NCSC’s point-of-sale leaflet explaining how new PSTI regulation affects consumers and retailers.
Trusting the tech: using password managers and passkeys to help you stay secure online
How today’s secure tools simplify your digital life, and reduce login stress and password fatigue
Have you got what it takes to be a ‘Cyber Advisor’?
We need more cyber professionals to join our scheme providing hands-on advice to SMEs.
Mitigating malware and ransomware attacks
How to defend organisations against malware or ransomware attacks.
Our Collaborations With