Preparation and resilience extend beyond simply establishing robust defenses against intruders. Despite the effectiveness of your security measures, there may be instances when attackers successfully breach your defenses. This approach involves not only identifying threat actors exploiting legitimate access to your employees, network, or cloud services, but also containing these attackers to mitigate damage. Additionally,…
Large-scale events are becoming increasingly dependent on digital technologies. Cyber attacks that threaten the confidentiality, integrity, or availability of these systems can lead to significant disruptions, resulting in both financial losses and damage to reputation. This guide provides a framework for integrating Cyber Risk Management processes into the planning of major events. While the focus…
In our 2023 white paper, the NCSC emphasized the necessity of preparing for the transition to post-quantum cryptography (PQC) in light of the risks posed by advancements in quantum computing on current cryptographic systems. Beyond the technical insights provided in that paper, we outlined our commitment to assist the UK government and our regulated Critical…
The transition to Post-Quantum Cryptography (PQC) mirrors many significant technology migration projects. The main objective is to seamlessly integrate PQC into existing systems while minimizing new cyber security threats. Hence, comprehensive planning at the outset is crucial. Organizations may adopt various models for successful technology migration, with each having its unique framework. Regardless of the…
In today’s digital landscape, accessing various online services including messaging, shopping, travel, social media, media streaming, and government resources typically requires managing yet another account and password. Concurrently, there is a rising trend of cyber criminals attempting to hijack online accounts for their illegal gain, often at the expense of users. Safeguarding these account passwords…
As the Director of National Resilience at NCSC, the announcement of a Cyber Security and Resilience Bill in July 2024 by the government was a pivotal step towards addressing the increasing cyber threats to essential services, including water, power, and healthcare. Today, we appreciate the publication of the Department of Science, Innovation and Technology’s (DSIT)…
This guidance targets private sector organizations that do not qualify to utilize the NCSC’s Protective DNS (PDNS). If your organization does qualify for the NCSC’s PDNS, note that a commercially procured protective DNS service is not a suitable alternative. Reasons to Implement Protective DNS Protective DNS (PDNS) systems block access to malicious domains attempted by…
APIs (application programming interfaces) play a crucial role across various industries, spanning social media, finance, healthcare, and telecommunications. They enable effective data exchange between different systems and services. However, the growing reliance on APIs opens the door for attackers who look to exploit potential vulnerabilities in their design and implementation. Recent high-profile security breaches involving…
The Italian Data Protection Authority (Garante per la protezione dei dati personali) has imposed sanctions on OpenAI due to violations of data protection laws related to the ChatGPT chatbot. OpenAI is required to pay a fine of €15 million (approximately $15.6 million) and undertake a six-month public awareness initiative throughout Italian media. This campaign aims…
Vulnerability / Network Security Fortinet has issued an advisory regarding a recently patched critical security vulnerability affecting its Wireless LAN Manager (FortiWLM), which poses a risk of exposing sensitive information. This vulnerability, identified as CVE-2023-34990, has been rated with a CVSS score of 9.6 out of 10, indicating a severe threat level. “A relative path…
