Ransomware is your biggest threat, NCSC CEO tells business

Lindy Cameron is a dif­fi­cult per­son to reach. That’s under­stand­able: as CEO of the Nation­al Cyber Secu­ri­ty Cen­tre (NCSC), she’s at the fore­front of the UK’s fight against com­put­er secu­ri­ty threats. While it’s tough for a jour­nal­ist to nego­ti­ate an inter­view, it’s reas­sur­ing that she’s ded­i­cat­ed to her task. 

The NCSC pro­vides advice and sup­port for pub­lic and pri­vate sec­tor organ­i­sa­tions, help­ing them avoid com­put­er secu­ri­ty threats. Cameron took the helm in Octo­ber 2020, suc­ceed­ing inau­gur­al CEO Cia­ran Mar­tin, who stepped aside after four years in the job.

Ran­somware presents the most imme­di­ate dan­ger to the UK

Her assess­ment of cyber threats, themes and advice should be required read­ing for CIOs and oth­er mem­bers of the C‑suite. Indeed, on the rare occa­sions she has spo­ken in pub­lic since tak­ing up the role, she hasn’t held back.

For instance, in March she warned of the UK’s need to be “clear-eyed about Chi­nese ambi­tion in tech­no­log­i­cal advance­ment”. Speak­ing in her first address as CEO, she chid­ed China’s “hos­tile activ­i­ty in cyber­space” while adding that “Rus­sia [is] the most acute and imme­di­ate threat” to the coun­try.

Ransomware: an immediate danger 

The for­mer num­ber two at the North­ern Ire­land Office has over two decades of expe­ri­ence work­ing in nation­al secu­ri­ty pol­i­cy and cri­sis man­age­ment. She was equal­ly forth­right and insight­ful in October’s keynote speech at Chatham House’s Cyber 2021 con­fer­ence, where she reflect­ed on her first year at the NCSC and iden­ti­fied four key cyber­se­cu­ri­ty themes. The most alarm­ing is the per­va­sive­ness of ran­somware, the scourge of busi­ness lead­ers.

In May, US cloud-based infor­ma­tion secu­ri­ty com­pa­ny Zscaler cal­cu­lat­ed that cyber­crime was up 69% in 2020. Ran­somware account­ed for over a quar­ter (27%) of all attacks, with a total of $1.4 bil­lion demand­ed in pay­ments. And those fig­ures didn’t include two huge­ly dam­ag­ing breach­es that occurred in 2021, mark­ing an ele­vat­ed scope for bad actors.

July’s ran­somware attack on multi­na­tion­al remote man­age­ment soft­ware com­pa­ny Kaseya affect­ed thou­sands of organ­i­sa­tions and saw the largest ever ran­somware demand of $70 mil­lion. The REvil ran­somware gang that claimed respon­si­bil­i­ty for the attack ordered ran­soms rang­ing from a few thou­sand dol­lars to mul­ti­ple mil­lions, although it’s unclear how much was paid. The gang said 1 mil­lion sys­tems had been impact­ed across almost 20 coun­tries. While those num­bers are like­ly to be exag­ger­at­ed, the attack trig­gered wide­spread oper­a­tional down­time for over 1,000 com­pa­nies.

The Kaseya inci­dent came two months after the attack on Colo­nial Pipeline, one of the largest petro­le­um pipelines in the Unit­ed States. The attack dis­abled the 5,500-mile sys­tem, spark­ing fuel short­ages and pan­ic buy­ing at gas sta­tions. With­in hours of the breach, a $4.4m ran­som was paid to Dark­Side, an apt­ly named Russ­ian hack­ing group. Despite the pay­ment – lat­er recov­ered – the pipeline was down for a week.

“Ran­somware presents the most imme­di­ate dan­ger to the UK, UK busi­ness­es and most oth­er organ­i­sa­tions – from FTSE 100 com­pa­nies to schools; from crit­i­cal nation­al infra­struc­ture to local coun­cils,” Cameron told the Octo­ber con­fer­ence. “Many organ­i­sa­tions – but not enough – rou­tine­ly plan and pre­pare for this threat, and have con­fi­dence their cyber­se­cu­ri­ty and con­tin­gency plan­ning could with­stand a major inci­dent. But many have no inci­dent response plans, or ever test their cyber defences.”

Managing and mitigating cyber risk

The sheer num­ber of cyber­at­tacks, their broad­er scope and grow­ing sophis­ti­ca­tion should keep CIOs awake at night. The lat­est Imper­va Cyber Threat Index score is 764 out of 1,000, near­ing the top-lev­el “crit­i­cal” cat­e­go­ry. Oth­er sta­tis­tics hint at the preva­lence of cyber­crime in 2021: some 30,000 web­sites on aver­age are breached every day, with a cyber­at­tack occur­ring every 11 sec­onds, almost twice as often as in 2019.

Cyber­se­cu­ri­ty organ­i­sa­tion Mime­cast reck­ons six in 10 UK com­pa­nies suf­fered such an attack in 2020. In her Racon­teur inter­view, con­duct­ed a fort­night after her appear­ance at Chatham House, Cameron reit­er­at­ed her con­cerns.

“Right now, ran­somware pos­es the most imme­di­ate threat to UK busi­ness­es, and sad­ly it is an issue which is grow­ing glob­al­ly,” she says. “While many organ­i­sa­tions are alert to this, too few are test­ing their defences or their planned response to a major inci­dent.”

Organ­i­sa­tions can pre­vent the vast major­i­ty of high-pro­file cyber inci­dents we’ve seen fol­low­ing guid­ance we have already issued

Despite the head­line-steal­ing attacks, busi­ness­es aren’t doing enough to pre­pare for ran­somware attacks, says Cameron. Cyber risks can and must be man­aged and mit­i­gat­ed. To an extent, CIOs and chief infor­ma­tion secu­ri­ty offi­cers (CISOs) are respon­si­ble for com­mu­ni­cat­ing the poten­tial­ly fatal threat to var­i­ous stake­hold­ers.

Cyber­at­tacks are dif­fer­ent from oth­er shocks as they aren’t read­i­ly per­cep­ti­ble. They are delib­er­ate and can be inter­nal and exter­nal. They hit every aspect of an organ­i­sa­tion – human resources, finance, oper­a­tions and more – mak­ing them incred­i­bly hard to con­tain.

“The impact of a ran­somware attack on vic­tims can be severe,” Cameron con­tin­ues, “and I’ve heard pow­er­ful tes­ti­monies from CEOs fac­ing the reper­cus­sions of attacks they were unpre­pared for. Attacks can affect an organisation’s finances, oper­a­tions and rep­u­ta­tion, both in the short and long term.”

Building cyber resilience 

CEOs can’t hide behind their secu­ri­ty teams if breached by a cyber­at­tack. Cameron warns that defend­ing against these inci­dents can’t be treat­ed as “just a tech­ni­cal issue” – it’s a board-lev­el mat­ter, demand­ing action from the top. 

“A CEO would nev­er say they don’t need to under­stand legal risk just because they have a Gen­er­al Coun­sel. The same applies to cyber­se­cu­ri­ty.” 

Cyber­se­cu­ri­ty should be cen­tral to board­room think­ing, Cameron adds. “We need to go fur­ther to ensure good prac­tice is under­stood and resilience is being built into organ­i­sa­tions. Invest­ing resources and time into putting good secu­ri­ty prac­tices into place is cru­cial for boost­ing cyber resilience.”

Cameron notes that the NCSC’s guid­ance, updat­ed in Sep­tem­ber, will reduce the like­li­hood of becom­ing infect­ed by mal­ware – includ­ing ran­somware – and lim­it the impact of the infec­tion. It also includes advice on what CIOs, CISOs and even CEOs should do if sys­tems are already infect­ed with mal­ware. 

Cameron, who was pre­vi­ous­ly direc­tor gen­er­al respon­si­ble for the Depart­ment for Inter­na­tion­al Development’s pro­grammes in Africa, Asia and the Mid­dle East, echoes Ben­jamin Franklin’s famous max­im: “By fail­ing to pre­pare, you are prepar­ing to fail.” 

There’s a wide range of prac­ti­cal, action­able advice avail­able on the NCSC web­site, she notes.

“One of the key things I have learned in my first year as NCSC CEO is that organ­i­sa­tions can pre­vent the vast major­i­ty of high-pro­file cyber inci­dents we’ve seen fol­low­ing guid­ance we have already issued,” she adds. 

Low-hanging fruit

At the Chatham House event, Cameron acknowl­edged that small- and medi­um-sized enter­pris­es are espe­cial­ly vul­ner­a­ble to cyber­at­tacks. “I com­plete­ly under­stand this is get­ting hard­er, espe­cial­ly for small busi­ness­es with less capa­bil­i­ty,” she said. “But it is cru­cial to build lay­ered defences that are resilient to this.”

SMEs are the low-hang­ing fruit for cyber­crim­i­nals, as they usu­al­ly don’t have the bud­get or the access for suf­fi­cient IT sup­port or secu­ri­ty. “We appre­ci­ate small­er organ­i­sa­tions may not have the same resources to put into cyber­se­cu­ri­ty as larg­er busi­ness­es,” Cameron says. 

The NCSC has pro­duced tai­lored advice for such organ­i­sa­tions in its Small Busi­ness Guide. This explains what to con­sid­er when back­ing up data, how to pro­tect an organ­i­sa­tion from mal­ware, tips to secure mobile devices and the infor­ma­tion stored on them, things to bear in mind when using pass­words and advice on iden­ti­fy­ing phish­ing attacks.

Crim­i­nals will seek to exploit a weak point, which could include an SME in a sup­ply chain. Larg­er organ­i­sa­tions, says Cameron, have a “respon­si­bil­i­ty to work with their sup­pli­ers to ensure oper­a­tions are secured. In the past year, we have seen an increase in sup­ply chain attacks with impacts felt around the world, under­lin­ing how wide­spread sup­ply net­works can be.”

Supply chain concerns

Sup­ply chain attacks were anoth­er of Cameron’s four key themes at the Chatham House con­fer­ence. Such vul­ner­a­bil­i­ties “con­tin­ue to be an attrac­tive vec­tor at the hand of sophis­ti­cat­ed actors and … the threat from these attacks is like­ly to grow,” she said. “This is par­tic­u­lar­ly the case as we antic­i­pate tech­nol­o­gy sup­ply chains will become increas­ing­ly com­pli­cat­ed in the com­ing years.”

The most infa­mous recent sup­ply chain attack was on Solar­Winds, said Cameron. Accord­ing to the for­mer CEO and oth­er Solar­Winds offi­cials, the breach hap­pened because crim­i­nals hacked a key pass­word – it was solarwinds123. This high­lights the impor­tance of strong pass­codes for com­pa­nies large and small. 

“Solar­Winds was a stark reminder of the need for gov­ern­ments and enter­pris­es to make them­selves more resilient should one of their key tech­nol­o­gy sup­pli­ers be com­pro­mised,” Cameron said at Chatham House.

The two oth­er areas of cyber con­cern she pro­mot­ed were the vul­ner­a­bil­i­ties exposed by the coro­n­avirus and the devel­op­ment of strate­gi­cal­ly impor­tant tech­nol­o­gy. “We are all increas­ing­ly depen­dent on that tech­nol­o­gy and it is now fun­da­men­tal to both our safe­ty and the func­tion­ing of soci­ety,” she said of the lat­ter.

On the for­mer theme, Cameron said that mali­cious actors are try­ing to access Covid-relat­ed infor­ma­tion, whether vac­cine pro­cure­ment plans or data on new vari­ants. 

“Some groups may also seek to use this infor­ma­tion to under­mine pub­lic trust in gov­ern­ment respons­es to the pan­dem­ic. The coro­n­avirus pan­dem­ic con­tin­ues to cast a sig­nif­i­cant shad­ow on cyber­se­cu­ri­ty and is like­ly to do so for many years to come.”

CIOs must keep this in mind as many organ­i­sa­tions grap­ple with post-pan­dem­ic ways of work­ing. This involves more remote work­ers using per­son­al or poor­ly pro­tect­ed devices on unse­cured net­works, all of which play into the hands of bad actors.

“Over the past 18 months, many organ­i­sa­tions will have like­ly increased remote work­ing for staff and intro­duced new online ser­vices and devices to stay con­nect­ed,” says Cameron. “While this has offered a solu­tion for many busi­ness­es, it’s vital for the risks to be mit­i­gat­ed so users and net­works work secure­ly. Our home-work­ing guid­ance offers prac­ti­cal steps to help with safe remote work­ing.”

Post-pandemic cybersecurity 

Pro­vid­ing oth­er essen­tial advice, Cameron under­lines the impor­tance for organ­i­sa­tions of all sizes to build their cyber resilience. 

“It’s vital that organ­i­sa­tions of all sizes take the right steps to build their cyber resilience. Edu­cat­ing employ­ees is an impor­tant aspect of keep­ing any busi­ness secure. Staff can be an effec­tive first line of defence against cyber­at­tacks if they are equipped with the right under­stand­ing and feel they can report any­thing sus­pi­cious.”

Busi­ness­es should put a clear IT pol­i­cy in place that guides employ­ees on best prac­tices, while staff should be encour­aged to use the NCSC’s “Top Tips for Staff” train­ing pack­age. 

“These steps are about cre­at­ing a pos­i­tive cyber­se­cu­ri­ty cul­ture and we believe senior lead­ers should lead by exam­ple,” she adds. 

The NCSC’s Board Toolk­it is par­tic­u­lar­ly use­ful for CIOs, designed to help facil­i­tate cyber­se­cu­ri­ty dis­cus­sions between board mem­bers and tech­ni­cal experts. It will “help ensure lead­ers are informed and cyber­se­cu­ri­ty con­sid­er­a­tions can be inte­grat­ed into busi­ness objec­tives”.

These con­ver­sa­tions are now crit­i­cal, as advances in arti­fi­cial intel­li­gence, the inter­net of things, 5G and quan­tum com­put­ing mul­ti­ply attack sur­faces. Reflect­ing on the NCSC’s work since its incep­tion five years ago, Cameron says the organ­i­sa­tion has achieved a huge amount, includ­ing deal­ing with sig­nif­i­cant cyber inci­dents, improv­ing the resilience of crit­i­cal net­works and devel­op­ing a skills pipeline for the future. 

“This is deliv­er­ing real ben­e­fits for the nation, from pro­tect­ing multi­na­tion­al com­pa­nies to defend­ing cit­i­zens against online harm. How­ev­er, the chal­lenges we face in cyber­space are always chang­ing, so we can’t rest on our lau­rels.”

---