The four measures include protected DNS and anti-spoofing technology

The National Cyber Security Centre (NCSC) has created four “simple and free measures” that public sector bodies can implement to immediately become safer online. The body is also hoping that, in time, UK businesses will also be able to adopt the initiatives.

In the NCSC’s own self-described lay person’s terms, the four measures comprise: blocking bad stuff from being accessed from government systems; blocking bad emails pretending to be from government; helping public bodies fix bad things on their website; and removing bad things from the internet.

In the former case, the centre – which is part of GCHQ – has created a Domain Name Service (DNS), which it characterises as “the phonebook of the internet”. The service will collate data from GCHQ and its partner organisations in the private sector to maintain a register of malicious addresses, which civil servants will be prevented from visiting. Departments can register for the service here [1]. 

Related content

• Cabinet Office announces first Scottish cyber security research centre of excellence [2]
• Government cyber security survey shows concern over ransomware [3]
• Cyber attacks bolder and more aggressive than ever [4]before, [4] says cybersecurity centre [4]

The second of the four initiatives relates to the DMARC anti-spoofing protocol, which is designed to confirm the authenticity of an organisation’s communications.  The protocol, which aims to make email spoofing much more difficult, was trialled by HMRC last year. During the pilot, the department – which NCSC said is “the UK’s single most spoofed brand” – blocked 300 million malevolent emails. 

Alongside the protocol, the NCSC has created a Mail Check service to track adoption of DMARC, ensure that data on malicious communications is shared with NCSC as well as any relevant commercial partners, and analyse trends. Some 613 government domains were using DMARC as of the end of March. The permanent secretaries of any departments yet to roll out either DMARC or Mail Check will be contacted by the centre shortly with information on their department’s uptake, and where they are placed “in the league table of adopters”. To implement the service departments can email dmarc@ncsc.gov.uk [5].

To help “public bodies fix bad things on their website”, the NCSC is offering a free website scanning offering called WebCheck. The service will scan bodies’ sites and provide feedback on vulnerabilities and advice on mitigating cybersecurity risks. 

WebCheck is due for formal launch later this month, following the completion of an ongoing trial involving 150 users drawn from 114 different organisations covering the breadth of the public sector. This scheme is primarily aimed at the local government space, but central government entities are also free to sign up. Users can find out how to join by registering here [6] and quoting the reference wbchk04/7.

The final measure is intended to remove “bad things from the internet”. This initiative has seen NCSC team up with Bath-based anti-phishing and research specialist Netcraft. The company’s services have already been deployed across central government, but departments are encouraged to improve the service by notifying Netcraft if they are targeted by a phishing campaign. To do so, they should send any relevant emails and other attachments to scam@netcraft.com [7].