Trusting the tech: using password managers and passkeys to help you stay secure online
How today’s secure tools simplify your digital life, and reduce login stress and password fatigue
Have you got what it takes to be a ‘Cyber Advisor’?
We need more cyber professionals to join our scheme providing hands-on advice to SMEs.
Mitigating malware and ransomware attacks
How to defend organisations against malware or ransomware attacks.
The future of telecoms in the UK
NCSC Technical Director Dr Ian Levy explains how the security analysis behind the DCMS supply chain review will ensure the UK’s telecoms networks are secure – regardless of the vendors used.
The strength of the ICS COI is the team
Join the Industrial Control System Community of Interest (ICS COI), and help build CNI expertise across the UK.
Tackling the ‘human factor’ to transform cyber security behaviours
ThinkCyber’s CEO Tim Ward reflects on the challenges that startups face when developing innovative products.
How Rebellion Defence used NCSC For Startups to accelerate product development
Unparalleled access to skilled users transformed Rebellion Defence’s product roadmap.
The rise of ransomware
Toby L, Technical Lead for Incident Management, explains how modern-day ransomware attacks are evolving.
‘PDNS for Schools’ to provide cyber resilience for more institutions
The NCSC’s ‘Protective Domain Name Service for Schools’ scaled-up to protect a wider range of organisations.
The strength of the ICS COI is the team
Join the Industrial Control System Community of Interest (ICS COI), and help build CNI expertise across the UK.
The security benefits of modern collaboration in the cloud
By exploiting cloud services, organisations no longer have to choose between ‘more security’ and ‘better usability’.
Studies in secure system design
Worked examples for Operational Technology and Virtualised systems, using the NCSC’s secure design principles
Authentication methods: choosing the right type
Recommended authentication models for organisations looking to move ‘beyond passwords’.
Telling users to ‘avoid clicking bad links’ still isn’t working
Why organisations should avoid ‘blame and fear’, and instead use technical measures to manage the threat from phishing.
Tackling the ‘human factor’ to transform cyber security behaviours
ThinkCyber’s CEO Tim Ward reflects on the challenges that startups face when developing innovative products.
Supplier assurance: having confidence in your suppliers
Questions to ask your suppliers that will help you gain confidence in their cyber security.
NCSC For Startups diaries: PORGiESOFT
We caught up with George Brown, founder of PORGiESOFT, about his first few weeks in NCSC For Startups…
Introducing the guidelines for secure AI
New guidelines will help developers make informed decisions about the design, development, deployment and operation of their AI systems.
NCSC For Startups: the feedback loop
How startups can make the most of their time when pitching to cyber security experts.
Products on your perimeter considered harmful (until proven otherwise)
As attackers’ tactics change, so must network defenders’.
Sausages and incentives: rewarding a resilient technology future
Why ‘thinking big’ is required to shift the dynamics of the technology market.
Creating the right organisational culture for cyber security
Calling cyber security professionals, culture specialists and leaders to drive uptake of new Cyber security culture principles.
New ETSI standard protects AI systems from evolving cyber threats
The NCSC and DSIT work with ETSI to ‘set a benchmark for securing AI’.
Facing the cyber threat behind the headlines
NCSC CEO urges all businesses to face the stark reality of the cyber threat they face, whether in the spotlight or not.
Decommissioning assets
How to retire digital assets (such as data, software, or hardware) from operation.
Data breaches: guidance for individuals and families
How to protect yourself from the impact of data breaches
SBOMs and the importance of inventory
Can a Software Bill of Materials (SBOM) provide organisations with better insight into their supply chains?
RITICS: Securing cyber-physical systems
Discover the Research Institute in Trustworthy Inter-connected Cyber-physical Systems.
Revolutionising identity services using AI
The ‘NCSC for Startups’ alumnus giving identity verification the ‘Trust Stamp’
Announcing IASME as our second Delivery Partner for Cyber Incident Response Level 2
Both CIR Delivery Partners are now accepting enquiries and applications.
Moving to a cloud, not a storm
Avoiding common problems when moving to the cloud.
Helping banish malicious adverts – and drive a secure advertising ecosystem
If your brand uses digital advertising, the NCSC has new guidance to help you choose a security-minded partner.
Ransomware: ‘WannaCry’ guidance for home users and small businesses
Guidance for home users or small businesses who want to reduce the likelihood of being held to ransom by WannaCry (or other types of ransomware).
Ransomware: ‘WannaCry’ guidance for enterprise administrators
Guidance for enterprise administrators who want to reduce the likelihood of being held to ransom by WannaCry (or other types of ransomware).
Cyber security for major events
Assessing the cyber security needs of major events.
Impact of AI on cyber threat from now to 2027
An NCSC assessment highlighting the impacts on cyber threat from AI developments between now and 2027.
Software Code of Practice: building a secure digital future
New voluntary code of practice for technology providers defines a market baseline for cyber security.
Software Security Code of Practice – Assurance Principles and Claims (APCs)
Helps vendors measure how well they meet the Software Security Code of Practice, and suggests remedial actions should they fall short.
CyberFirst Girls Competition: a proud milestone and exciting future
The future of the CyberFirst Girls Competition and reflecting on brilliant progress.
The problems with forcing regular password expiry
Why the NCSC decided to advise against this long-established security guideline.
QR Codes – what’s the real risk?
How safe is it to scan that QR code in the pub? Or in that email?
Eradicating trivial vulnerabilities, at scale
A new NCSC research paper aims to reduce the presence of ‘unforgivable’ vulnerabilities.
‘PDNS for Schools’ to provide cyber resilience for more institutions
The NCSC’s ‘Protective Domain Name Service for Schools’ scaled-up to protect a wider range of organisations.
Incidents impacting retailers – recommendations from the NCSC
A joint blog post by the NCSC’s National Resilience Director, Jonathon Ellison, and Chief Technology Officer, Ollie Whitehouse.
Advanced Cryptography: new approaches to data privacy
A new NCSC paper discusses the suitability of emerging Advanced Cryptography techniques.
Timelines for migration to post-quantum cryptography
Activities which organisations must carry out to migrate safely to post-quantum cryptography in the coming years.
SCADA ‘in the cloud’: new guidance for OT organisations
If migrating SCADA solutions to the cloud, cyber security must be a key consideration for operational technology organisations.
Building Web Check using PaaS
How Platform as a Service (PaaS) can make good security easier to achieve.
New online training helps board members to govern cyber risk
The NCSC’s CEO, Richard Horne on the new cyber governance resources giving Boards the tools they need to govern cyber security risks.
New guidance on securing HTTP-based APIs
Why it’s essential to secure your APIs to build trust with your customers and partners.
Cyber Security and Resilience Policy Statement to strengthen regulation of critical sectors
New proposals will combat the growing threat to UK critical national infrastructure (CNI).
Protective DNS for the private sector
Advice on the selection and deployment of Protective Domain Name Systems (DNS).
Privileged access workstations: introducing our new set of principles
Principles-based guidance for organisations setting up a PAW solution.
CyberFirst Girls Competition: a proud milestone and exciting future
The future of the CyberFirst Girls Competition and reflecting on brilliant progress.
Passkeys: the promise of a simpler and safer alternative to passwords
The merits of choosing passkeys over passwords to help keep your online accounts more secure, and explaining how the technology promises to do this
A different future for telecoms in the UK
NCSC Technical Director Dr Ian Levy explains the technical impact of the recent US sanctions on the security of Huawei equipment in the UK.
Use of Russian technology products and services following the invasion of Ukraine
Cyber security – even in a time of global unrest – remains a balance of different risks. Ian Levy, the NCSC’s Technical Director, explains why.
TLS 1.3: better for individuals – harder for enterprises
The NCSC’s technical director outlines the challenges that TLS 1.3 presents for enterprise security.
Timelines for migration to post-quantum cryptography
Activities which organisations must carry out to migrate safely to post-quantum cryptography in the coming years.
Setting direction for the UK’s migration to post-quantum cryptography
Why the key milestones for PQC migration are part of building and maintaining good cyber security practice.
Thinking about the security of AI systems
Why established cyber security principles are still important when developing or implementing machine learning models.
There’s a hole in my bucket
…or ‘Why do people leave sensitive data in unprotected AWS S3 buckets?’
The problems with patching
Applying patches may be a basic security principle, but that doesn’t mean it’s always easy to do in practice.
The security benefits of modern collaboration in the cloud
By exploiting cloud services, organisations no longer have to choose between ‘more security’ and ‘better usability’.
The problems with forcing regular password expiry
Why the NCSC decided to advise against this long-established security guideline.
The logic behind three random words
Whilst not a password panacea, using ‘three random words’ is still better than enforcing arbitrary complexity requirements.
The future of telecoms in the UK
NCSC Technical Director Dr Ian Levy explains how the security analysis behind the DCMS supply chain review will ensure the UK’s telecoms networks are secure – regardless of the vendors used.
The future of Technology Assurance in the UK
Chris Ensor highlights some important elements of the NCSC’s new Technology Assurance strategy.
The Cyber Assessment Framework 3.1
Latest version of the CAF focusses on clarification and consistency between areas of the CAF.
Thanking the vulnerability research community with NCSC Challenge Coins
Reflecting on the positive impact of the Vulnerability Reporting Service – and introducing something new for selected contributors.
Terminology: it’s not black and white
The NCSC now uses ‘allow list’ and ‘deny list’ in place of ‘whitelist’ and ‘blacklist’. Emma W explains why…
Tackling the ‘human factor’ to transform cyber security behaviours
ThinkCyber’s CEO Tim Ward reflects on the challenges that startups face when developing innovative products.
Spotlight on shadow IT
New guidance to help organisations manage rogue devices and services within the enterprise.
Supplier assurance: having confidence in your suppliers
Questions to ask your suppliers that will help you gain confidence in their cyber security.
Studies in secure system design
Worked examples for Operational Technology and Virtualised systems, using the NCSC’s secure design principles
So long and thanks for all the bits
Ian Levy, the NCSC’s departing Technical Director, discusses life, the universe, and everything.
Security, complexity and Huawei; protecting the UK’s telecoms networks
With 5G set to transform mobile services, Ian Levy explains how the UK has approached telecoms security, and what that means for the future.
SCADA ‘in the cloud’: new guidance for OT organisations
If migrating SCADA solutions to the cloud, cyber security must be a key consideration for operational technology organisations.
SBOMs and the importance of inventory
Can a Software Bill of Materials (SBOM) provide organisations with better insight into their supply chains?
RITICS: Securing cyber-physical systems
Discover the Research Institute in Trustworthy Inter-connected Cyber-physical Systems.
Revolutionising identity services using AI
The ‘NCSC for Startups’ alumnus giving identity verification the ‘Trust Stamp’
Researching the hard problems in hardware security
Introducing the next chapter of the NCSC research problem book, which aims to inspire research on the biggest impact topics in hardware cyber security.
Relaunching the NCSC’s Cloud security guidance collection
Andrew A explains what’s new in a significant update to the NCSC’s flagship cloud guidance.
Raising the cyber resilience of software ‘at scale’
New ‘Code of Practice for Software Vendors’ will ensure that security is fundamental to developing and distributing products and services.
QR Codes – what’s the real risk?
How safe is it to scan that QR code in the pub? Or in that email?
Protecting how you administer cloud services
New advice on implementing high-risk and ‘break-glass’ accesses in cloud services.
Post-quantum cryptography: what comes next?
Jeremy B explains how the NCSC will help organisations plan their migration to PQC.
Pathways: exploring a new way to achieve Cyber Essentials certification
For large, complex firms struggling with the prescriptiveness of Cyber Essentials, ‘Pathways’ will provide a new route to certification.
Passkeys: they’re not perfect but they’re getting better
Passkeys are the future of authentication, offering enhanced security and convenience over passwords, but widespread adoption faces challenges that the NCSC is working to resolve.
Our new principles to help make cloud backups more resilient
Introducing a new set of NCSC principles to strengthen the resilience of organisations’ cloud backups from ransomware attackers.
Offline backups in an online world
How to protect your backups that are stored in the public cloud.
NCSC For Startups: Vistalworks cracking down on illicit trade
Vicky Brock of Vistalworks describes how the ‘NCSC For Startups’ programme has helped her organisation develop solutions to tackle illicit online trade.
NCSC For Startups: the feedback loop
How startups can make the most of their time when pitching to cyber security experts.
NCSC for Startups: the case for collaboration
Saj Huq of Plexal explains why collaboration with the NCSC brings opportunities to the cyber security sector.
NCSC For Startups: taking on malvertising
Can your startup help counter the rise of malicious advertising?
Mastering your supply chain
A new collection of resources from the NCSC can help take your supply chain knowledge to the next level
Market incentives in the pursuit of resilient software and hardware
A new paper from the ONCD explores how metrics can influence markets to improve the cyber security ecosystem.
Making the UK the safest place to live and do business online
The NCSC’s Chief Executive Ciaran Martin outlines why the UK needs a National Cyber Security Centre.
Looking back at the ballot – securing the general election
NCSC CEO Felicity Oswald shares reflections on keeping the 2024 General Election safe.
Log4j vulnerability: what should boards be asking?
Advice for board members of medium to large organisations that are at risk from the Apache Log4j vulnerability.
Our Collaborations With