Graham Bartlett, Cisco’s UKI Senior Technical Leader in professional services security, explains why defending our Critical National Infrastructure customers from cyber threats is a personal mission.
I was recently asked to present at the recent National Cyber Security Centre (NCSC) CyberUK event in Manchester, and was delighted to accept in my role as Cisco’s Head Consultant to the NCSC Cyber Security Consultancy Scheme (CCSC).
I have had the pleasure of working with a number of architects from NCSC when collaborating with our UKI Public Sector customers, as well as working with our Principle Information Assurance Architect, Mark Jackson, when he took several of our security products through Commercial Product Assurance.
The NCSC CCSC allows organisations with a track record in delivering quality services to Critical National Infrastructure (CNI) customers to certify said services. I am proud to say that we were one of the first organisations to be certified under this scheme.
Protecting and defending our customers
When NCSC first announced this programme, I was determined to obtain membership for our organisation, given our proven track record in national cyber-security support.
However, it was also a personal mission. I work with many CNI customers who struggle to deploy robust security architectures; this is something I see virtually on a weekly basis. CCSC membership could help Cisco defend our CNI customers from cyber threats.
Reading this, you might assume that we had a large team that magically and effortlessly produced our CCSC application, but this was not the case.
I spent many long nights and weekends generating the evidence for submission to NCSC for our application, including gaining membership of the Cyber Essentials scheme. As you can imagine, I was thrilled when Cisco obtained CCSC membership in 2015, and this would not have been possible without the backing of my senior management, David Williamson, Ashley Arbuckle and James Mobley.
Then and now
It’s incredible how times have changed. When I left university in the late 1990s, interconnecting networking products was complex; when things didn’t work, which was common, we had to debug protocol flows to determine what was broken.
Today however, customers no longer need to know the ins-and-outs of every protocol and technology that is used – just connect devices to your network, click the GUI and voilà! Things just seem to work by magic…
With this ease of use, the requirement for a knowledge and understanding of the security of said protocols has declined, and a deep understanding of protocols seems to have become a dying art.
Trends in cyber threats
At CyberThreat2018 (which was an amazing event), an NCSC analyst shared their findings from the last 12 months. This included network compromise at scale, where two particular comments resonated with me:
The attacker only needed the defender to make one mistake to compromise the network.
In the case of all incidents, the attackers knew the network better than the defenders.
These are very valid points and illustrate that defender’s need to understand the capabilities of threat actors and the security controls that can be used to mitigate said threats. If a defender does not have knowledge of the security protocols in use, which seem to be more common than not, they must rely on vendors to implement robust security into products and technologies.
Find out more
Understanding the threat domain and taking advice from experts can help mitigate the risks. So why not start by contacting us for further information. And don’t forget to check out our 2018 Cyber Security Report.
Authors