Global pandemic fuels cyber threat workload for National Cyber Security Centre, shows Annual Review

From securing the Nightingale hospitals to tackling threats to vaccine research and production, a large part of the National Cyber Security Centre’s (NCSC) recent work has been related to the coronavirus pandemic, as Ron Alalouff discovered when reporting on its Annual Review.

Combatting online threats exploiting the COVID-19 pandemic, building resilience into NHS IT systems and protecting the setting up of a virtual parliament are just some of the projects the National Cyber Security Centre has been involved in, according to its latest annual review.

Much of the recent activity of NCSC – established in 2016 and a part of GCHQ – has been directly or indirectly concerned with the pandemic. This includes building NHS resilience, protecting vaccine and medicine research, supporting remote working, securing the NHS COVID-19 app and large-scale data, and helping essential service providers.

Throughout a year of change, where the NCSC welcomed new CEO, Lindy Cameron to replace the departing Ciaran Martin, the division deployed analysts to analyse NHS threat data and supported the health sector through cyber security incidents. As a result, more than one million NHS IP addresses were supported, over 160 high-risk and critical vulnerabilities were identified and shared and threat hunting was performed on 1.4 million endpoints.

In addition, the NCSC worked to protect vaccine and medicine research by supporting the government’s Vaccine Taskforce, which controls decision-making on research funding and purchasing through to manufacturing and distribution. In July, the NCSC revealed that Russian cyber actors were targeting organisations involved in the development of coronavirus vaccines.

With the ability to share Indicators of Compromise (pieces of data which identify potentially malicious activity on a system or network) in a matter of seconds, the NCSC exponentially increased the number of tips to the NHS, with 51,910 shared by the end of August.

Cyber threats to remote working

The Centre also helped businesses and individuals as they moved to remote working by providing advice on working securely from home, and providing guidance on how to spot and deal with suspicious emails, calls and texts. It helped the Government Security Group and the Government Digital Service to provide advice for civil servants on accessing official IT when working remotely.

The NCSC says it has disrupted thousands of attempts to trick people, from fake lures of personal protective equipment (PPE), testing kits and cures, to sham key worker badges.

In setting up the virtual parliament – which includes enabling remote participation in proceedings and online voting – the NCSC worked with parliamentarians to raise awareness and upgrade training in cyber security. Other actions included protecting the electoral process in the 2019 general election responding to incidents and triaging threats, investigating leads and providing advice when needed, protecting the Register to Vote website, and supporting the Government’s Brexit negotiations and preparations.

Suspicious email reporting

The NCSC has also continued its work to defend citizens, businesses and charitable institutions and to safeguard Critical National Infrastructure (the mounting cyber threat to this arena has ramped up countermeasures), defence and security assets and operations. In the public arena, this includes setting up of the Suspicious Email Reporting Service which received an average of 133,000 reports a week. Emails are analysed and if malicious content is found, a takedown notice is issued to the hosting provider requesting it removes the content. In parallel, malicious URLs are added to a block list which is provided to browser, anti-virus and firewall vendors. Work has also included tackling the growing incidence of fake celebrity-endorsed investment scams, taking down 300,000 malicious URLs created to trick people into parting with their money.

Last year, the NCSC launched Exercise in a Box, an online tool enabling businesses to test their resilience to cyber attacks, while in July 2020 a Home and Remote Working exercise was launched in response to the increased number of people working remotely. The latter focussed on how employees can safely access networks, what might be needed for secure employee collaboration, and managing a cyber incident while working remotely.

Sports cyber incidents

The NCSC published its first analysis of the sports industry in July, which revealed that 70% of sports institutions had suffered a cyber incident in the past year – double the average for UK businesses. Examples include an English Football League club suffering a ransomware attack which crippled its CCTV system and turnstiles, a racecourse employee losing £15,000 in a spoof eBay scam, and a Premier League club’s managing director being hacked prior a £1m transfer negotiation.

“The COVID-19 pandemic continues to affect how we live and work,” said Penny Mordaunt, the Paymaster General. “In a year of complex challenges, the NCSC has continued to react to swiftly-evolving cyber threats.

“This review shows how the NCSC has taken decisive action against malicious actors in the UK and abroad who saw our digital lifelines as vectors for espionage, fraud and ransom attacks. It is vital that cyber security remains a priority for government, industry and the public in building UK resilience to a spectrum of risks.”

Lindy Cameron, CEO of the NCSC, explains more in the video below.