Early Years practitioners: using cyber security to protect your settings
How to protect sensitive information about your setting and the children in your care from accidental damage and online criminals.
Products on your perimeter considered harmful (until proven otherwise)
As attackers’ tactics change, so must network defenders’.
New online training helps board members to govern cyber risk
The NCSC’s CEO, Richard Horne on the new cyber governance resources giving Boards the tools they need to govern cyber security risks.
Setting direction for the UK’s migration to post-quantum cryptography
Why the key milestones for PQC migration are part of building and maintaining good cyber security practice.
Navigating the different cyber services from the NCSC
If you don’t have the inhouse expertise to keep your organisation cyber secure, the NCSC offers services and tools to help organisations guard against commodity threats.
RITICS: Securing cyber-physical systems
Discover the Research Institute in Trustworthy Inter-connected Cyber-physical Systems.
NCSC’s Cyber Advisor scheme milestone
Cyber Advisor scheme for small organisations welcomes its 100th advisor, but more still needed!
EASM buyer’s guide now available
How to choose an external attack surface management (EASM) tool that’s right for your organisation.
External attack surface management (EASM) buyer’s guide
A guide to choosing the right EASM product for your organisation, and the security features you need to consider.
Buying, selling and donating second-hand devices
How to erase the personal data from your phone, tablets, and other devices (and why it’s important when you’re buying and selling them).
Cyber resilience matters as much as cyber defence
Why planning and rehearsing your recovery from an incident is as vital as building your defences
“If you have knowledge, let others light their candles in it.”
Why sharing lessons learned from cyber security incidents and ‘near misses’ will help everyone to improve
The future of telecoms in the UK
NCSC Technical Director Dr Ian Levy explains how the security analysis behind the DCMS supply chain review will ensure the UK’s telecoms networks are secure – regardless of the vendors used.
Protecting internet-facing services on public service CNI
How operators of critical national infrastructure (CNI) can use NCSC guidance and blogs to secure their internet-facing services.
ACD 2.0: Insights from the external attack surface management trials
We publish the results of our ACD 2.0 external attack surface management (EASM) trials
Cyber Essentials Plus is for charities too!
Sara Ward, the CEO of Black Country Women’s Aid, discusses her organisation’s experience of gaining Cyber Essentials Plus certification.
From bugs to bypasses: adapting vulnerability disclosure for AI safeguards
Exploring how far cyber security approaches can help mitigate risks in generative AI systems
Social Media: how to use it safely
Use privacy settings across social media platforms to manage your digital footprint.
So long and thanks for all the bits
Ian Levy, the NCSC’s departing Technical Director, discusses life, the universe, and everything.
TLS 1.3: better for individuals – harder for enterprises
The NCSC’s technical director outlines the challenges that TLS 1.3 presents for enterprise security.
NCSC IT: There’s confidence and then there’s SaaS
Raising a cheer for SaaS vendors who respond to our cloud security principles.
Pathways: exploring a new way to achieve Cyber Essentials certification
For large, complex firms struggling with the prescriptiveness of Cyber Essentials, ‘Pathways’ will provide a new route to certification.
New techniques added to the NCSC’s ‘risk management toolbox’
Refreshed guidance published to help practitioners manage cyber risk.
“If you have knowledge, let others light their candles in it.”
Why sharing lessons learned from cyber security incidents and ‘near misses’ will help everyone to improve
Why more transparency around cyber attacks is a good thing for everyone
Eleanor Fairford, Deputy Director of Incident Management at the NCSC, and Mihaela Jembei, Director of Regulatory Cyber at the Information Commissioner’s Office (ICO), reflect on why it’s so concerning when cyber attacks go unreported – and look at some of the misconceptions about how organisations respond to them.
Cyber security for high profile conferences
Managing the cyber security of high profile events in the real and virtual worlds.
Actions to take when the cyber threat is heightened
When organisations might face a greater threat, and the steps to take to improve security.
Cyber Assessment Framework v4.0 released in response to growing threat
Updates to the CAF helps providers of essential services to better manage their cyber risks.
Cyber Assessment Framework v4.0 released in response to growing threat
Updates to the CAF helps providers of essential services to better manage their cyber risks.
The problems with patching
Applying patches may be a basic security principle, but that doesn’t mean it’s always easy to do in practice.
The security benefits of modern collaboration in the cloud
By exploiting cloud services, organisations no longer have to choose between ‘more security’ and ‘better usability’.
The problems with forcing regular password expiry
Why the NCSC decided to advise against this long-established security guideline.
Smart devices: using them safely in your home
Many everyday items are now connected to the internet: we explain how to use them safely.
The cyber threat to Universities
Assessing the cyber security threat to UK Universities
Securing your devices
How to ensure your devices are as secure as possible.
What is an antivirus product? Do I need one?
Detect and prevent malicious software and viruses on your computer or laptop.
Active Cyber Defence (ACD) – the fourth year
The year four report covers 2020 and aims to highlight the achievements and efforts made by the Active Cyber Defence programme.
Active Cyber Defence (ACD) – The Third Year
The year three report covers 2019 and aims to highlight the achievements and efforts made by the Active Cyber Defence programe.
The logic behind three random words
Whilst not a password panacea, using ‘three random words’ is still better than enforcing arbitrary complexity requirements.
The future of Technology Assurance in the UK
Chris Ensor highlights some important elements of the NCSC’s new Technology Assurance strategy.
The Cyber Assessment Framework 3.1
Latest version of the CAF focusses on clarification and consistency between areas of the CAF.
Cyber Essentials: are there any alternative standards?
Can an equivalent cyber security standard deliver the same outcomes as the NCSC’s Cyber Essentials scheme?
Configuring Microsoft Outlook 365’s ‘Report Phishing’ add-in
How to report emails to the NCSC’s Suspicious Email Reporting Service (SERS) using the ‘Report Phishing’ add-in for Microsoft Outlook 365.
How the NCSC thinks about security architecture
Richard C explains how an understanding of vulnerabilities – and their exploitation – informs how the NCSC assesses the security of computer systems.
The future of Technology Assurance in the UK
Chris Ensor highlights some important elements of the NCSC’s new Technology Assurance strategy.
The Cyber Assessment Framework 3.1
Latest version of the CAF focusses on clarification and consistency between areas of the CAF.
Reducing data exfiltration by malicious insiders
Advice and recommendations for mitigating this type of insider behaviour.
What is an antivirus product? Do I need one?
Detect and prevent malicious software and viruses on your computer or laptop.
Summary of the NCSC analysis of May 2020 US sanction
A summary of the NCSC’s analysis of the May 2020 US sanction which caused the NCSC to modify the scope of its security mitigation strategy for Huawei.
‘NCSC Cyber Series’ podcast now available
Listen to all five episodes now, covering a wide range of cyber security topics.
Getting your organisation ready for Windows 11 upgrade before Autumn 2025
Why you should act now to ensure you meet the new hardware standards, and prioritise security.
The Cyber Assessment Framework 3.1
Latest version of the CAF focusses on clarification and consistency between areas of the CAF.
Thanking the vulnerability research community with NCSC Challenge Coins
Reflecting on the positive impact of the Vulnerability Reporting Service – and introducing something new for selected contributors.
Motivating developers to write secure code
The ‘Motivating Jenny’ project is helping to change the conversation about security in software development.
NCSC For Startups diaries: PORGiESOFT
We caught up with George Brown, founder of PORGiESOFT, about his first few weeks in NCSC For Startups…
Smart devices: new law helps citizens to choose secure products
Download the NCSC’s point-of-sale leaflet explaining how new PSTI regulation affects consumers and retailers.
Trusting the tech: using password managers and passkeys to help you stay secure online
How today’s secure tools simplify your digital life, and reduce login stress and password fatigue
Have you got what it takes to be a ‘Cyber Advisor’?
We need more cyber professionals to join our scheme providing hands-on advice to SMEs.
Mitigating malware and ransomware attacks
How to defend organisations against malware or ransomware attacks.
The future of telecoms in the UK
NCSC Technical Director Dr Ian Levy explains how the security analysis behind the DCMS supply chain review will ensure the UK’s telecoms networks are secure – regardless of the vendors used.
The strength of the ICS COI is the team
Join the Industrial Control System Community of Interest (ICS COI), and help build CNI expertise across the UK.
Tackling the ‘human factor’ to transform cyber security behaviours
ThinkCyber’s CEO Tim Ward reflects on the challenges that startups face when developing innovative products.
How Rebellion Defence used NCSC For Startups to accelerate product development
Unparalleled access to skilled users transformed Rebellion Defence’s product roadmap.
The rise of ransomware
Toby L, Technical Lead for Incident Management, explains how modern-day ransomware attacks are evolving.
‘PDNS for Schools’ to provide cyber resilience for more institutions
The NCSC’s ‘Protective Domain Name Service for Schools’ scaled-up to protect a wider range of organisations.
The strength of the ICS COI is the team
Join the Industrial Control System Community of Interest (ICS COI), and help build CNI expertise across the UK.
The security benefits of modern collaboration in the cloud
By exploiting cloud services, organisations no longer have to choose between ‘more security’ and ‘better usability’.
Studies in secure system design
Worked examples for Operational Technology and Virtualised systems, using the NCSC’s secure design principles
Authentication methods: choosing the right type
Recommended authentication models for organisations looking to move ‘beyond passwords’.
Telling users to ‘avoid clicking bad links’ still isn’t working
Why organisations should avoid ‘blame and fear’, and instead use technical measures to manage the threat from phishing.
Tackling the ‘human factor’ to transform cyber security behaviours
ThinkCyber’s CEO Tim Ward reflects on the challenges that startups face when developing innovative products.
Supplier assurance: having confidence in your suppliers
Questions to ask your suppliers that will help you gain confidence in their cyber security.
NCSC For Startups diaries: PORGiESOFT
We caught up with George Brown, founder of PORGiESOFT, about his first few weeks in NCSC For Startups…
Introducing the guidelines for secure AI
New guidelines will help developers make informed decisions about the design, development, deployment and operation of their AI systems.
NCSC For Startups: the feedback loop
How startups can make the most of their time when pitching to cyber security experts.
Products on your perimeter considered harmful (until proven otherwise)
As attackers’ tactics change, so must network defenders’.
Sausages and incentives: rewarding a resilient technology future
Why ‘thinking big’ is required to shift the dynamics of the technology market.
Creating the right organisational culture for cyber security
Calling cyber security professionals, culture specialists and leaders to drive uptake of new Cyber security culture principles.
New ETSI standard protects AI systems from evolving cyber threats
The NCSC and DSIT work with ETSI to ‘set a benchmark for securing AI’.
Facing the cyber threat behind the headlines
NCSC CEO urges all businesses to face the stark reality of the cyber threat they face, whether in the spotlight or not.
Decommissioning assets
How to retire digital assets (such as data, software, or hardware) from operation.
Data breaches: guidance for individuals and families
How to protect yourself from the impact of data breaches
SBOMs and the importance of inventory
Can a Software Bill of Materials (SBOM) provide organisations with better insight into their supply chains?
RITICS: Securing cyber-physical systems
Discover the Research Institute in Trustworthy Inter-connected Cyber-physical Systems.
Revolutionising identity services using AI
The ‘NCSC for Startups’ alumnus giving identity verification the ‘Trust Stamp’
Announcing IASME as our second Delivery Partner for Cyber Incident Response Level 2
Both CIR Delivery Partners are now accepting enquiries and applications.
Moving to a cloud, not a storm
Avoiding common problems when moving to the cloud.
Helping banish malicious adverts – and drive a secure advertising ecosystem
If your brand uses digital advertising, the NCSC has new guidance to help you choose a security-minded partner.
Ransomware: ‘WannaCry’ guidance for home users and small businesses
Guidance for home users or small businesses who want to reduce the likelihood of being held to ransom by WannaCry (or other types of ransomware).
Ransomware: ‘WannaCry’ guidance for enterprise administrators
Guidance for enterprise administrators who want to reduce the likelihood of being held to ransom by WannaCry (or other types of ransomware).
Cyber security for major events
Assessing the cyber security needs of major events.
Impact of AI on cyber threat from now to 2027
An NCSC assessment highlighting the impacts on cyber threat from AI developments between now and 2027.
Software Code of Practice: building a secure digital future
New voluntary code of practice for technology providers defines a market baseline for cyber security.
Software Security Code of Practice – Assurance Principles and Claims (APCs)
Helps vendors measure how well they meet the Software Security Code of Practice, and suggests remedial actions should they fall short.
CyberFirst Girls Competition: a proud milestone and exciting future
The future of the CyberFirst Girls Competition and reflecting on brilliant progress.
The problems with forcing regular password expiry
Why the NCSC decided to advise against this long-established security guideline.
QR Codes – what’s the real risk?
How safe is it to scan that QR code in the pub? Or in that email?
Eradicating trivial vulnerabilities, at scale
A new NCSC research paper aims to reduce the presence of ‘unforgivable’ vulnerabilities.
‘PDNS for Schools’ to provide cyber resilience for more institutions
The NCSC’s ‘Protective Domain Name Service for Schools’ scaled-up to protect a wider range of organisations.
Incidents impacting retailers – recommendations from the NCSC
A joint blog post by the NCSC’s National Resilience Director, Jonathon Ellison, and Chief Technology Officer, Ollie Whitehouse.
Our Collaborations With