 | This article has multiple issues. Please help improve it or discuss these issues on the talk page . (Learn how and when to remove these messages)
|
The United Kingdom has a diverse cyber security community, interconnected in a complex network.
| This article has multiple issues. Please help improve it or discuss these issues on the talk page . (Learn how and when to remove these messages)
|
The United Kingdom has a diverse cyber security community, interconnected in a complex network.
According to a parliamentary committee the UK government is not doing enough to protect the nation against cyber attack. [1]
The UK Government periodically publishes a Cyber Security Strategy. [3]
Many of the stakeholders across all categories are engaged with that effort.
The overall responsibility for security within the UK rests with the National Security Council which is a cabinet committee chaired by the Prime Minister tasked with overseeing all issues related to national security, intelligence coordination, and defence strategy.
The internal protective security coordination role for UK government is led by the Government Chief Security Officer (GCSO) within the Cabinet Office, who since 2021 has been Vincent Devine. [4]
The central organisation supporting the GCSO is the Government Security Group (GSG), with a distributed Government Security Function / Government Security Profession across the departments and Arms Length Bodies (ALB), and three National Technical Authorities (NTA), all of which have a role in information and/or cyber security:
The role of Lead Government Department (LGD) for Cyber Security is currently fulfilled by the Department for Science, Innovation, and Technology (DSIT), having previously rested with:
All other government departments and ALBs will have staff in the government security function / government security profession, supporting both their internal staff, and their client communities.
Former bodies in this category include:
The Ministry of Defence has primacy for information and cyber security within both its civilian and military staffs (approximately 250,000 personnel), and for the Defence Supply Base (DSB - approximately 30,000 companies).
It has two main security organisations:
These organisation work collaboratively to publish not only the internal rules, but also Defence Standards and Industry Security Notices (ISN) [7]
In April 2016, the MOD announced the creation of the Cyber Security Operations Centre (CSOC) with a budget of over £40 million. It is located at MoD Corsham. [8] [9]
MOD collaborates with the DSB over information and cyber security matters through a number of organisations, including:
Former bodies in this category include:
The National Cyber Force consolidates offensive cyber capabilities from the Ministry of Defence and GCHQ.
The National Crime Agency (NCA) hosts the law enforcement cyber crime unit, incorporating the Child Exploitation and Online Protection Centre.
Former bodies in this category include:
Within the WPS, there are a number of collaborative bodies, including:
Two regulatory bodies have a specific cyber security related function:
Most other regulatory bodies will have staff covering information and cyber security function for both their internal staff, and their client communities.
| UK Cyber Clusters |
|---|
| Bristol and Bath Cyber |
| Bournemouth Cyber Cluster |
| Cambridge Cluster |
| East Midlands |
| London |
| Malvern Cluster |
| Norfolk Cyber Cluster |
| North East Cyber Cluster |
| North Wales |
| North West Cluster |
| N Somerset Cluster |
| Oxford |
| Scottish Cyber Cluster |
| Solent Cyber Cluster |
| South Wales |
| South West Cyber Cluster (Exeter) |
| Sussex Cluster |
| Thames Valley Cluster |
| West Midlands Cluster |
| Yorkshire Cluster |
Current bodies that cover multiple sectors include:
Former bodies in this category include:
Government Communications Headquarters (GCHQ) is an intelligence and security organisation responsible for providing signals intelligence (SIGINT) and information assurance (IA) to the government and armed forces of the United Kingdom. Primarily based at "The Doughnut" in the suburbs of Cheltenham, GCHQ is the responsibility of the country's Secretary of State for Foreign and Commonwealth Affairs, but it is not a part of the Foreign Office and its director ranks as a Permanent Secretary.
The Common Criteria for Information Technology Security Evaluation is an international standard for computer security certification. It is currently in version 3.1 revision 5.
Information security standards are techniques generally outlined in published materials that attempt to protect a user's or organization's cyber environment. This environment includes users themselves, networks, devices, all software, processes, information in storage or transit, applications, services, and systems that can be connected directly or indirectly to networks.
The Federal Office for Information Security is the German upper-level federal agency in charge of managing computer and communication security for the German government. Its areas of expertise and responsibility include the security of computer applications, critical infrastructure protection, Internet security, cryptography, counter eavesdropping, certification of security products and the accreditation of security test laboratories. It is located in Bonn and as of 2024 has about 1,700 employees. Its current president, since 1 July 2023, is former business executive Claudia Plattner, who took over the presidency from Arne Schönbohm.
The National Protective Security Authority (NPSA) is the national technical authority in the United Kingdom for physical and personnel protective security, maintaining expertise in counter terrorism as well as state threats.
The CESG Claims Tested Mark, formerly CSIA Claims Tested Mark, is a UK Government Standard for computer security.
HMG Information Assurance Standard No.1, usually abbreviated to IS1, was a security standard applied to government computer systems in the UK.
The CESG Listed Adviser Scheme was a programme run by CESG, to provide a pool of information assurance consultants to government departments and other public-sector bodies in the UK.
The Security Policy Framework is a set of high-level policies on security, mainly affecting the UK government and its suppliers.
Robert Peter Hannigan CMG is a cybersecurity specialist who has been Warden of Wadham College, Oxford, since 2021. He was a senior British civil servant who previously served as the director of the signals intelligence and cryptography agency the Government Communications Headquarters (GCHQ) and established the UK's National Cyber Security Centre. His sudden resignation as director was announced on 23 January 2017, and he stepped down at the end of April 2017 to pursue a career in private sector cyber security, academia and as a security commentator. In 2021 he became Warden of Wadham College, Oxford.
The Chartered Institute of Information Security (CIISec), formerly the Institute of Information Security Professionals (IISP), is an independent, not-for-profit body governed by its members, with the principal objective of advancing the professionalism of information security practitioners and thereby the professionalism of the industry as a whole.
IASME Governance is an Information Assurance standard that is designed to be simple and affordable to help improve the cyber security of Small and medium-sized enterprises (SMEs).
Nexor Limited is a privately held company based in Nottingham, providing products and services to safeguard government, defence and critical national infrastructure computer systems. It was originally known as X-Tel Services Limited.
The Government Security Classifications Policy (GSCP) is a system for classifying sensitive government data in the United Kingdom.
The Trustworthy Software Foundation (TSFdn) is a UK not-for-profit organisation, with stated aim of improving software.
Ian Bryant is a British academic. He is primarily involved in promoting Trustworthy Software and Systems, and in Standardisation.
The Government of the United Kingdom maintains several intelligence agencies that deal with secret intelligence. These agencies are responsible for collecting, analysing and exploiting foreign and domestic intelligence, providing military intelligence, and performing espionage and counter-espionage. Their intelligence assessments contribute to the conduct of the foreign relations of the United Kingdom, maintaining the national security of the United Kingdom, military planning, public safety, and law enforcement in the United Kingdom. The four main agencies are the Secret Intelligence Service, the Security Service (MI5), the Government Communications Headquarters (GCHQ) and Defence Intelligence (DI). The agencies are organised under three government departments, the Foreign Office, the Home Office and the Ministry of Defence.
Cyber Essentials is a United Kingdom certification scheme designed to show an organisation has a minimum level of protection in cyber security through annual assessments to maintain certification.
The National Cyber Security Centre (NCSC) is a government computer security organisation in Ireland, an operational arm of the Department of the Environment, Climate and Communications. The NCSC was developed in 2013 and formally established by the Irish government in July 2015. It is responsible for Ireland's cyber security, with a primary focus on securing government networks, protecting critical national infrastructure, and assisting businesses and citizens in protecting their own systems. The NCSC incorporates the Computer Security Incident Response Team (CSIRT-IE).
The National Cyber Security Centre (NCSC) is an organisation of the United Kingdom Government that provides advice and support for the public and private sector in how to avoid computer security threats. It is the UK's National technical authority for cyber threats and Information Assurance. Based in Victoria, London, it became operational in October 2016, and its parent organisation is GCHQ.