The UK’s cyber chief has warned of an “enduring and significant threat” to the UK’s critical infrastructure
In its seventh Annual Review, the National Cyber Security Centre (NCSC) said the UK’s critical sectors are facing the increased threat of cyberattack, in part due to a rise of state-aligned groups, an increase in aggressive cyber activity and ongoing geopolitical challenges.
Over the past 12 months, the NCSC said it has seen the emergence of a new class of cyber adversary in the form of state-aligned actors, who are “often sympathetic to Russia’s further invasion of Ukraine and are ideologically, rather than financially, motivated.”
“The last year has seen a significant evolution in the cyber threat to the UK – not least because of Russia’s ongoing invasion of Ukraine but also from the availability and capability of emerging tech,” said NCSC CEO Lindy Cameron.
“As our Annual Review shows, the NCSC and our partners have supported government, the public and private sector, citizens, and organisations of all sizes across the UK to raise awareness of the cyber threats and improve our collective resilience.
“Beyond the present challenges, we are very aware of the threats on the horizon, including rapid advancements in tech and the growing market for cyber capabilities. We are committed to facing those head on and keeping the UK at the forefront of cybersecurity.”
Interfering with elections
The Review highlighted a new trend of malicious actors targeting the personal email accounts of high-profile and influential individuals involved in politics. Rather than a mass campaign against the public, the NCSC warns that there is a “persistent effort” by attackers to specifically target people who they think hold information of interest.
It also noted that the next general election will be the first to take place against the backdrop of significant advances in artificial Intelligence (AI), which will enable and enhance existing challenges.
More specifically, the NCSC assesses that large language models (LLMs) will almost certainly be used to generate fabricated content; that hyper-realistic bots will make the spread of disinformation easier; and that deepfake campaigns are likely to become more advanced in the run up to the next nationwide vote, scheduled to take place by January 2025.
“Ecosystem approach” to national resilience
Dominic Trott, director of strategy and alliances at Orange Cyberdefense, Europe’s largest managed security services provider (MSSP), said the need to protect vital assets has been brought to the fore since the start of the war in Ukraine.
“This challenge has been heightened by the ‘theatre’ of this conflict increasingly pivoting online as threats target organisations’ web presence, as well as the rapid uptake of AI, and especially generative AI (Gen AI) tools – with both positive and negative consequences,” he said.
“It is undoubtable that more needs to be done to protect CNI worldwide. This is especially vital within the energy sector, which will become much more of a target for cybercriminals looking to cause disruption or achieve financial gains as we move away from fossil fuels and increase our reliance on renewable energy.
“As ever, any cyber-resilience programme within CNI firms must begin with the security fundamentals, such as educating employees on the threats they face and the importance of adopting good basic security hygiene. They should also prioritise patch management to update and rid key systems of any potentially catastrophic vulnerabilities, which can prevent many breaches before they even occur. However, when considering the security of CNI value chains, we must also give thought to driving security beyond basic hygiene factors. Orange Cyberdefense is pleased to see the NCSC and the UK government encouraging the adoption of a nationwide ecosystem approach to national resilience.”
