CyberScotland Bulletin

Cyber Essentials technical requirements v3.1 goes live

Version 3.1 of the Cyber Essentials Requirements has been released. All Cyber Essentials certifications started on or after the 24th of April will be assessed using this version.

As first previewed in January, this 2023 update is a ‘lighter touch’ than the major update in 2022, however, it features several clarifications and some important new guidance. Further details on these changes can be found in the NCSC’s earlier news article and in a blog post from their Cyber Essentials delivery partner, IASME. A refreshed set of FAQs is also available.

This update is part of a regular review of the scheme’s technical controls, ensuring that it continues to help UK organisations guard against the most common cyber threats. All changes are based on feedback from assessors and applicants and have been made in consultation with technical experts from the NCSC. As well as the updated requirements and new question set, IASME are also providing more guidance documents to help applicants during the certification process. This includes articles to help applicants understand the questions, as well as access to a dedicated knowledge base. These resources will become available over the coming months.

Read more about it here

NCSC Threat Report

The NCSC produces threat reports drawn from recent open-source reporting. View the latest report here.  

To ensure you get the most up-to-date information from NCSC, you can sign up for their email service where they are sharing all advisories, threat reports, and urgent communications. Select ‘threat report and advisories’ to receive the most up-to-date content.

Organisations that are proactive in their approach to the management and handling of cyber security should consider joining the Cyber Security Information Sharing Partnership (CiSP).

Cyber security breaches survey 2023

The Cyber Security Breaches Survey is a research study for UK cyber resilience, aligning with the National Cyber Strategy. It is primarily used to inform government policy on cyber security, making the UK cyberspace a secure place to do business. The study explores the policies, processes and approach to cyber security for businesses, charities, and educational institutions. It also considers the different cyber attacks and cyber crimes these organisations face, as well as how these organisations are impacted and respond.

 The 2023 publication includes coverage of the following areas:

• prioritisation, information seeking (including use of government guidance) and decision making on cyber security, including among organisations’ management boards
• cyber security approaches, covering risk management (including cyber insurance and supply chain risks), technical controls, staff training and responsibilities and governance
• the cyber threat landscape, including identification of cyber security breaches or attacks, their outcomes and impacts, their estimated financial cost
• incident response approaches and reporting of cyber security breaches or attacks
• the prevalence, nature, scale and financial costs of cyber crime, as well as the prevalence, nature and scale of fraud that occurred as a result of cyber crime.

Read the 2023 Cyber security breaches survey here

World Password Day on 4 May 2023

The first Thursday of May is World Password Day, established to help raise awareness of the importance of strong passwords.

Passwords are an important step to help keep our accounts secure online, and often one that many people under value.

Methods to help you choose a strong password include:

• Combining three random words. See this blog from NCSC about why the technique works.

• Use a different password for all your accounts. This makes it more difficult for hackers to break into your account.

• NCSC encourages people to use password managers which can help create strong passwords for you (and remember them).

• Turning on 2-step verification on your accounts, will help provide an extra layer of security that verifies it’s really you logging in.

• Delete accounts that you no longer require. Check if your password has been compromised in any data breaches. https://haveibeenpwned.com/Passwords 

Check out or guide on choosing strong and separate passwords here for more in depth advice

Cyber and Fraud Centre Cyber Executive Education Programme

In today’s landscape of escalating cybercrime, mitigating cyber risk is not the Chief Information Security Officer’s responsibility alone — it is everyone’s job.

Getting ahead of hackers and other security risks requires the active engagement of non-technical management and an overall commitment to building a cyber security culture within your organisation.

This programme, which is developed and delivered by Ciaran Martin, former CEO of the National Cyber Security Centre, provides CEOs, Directors and Non-Executive Directors with frameworks and best practices for managing cyber security-related risk, separate from the specialised IT infrastructure typically associated with this topic.

This two-day, in-person course includes lectures from Ciaran Martin and the Cyber and Fraud Centre’s Head of Ethical Hacking and Professional Services, Declan Doyle and highly interactive discussions, as well as case studies related to:

• Increasing your overall cyber security awareness.
• The role of non-tech leaders play in cyber security management.
• Actionable ideas to increase cyber resilience.
• How to measure your organisation’s cyber-safety level — and how it’s changing over time.
• How to speak the language of cyber security to enable informed conversations with your technology teams and colleagues and ensure your organisation is as cyber secure as possible.

For more information or to sign up click here

There will be 3 modules delivered over the 2 days, and there will be interactive case study work outside of the programme in groups. For more details on the modules, click here.