A National Cyber Security Centre director is urgening critical national infrastructure (CNI) providers to protect against severe emerging cyber threats in the wake of recent attacks on other government’s CNI.

Director for national resilience at the NCSC, Jonathan Ellison, took to LinkedIn to warn CNI providers to shore up their cyber defences following a malware attack that targeted the energy infrastructure in Poland.

Ellison said that this type of disruptive cyber-attack “may sound far-feteched, but we know it’s not.”

“Incidents like this speak to the severity of the cyber threat and highlight the necessity of strong cyber defences and resilience. Operators of UK critical national infrastructure must not only take note but, as we have said before, act now.”

In the UK, critical national infrastructure includes energy, water, defense, data centres, health, transportation, and telecommunications.

These are especially lucrative targets for cyber threat actors as they are integral to the functioning of a nation and need to be continually operating; disruptions can be dangerous and disasterous, which means that CNI providers may be more tempted to pay off a ransom in order to regain control or access to their services and assets. They can also be targeted to intentially bring these services down in an effort to hurt the economic security and safety of a nation state.

Ellison urged CNI providers to take heed of the NCSC’s advice, guidance, and frameworks in order to mitigate the chances of a cyber-attack as well as any adverse effects.

He pointed to the NCSC’s Cyber Assessment Framework which aimed to help operators and regulators implement cyber resilience, with principles that can help mitigate a severely disruptive attack.

Recommended reading

• £21M Backing for CNI and Device Cyber Technology
• Turing Institute Develops AI Cyber Tools to Defend Critical National Infrastructure
• NCSC Updates Cyber Assessment Framework for Rising CNI Threats

“Risk management, identity and access controls, and threat hunting are all key components of meeting the objectives of the latest iteration,” he said.

Much of the NCSC’s advice centres around increasingly common calls for cyber hygeine, such as patching known vulnerabilites, issuing multi-factor authentication, and adopting secure-by-design principles.

“Risk management, identity and access controls, and threat hunting are all key components of meeting the objectives of the latest iteration,” were also cited as integral cyber protocols by Ellison.

“Although attacks can still happen, strong resilience and recovery plans reduce both the chances of an attack succeeding and the impact if one does,” Ellison said.