UK Cyber Security Council Hosts International Women’s Day Event To Celebrate Vital Role Women Play In The Sector

Ahead of International Women’s Day (8th March), The UK Cyber Security Council has revealed how a more diverse workforce can plug the cyber industry’s skills gap and bolster the UK’s resilience against online threats.

With an ambition to ensure the UK becomes the safest place to live and work online, the UK Cyber Security Council has partnered with Women in Cyber Security (WiCyS UK) for an event on 8th March 2022. 

Exploring sector diversity and barriers to entry, the virtual sessions will hear from high-profile individuals working within cyber, which aims to inspire current practitioners and educate potential entrants to the industry.

The event will be chaired by Laura Wellstead (WiCyS), with keynote talks given by thought leaders from across the industry, including Dr Claudia Natanson (Chair, UK Cyber Security Council), Lindy Cameron (CEO, NCSC) and Angelique Faye Loe (Head of Cryptography, Jaguar Land Rover). 

Although the UK’s cyber sector employs an estimated 52,700 individuals, diversity has been identified as a key area of growth as the sector tackles increased cyber risks. An estimated 16 percent of the workforce are women, 17 percent come from ethnically diverse backgrounds, and just 9 percent self-describe as being neurodiverse.

According to the UK Cyber Security Council, the importance of the sector is growing exponentially in line with our increasingly connected and digital lives, however increased demand has also created a skills gap. The Council believes overcoming barriers to entry and a push for greater diversity is a pivotal issue for the sector which, if overlooked, could leave the country more vulnerable to future cyber-attacks.

The UK Cyber Security Council’s CEO, Simon Hepburn, said: “One of the government’s key aims is to establish the UK as one of the safest places to live and do business online and to do that, the Council will work to bridge the industry’s skills gap.

An intrinsic element for that ambition will be for the Council to help remove barriers for entry, helping individuals across a broad range of demographics and backgrounds to recognise just how rewarding a career in the sector can be.”

Despite contributing £5.3 billion in GVA to the UK economy, there is an annual reported shortfall of 10,000 practitioners within the industry, and half of businesses in the UK report a basic skills gap when it comes to cyber, despite the increasing importance of digital resilience to counter threats.

Dr. Claudia Natanson, The UK Cyber Security Council’s Chair, said: “We want the sector to be truly representative of all sections of society, and for every employee, contractor or supplier to feel acknowledged, respected and able to be their best”.

Dr Claudia Natanson (Chair, UK Cyber Security Council)

Ethics aside, it also makes for a compelling business argument. According to a recent study by Cleverpop, more gender-diverse teams make better business decisions due to fresh perspectives being brought to the table.

In addition to worsening the sector’s skills gap, a less diverse workforce can stifle innovation and can lead to intrinsic biases within organisations, which cyber criminals can, and will, take full advantage of.

The sector has a long way to go to achieve gender parity, but we’re excited to be partnering with WiCyS for this event to take initial steps to overcome the problems. It’ll be a great session for people to engage with each other, learn more about routes into the profession, career development opportunities and best practice in this exciting industry.

Formed as the voice of the UK’s cyber security profession, the Council provides broad representation for the industry and promotes excellence across the profession. In accordance with the UK government’s National Cyber Security Strategy, its role is to develop, promote and align professional standards, and encourage progression along cyber security career paths.

For more information on the UK Cyber Security Council, please visit:https://www.ukcybersecuritycouncil.org.uk/events

And to sign up to the International Women’s Day event, please visit:
https://hopin.com/events/uk-cyber-security-council-iwd

(72)

Share

TIGERBOND DECODES BRIEF TO BRING UK CYBER SECURITY COUNCIL ON BOARD

The UK Cyber Security Council has appointed tigerbond as its lead agency to devise a structured PR and marketing programme to raise awareness of its aims.

The Council, which became operational in 2021, was formed as the voice of the UK’s cyber security profession. Its role is to develop, promote and align professional standards, and encourage progression along cyber security career paths, in accordance with the UK government’s National Cyber Security Strategy.

Following a competitive tender process, the UK Cyber Security Council has chosen tigerbond on an initial three month contract, with an option for a further 12 months as it enters a new funding cycle.

Simon Hepburn, chief executive of the UK Cyber Security Council, said: “From online shopping to banking, cyber security plays an intrinsic role in our increasingly digital personal and professional lives. We want the Council to be leading the charge at the forefront of the rapidly growing cyber security sector.

“Our objective is to develop and promote the highest professional and ethical standards across the profession to ensure the UK becomes the safest place to live and work online, and for that we need support from an agency partner. “According to a recent DCMS report, the sector is rapidly expanding and employs 52,700 individuals and contributes around £5.3 billion GVA to the UK economy, a 33% increase on the previous year. Comparatively, that’s roughly half the size of the GVA added by the UK’s agricultural industry – but not enough people know the scale of the sector or the rapid growth that’s still to come.

“Our tender process was extremely competitive and the standard of submissions we received was very high, but tigerbond stood out. Tigerbond will support by engaging with the cyber security sector and those seeking to enter it, alongside government, industry and academia, with the combined aim of developing and promoting UK cyber security excellence globally and growing the UK’s skills base.”

Tigerbond has long-standing experience of working with membership organisations and trade bodies, and will support the Council with increased awareness and positioning. The comms activity for the Council will seek to raise awareness of its purpose, vision and mission, whilst positioning it at the forefront of an inclusive and diverse cyber industry.
This will include refining the organisation’s messaging in order to reach and engage with key stakeholders including existing sector organisations and professionals, the public sector, and those in education or currently working in other sectors who may consider a career in cyber security.

Chris Gilmour, co-founder at tigerbond, said: “It was evident early in the tendering process just how significant the UK Cyber Security Council’s role will be in providing stewardship for this rapidly expanding and increasingly vital sector, and we were inspired to assist in this journey.

“The team’s experience working across public and private sector, trade bodies and membership organisations has put us in good stead for delivering impact. We can’t wait to kick off our campaigns this year and generate some strong results for Simon and his team.”

Headquartered in London, tigerbond’s office network includes Manchester, Glasgow, Leeds, Belfast and four cities across Canada. It delivers the full mix of integrated communications services from PR and social to digital, design, branding and web. It was recently named as one of PR Week’s top 12 agencies to watch in the UK in 2022. For more information on tigerbond, please visit:https://www.tigerbond.com/  and to learn more about the UK Cyber Security Council, visit:https://www.ukcybersecuritycouncil.org.uk/ 

(54)

Share

Simon Hepburn Is The New Permanent CEO appointed to lead the UK Cyber Security Council

The UK Cyber Security Council – the charitable, self-regulatory body for the cyber security education and skills sector – today announced the appointment of Simon Hepburn, a charity and education executive with over twenty years’ experience in a variety of national and international organisations, as its chief executive.

Hepburn has previously been chief executive of a charity and founded two others, and has held director positions with a variety of charities, academy trusts and businesses. He was also a Trustee Board member of ACEVO (Association for Chief Executives of Voluntary Organisations) and has also sat on the BBC Charities Advisory Board.

“Simon Hepburn’s record is one of delivering at the sharp end of education and careers, for charitable organisations like the Council,” said Dr. Claudia Natanson, chair of the Board of Trustees of the UK Cyber Security Council. “The Council may well be the voice for the profession, but it is absolutely intended to be a ‘doing’ organisation rather than just a ‘talking’ organisation, so this attribute made him an excellent candidate for CEO; we welcome his passion and energy and look forward to him driving the organisation forwards.”

“I make no secret of my passion for supporting people and organisations to reach their full potential and make a positive contribution to society – it has been at the heart of my career to date. I intend to bring the full weight of that knowledge and experience to bear on the activities of the Council, benefiting the cyber security profession,” said Simon Hepburn, CEO of the UK Cyber Security Council. I’m excited by the opportunity to work with one of the most critical sectors in our country, delivering education and skills support and resources to organisations and the professionals that are essential to the safe, secure and prosperous operation of the UK economy.”

Hepburn’s other career roles include:

  • Founder of Black Star Inc., advising on diversity and inclusion, leadership and management, people and change, strategy and organisation development, careers and employability
  • UK Director at international social action charity City Year UK, leading on school partnerships, programme design and delivery, leadership programme development, mentor experience and programme impact
  • Director of Education and Policy at ed-tech company U-Explore Ltd, supporting schools, colleges, local authorities and businesses on careers and employability programme development and partnerships
  • Director of Pathways and Partnerships for Academies Enterprise Trust Careers, leading on the development of the Championing Careers Guidance Programme working in partnership with the Greater London Authority (GLA)

Simon Hepburn succeeds Don MacIntyre, who was appointed as interim CEO by the Board of Trustees in January 2021 during the Council’s formation.

(136)

Share

UK Government Issues Cyber Security Professionalism Consultation Document

Dateline – 19th July 2018

As part of its National Cyber Security Strategy published in 2016, the Department for Culture Media and Sport today published its Consultation Document on creating the environment to develop the cyber security profession in the UK. In recognising that the UK has some of the best Cyber Security Professionals in the world the UK Government also recognises that “the need to further develop the right skills, capabilities and professionalism to meet our national needs across the whole economy is increasingly important” and that the “consultation sets out bold and ambitious proposals to implement that. It includes a clear definition of objectives for the profession to achieve and proposes the creation of a new UK Cyber Security Council to coordinate delivery”. The consultation aims are to:

* Summarise the Government’s understanding of the challenges facing the development of the cyber security profession;
* Seek views on objectives for the profession to deliver by 2021 and beyond; and
* Seek views on the creation of a new UK Cyber Security Council to help deliver those objectives.

The consultation period ends on the 31st August 2018 and therefore only provides a short period for the responses to be submitted. Responses may be submitted via an Online Portal by both organisations and individuals.

The current UK cyber security organisations were quick to recognise, that if left alone to plan and decide the future for the profession the outcome may not be desirable to their various members, a single governing body would not be suitable for all the various professional roles that are related to the cyber security profession. A collaborative ‘Cyber Security Alliance’ was therefore formed that includes many of the leading organisations such as the BCS, IET, IAAC, ISSP, to name but a few, of what has become a growing alliance. The ‘Cyber Security Alliance’ issued its own press release regarding the consultation process and its support to the National Cyber Security Strategy.

The aim of creating a Cyber Security Council is a bold move founded on previous experience of such organisations as the ‘General Medical Council’, ‘The Science Council’ and the ‘Engineering Council’. Some of these organisations were created by statute, however this is not the plan for the Cyber Security Council. Yet in this single point is the greatest danger to the future of establishing such a council. The council has to be all things to all the current organisations and potential new alliance members, with no single organisation taking a lead role, for to do so would potentially collapse the Alliance and ultimately the very idea of a Council. For this to work the cyber security council will need to be established from the ground up, be non profit for the benefit of its member organisations and have a plan to become self sufficient in the near future.

This is important for the future of the cyber security profession here in the UK and urge all to respond to the consultation to ensure that the widest possible participation is achieved.

(81)

Share

Comparitech.com finds nearly half of UK Netflix customers would pay a premium to access US restricted content

According to a survey carried by OnePoll on behalf of privacy advice and comparison website, Comparitech.com, almost half (48%) of the respondents that said they currently used Netflix claimed that they would pay a premium to be able to access content that is normally restricted to the US audience. A further 43% of those who used Netflix said that they felt it was wrong for Netflix to ban VPNs in order for customers to access US restricted content.

“While Netflix did recently push up its prices, there was no extra benefit to the customer.  Instead, if users were willing to pay a premium to access more content, Netflix could use this extra capital to negotiate better deals with licensing agencies to offer a better service to its customers rather than put its customers privacy at risk with this unpopular VPN ban,” said Paul Bischoff from Comparitech.com. 

This lockdown has meant Netflix has come under fire from consumers angry about its decision to block VPN connections from accessing content out of uncertainty of where the traffic is coming from – Netflix content varies across different regions, so VPNs can be used to get around regional content blocking in order for users to watch whatever they want.  NordVPN even surmised that this is the reason for Netflix’s subscriber growth taking a hit and share prices going down.

The findings bring into question whether the uproar about VPN blocking is actually necessary given there is a clear market for people willing to pay extra to Netflix to get the content they want to see.

(90)

Share

USB Stick can kill various devices that have USB ports

?When plugged into any device, The USB Killer, released earlier this summer, rapidly draws power from the hardware, then returns that power in an overloading burst. According to the makers, this “instantly and permanently disables unprotected hardware.” Potential targets include not just PCs, but TVs, copy machines—anything with a USB port.

To read the article in full click here .

(191)

Share

Mac OS X backdoor uncovered

Following the news that a sophisticated Mac OS X backdoor has been uncovered, Anton Tyurin, the Head of Attack Detection Software Department, Positive Technologies offered @DFMag the following expert comment.

“There is nothing unusual. A malware with similar functionality was detected in 2012 by Dr.Web. Dubbed BackDoor.DaVinci.1, this cross-platform Trojan can gain full control over computers running both Windows and Mac OS X, or even destroy your OS.

“If we compare Backdoor.OSX.Mokes with its versions for Windows and Linux, we will find nothing new, because developers initially aimed at cross-platform malware retaining all features. Of course, the mechanism of malware persistence in the system was changed for Mac OS X. By the way, not only antiviruses can detect that kind of malware behavior, but also persistence monitoring tools such as BlockBlock (https://objective-see.com/products/blockblock.html).

“OSX/Keydnap has a mechanism for gathering and retrieving passwords and keys stored in the OS (Keychain). This is probably the main idea of that malware. OSX/Mokes captures audio and video from a webcam, takes screenshots every 30 seconds, logs keystrokes, and monitors removable storage devices. More serious spy, so to say.

“Both Trojans are able to execute commands on a victim’s computer remotely – and both could be detected by its communication methods. OSX/Keydnap uses TOR to connect to the C&C server, this could be easily tracked by modern IDS systems.

“OSX/Mokes uses 443 port to transmit the AES-encrypted data, this is alarming incompliance: 443 port is used by default for HTTPS connections with TLS cryptographic protocol.

“It is classic: do not visit suspicious websites, do not open suspicious files (especially from root), update your antiviruses and your OS. Using Mac OS X does not guarantee security: it is widely used now, so malware authors will create more programs for it.

“The delivery vector of Mokes malware is unclear: it could be delivered by email or a faked application (from untrusted websites) run by users themselves, or it could come by vulnerability exploitation in Flash/Java/Safari (previously unknown vulnerabilities? Why not!).

“We can also guess who the user of this backdoor is and what resources he possesses to be able to store and analyze large amount of data stolen from victim computers (audio and video). Is it industrial espionage, or some state intelligence agency?”

(124)

Share

Gugi malware targeting Android banking apps

Following the news that a Gugi malware is targeting Android banking apps,  Artem Chaykin, Head of Mobile Application Security Department, Positive Technologies provided the following comment to @DFMag;

“The best way to avoid Android Trojans – do not install apps from unknown sources. By default you can install apps only from Google Play, but Android allows you to change this. As an Android user you should always install apps only from the official market.

“If you run a company, it could be hard to convince all your employees to apply this security rule on all BYOD or corporative devices. However you can force them to do this by applying mobile security policies via MDM systems or Microsoft Exchange, for example. This can protect users from typical Android Trojans.

“The new generation of Android Trojans is another story. According to our statistics, 75% of Android banking apps are exposed to high-severity vulnerabilities and some of them, like one-time passwords stealing, can be exploited by malware applications with zero permissions. What you can do? Install updates to applications as soon as they come, use security systems which can detect suspicious behavior of your applications… and yes, simply try to avoid serious operations (like money transfer) via Android mobile apps.”

(74)

Share

Guidance (Digital Forensics) Software Announces a Global Technology and Services Agreement with Atos

Guidance Software, a global company that develops and provides software solutions for digital investigations to law-enforcement and retail agencies, is best known for creating EnCase, a high-quality product line centered around digital forensics, endpoint security analytics, e-discovery and cyber security incident response.

Under the new agreement, Atos will provide top-tier forensic security products from Guidance Software to customers worldwide, according to a statement released to the media. Together, they plan to deliver solutions to organizations that will find, assess and counter hidden cyber threats within their networks.

“Today, organizations face an increasing variety of cybersecurity threats from both inside and outside the traditional network perimeter,” said Chris Moret, vice president for cybersecurity at Atos in the media statement.. “This partnership adds best-in-class endpoint detection and response tools from Guidance to our portfolio of security solutions clients use to protect their most valuable systems and data.”

Together, Atos and Guidance can provide 360-degree visibility for an organization’s secure data and provide unrivaled automated response if a threat is found, according to the press release.

“Guidance is committed to growing our business through strategic global partnerships,” said Scott Skidmore, Vice President of Guidance’s global channel in the statement released to the press. “Atos is a strategic partner in our strategy to accelerate growth across the globe. At Guidance, we are focused on strengthening our capabilities and services so that our partners have the best forensic security solutions to fit their market needs.”

Guidance was founded in 1997 and currently has 371 employees worldwide. Their software is best known for aiding authorities in convicting Scott Peterson, who murdered his wife and unborn child in 2004 and for catching Dennis Rader, the famed “BTK killer” who killed 10 people between 1974 and 1991 and wasn’t caught until he taunted police by sending them a CD in 2005, leaving behind traceable digital footprints. https://www.guidancesoftware.com/

(188)

Share

House Oversight and Government Reform Committee Releases Comprehensive Report Confirming CyFIR Software Located and Identified Malware in OPM Data Breach

Majority members of the House Oversight and Government Reform Committee today released a comprehensive and documented report outlining their findings regarding the April 2015 Office of Personnel Management (OPM) data breach, which includes a confirmation that CyTech Services played a key role in identifying and responding to the intrusion that compromised 21 million sensitive government records.
As the report indicates, at OPM’s invitation, CyTech demonstrated their CyFIR Enterprise digital forensics and incident response platform at OPM on April 21-22, 2015. Using CyTech’s innovative endpoint vulnerability assessment methodology, CyFIR identified, within 12 minutes, a set of unknown processes running on a limited set of endpoints. This information was immediately provided to OPM security staff upon detection and was ultimately revealed to be zero day malware that had been in place on the OPM network for more than a year.

Specifically, the report stated, “During CyTech’s April 21, 2015 demonstration, CyTech identified or ‘discovered’ malware on the live OPM IT environment related to the incident. There is no evidence showing CyTech was aware [of the incident] at the time of the April 21 demonstration…Beginning on April 22, 2015, CyTech offered and began providing significant incident response and forensic support to OPM related to the 2015 incident. The documents and testimony show OPM and Cylance recognized CyFIR’s ability to quickly obtain forensic images. CyTech provided an expert to manage the CyFIR tool and continue to provide onsite support through May 1, 2015.” [Chapter 5: The CyTech Story; Page 125]

CyTech CEO Ben Cotton, a 21-year veteran of the U.S. Army Special Forces, lauded the findings outlined in the report, stating, “We are pleased that the report officially confirms what we have known to be true since the day we deployed the software on OPM’s network – By leveraging CyFIR’s total dynamic visibility (TDV) on the endpoint the CyFIR platform detected the malware in OPM’s network within 12 minutes of installation, and CyFIR was able to provide OPM the technical capabilities to forensically investigate, respond to the breach and perform these activities with an unprecedented speed to resolution (S2R). CyFIR worked exactly as it was supposed to in identifying and locating the cyber threat existent in OPM’s production systems.”

John Irvine, Chief Technology Officer of CyTech Services, added, “This validates the efficacy and efficiency of the CyFIR platform, demonstrating its value to the federal government and any organization where network security is a priority. All government entities should be secure and protected with the most comprehensive data security tools available, especially when our national security is at risk. Our concern now is that the large number of government departments and agencies that are connected to the OPM network may have also been compromised and should now be evaluated.

CyFIR’s rapid threat assessment module was designed and built specifically for this type of analysis at the speed and breadth necessary to identify and contain the problem quickly. The technology can rapidly scan all running processes on individual computers and at the enterprise level, dramatically shortening the time it takes to discover, investigate, and remediate a breach through its unique distributed architecture. CyTech remains committed to providing one of the most comprehensive forensic investigation and incident response tools on the market and protecting the privacy and security of trusted information.”

(68)

Share