Cybersecurity protects systems, networks, programs, and data from digital attacks. Increasingly material risk for all organisations.

Cyber risk landscape:

Cyber attacks GROWING in frequency and sophistication
UK Cyber Security Breaches Survey 2024: 50% of UK businesses identified breaches/attacks in last year
Average cost of breach for medium/large UK business: tens of thousands to millions
Indirect costs (reputation, downtime, customers) often larger than direct
State-sponsored actors increasingly active
Ransomware emerged as major threat 2010s+

Common attack types:

1. Ransomware:

2. Phishing:

Fake emails/messages tricking users into revealing credentials or clicking malicious links
Spear phishing (targeted), whaling (executives)
Most common entry vector for attacks
AI-enhanced (more convincing)

3. Supply chain attacks:

4. Social engineering:

5. Insider threat:

6. DDoS (Distributed Denial of Service):

7. Zero-day exploits:

Cybersecurity frameworks:

NIST Cybersecurity Framework (CSF):

ISO/IEC 27001:

International standard for Information Security Management Systems (ISMS)
Certifiable; widely adopted
Risk-based approach
Annex A: 93 controls (in 2022 version) covering organisational, people, physical, technological controls
Common requirement for B2B contracts, regulators

CIS Controls (Center for Internet Security):

UK NCSC (National Cyber Security Centre):

Part of GCHQ; UK's authority on cybersecurity
Cyber Essentials scheme:
- Cyber Essentials (basic — self-assessment)
- Cyber Essentials Plus (independent assessment)
- Mandatory for some UK government contracts
Active threat intelligence; guidance; incident support
10 Steps to Cyber Security framework

Defence-in-depth principle:

Zero Trust architecture:

Identity and Access Management (IAM):

Incident response:

Notification requirements:

UK GDPR/DPA 2018: data breaches notified to ICO within 72 hours of awareness (if risk to individuals)
Affected individuals notified if HIGH risk
UK financial services: FCA/PRA notification
NIS Regulations 2018 (operators of essential services, digital service providers)
Telecoms Security Act 2021

Cyber insurance:

Insurance for cyber-related losses
Coverage: incident response, business interruption, ransom payments, data restoration, third-party liability
Premiums rising; coverage tightening; ransomware coverage controversial
Underwriters increasingly require security baseline

Major incidents — lessons:

Colonial Pipeline (May 2021):

Ransomware shut down major US fuel pipeline (5 days)
Significant fuel shortages on US East Coast
Paid $4.4m ransom (most recovered by FBI)
Lessons: legacy systems vulnerable; OT/IT separation; ransomware critical infrastructure threat

SolarWinds (December 2020):

MOVEit (May 2023):

Vulnerability in MOVEit file transfer software
Exploited by Cl0p ransomware group
Hundreds of organisations breached including BBC, British Airways, Boots, Aer Lingus
Mass data exfiltration
Lessons: third-party software risk; rapid patching; incident transparency

Cybersecurity strategy elements:

Strategic Business Management