Resilience and APT Threats Loom Large

A rash of cyber incidents felt by British businesses add up to a wake-up call that cybersecurity is an absolute priority, top government officials warned during an annual conference hosted by the National Cyber Security Centre.

See Also: Essential Elements to Consider when Choosing a Micro-Segmentation Solution

Attacks against Marks and Spencer, Co-op and Harrods sprung in short order against the High Street mainstays illustrate a need to “bolster our national defenses,” said Minister for Intergovernmental Relations Pat McFadden, who, along with NCSC CEO Richard Horne, warned about the increasing threats to the British critical infrastructure from nation states and cybercrime groups (see: Hacks of UK Retailers Are a ‘Wake-Up Call,’ Minister Says).

Horne said the United Kingdom has recorded over 200 incidents since September 2024. Both McFadden and Horne stressed on threats posed by Chinese nation state hackers. Economic disengagement from China was impossible but the government should engage in constructive dialogues with the country to “robustly defend” the sovereign cybersecurity, McFadden said.

Horne said China continued to pose a continuous threat. “The continued activity that we’re seeing come from the Chinese system remains a cause for profound and profuse concern,” he said.

The U.K. government has touted proposed legislation, stating it will soon introduce the Cybersecurity and Resilience Bill as a means to bolster cyber defense (see: UK Government Previews Cybersecurity Legislation)./p>

The bill, the equivalent of the European Union’s Network and Information Security Directive or NIS2, imposes measures such as mandatory patching and incident reporting.

“We’ve seen some fairly significant events over the last couple of years, and clearly there’s a need to make sure that U.K. defense is really strong, and this bill is one of a number of measures that will help to achieve that. It is a good step in the right direction, and it will, as I say, it will drive up standards,” Ian Hulme, director of regulatory affairs at the Information Commissioner’s Office told Information Security Media Group.

The NCSC unveiled a number of cyber resilience measures timed for the conference. Among them are plans to switch from SMS-based verification to passkeys to access government services later this year, and the launch of a voluntary code of practice for technology providers.

“The code marks the first step in establishing clear expectations for a market baseline with regards to cybersecurity. It signals – to both software vendors and their customers -what can reasonably be expected,” NCSC officials Ollie Whitehouse and Rod Latham said.

Additionally, the NCSC will also launch new testing centers that allow technology vendors to test the resilience of their products against cyberattacks.