The UK’s National Cyber Security Centre (NCSC) has shared details of an ongoing coordinated plan to improve cyber resilience in the National Health Service (NHS).
Over the past 18 months, government and industry organizations have deepened their collaboration to reduce cyber risk and improve detection, the agency said in a blog post published on 17 April.
It pointed to several pillars underpinning this strategy:
Nicholas W. of the NCSC’s National Resilience Directorate explained how the government’s Software Security Code of Practice is already being used by the NHS in procurement to better understand the cyber maturity of suppliers.
The NCSC has also partnered with a healthcare organization, using data science tools to help it understand and prioritize supplier risk. There are plans to expand this initiative, by combining data such as incident history, alert and vulnerability activity from the NCSC Early Warning service with technical indicators including remediation patterns and exposed attack surfaces.
The NCSC highlighted how it has helped NHS England, the NHS Business Services Authority and NHS Scotland to establish internal vulnerability disclosure processes. This is in addition to its own Vulnerability Reporting Service (VRS), which has supported GP surgeries, NHS trusts, ambulance services, acute hospital trusts and health boards since 2019.
Other efforts include:
The need for resilience building in the UK’s healthcare sector is much needed, given historic incidents.
The WannaCry campaign in 2017 cost the health service an estimated £92m ($118.6m), while a more recent ransomware attack on supplier Synnovis in 2024 led to the cancellation of 1500 operations and appointments and has been linked to the death of a patient.
The NHS was also rocked by a 2022 ransomware attack which struck IT partner Advanced Computer Software Group. That resulted in the theft of data on tens of thousands of individuals and major disruption to patient referrals, out-of-hours appointment bookings, emergency prescriptions and ambulance dispatches.
The key to the NCSC-driven plan for boosting resilience is collaboration across multiple industry and government stakeholders, said Nicholas W.
“Taken together, this work shows what is possible when organizations align around a shared goal. Effort is coordinated rather than duplicated, lessons are reused, and risk is reduced across the system, not just within individual organizations,” he concluded.
“Most importantly, this approach offers a model for other critical sectors. Cybersecurity challenges are too complex for any one organization to tackle alone.”
The UK’s National Cyber Security Centre (NCSC) has shared details of an ongoing coordinated plan to improve cyber resilience in the NHS.
Over the past 18 months, government and industry organizations have deepened their collaboration to reduce cyber risk and improve detection, the agency said in a blog post on Friday.
It pointed to several pillars underpinning this strategy:
“Nicholas W” of the NCSC’s National Resilience Directorate explained how the government’s Software Security Code of Practice is already being used by the NHS in procurement to better understand the cyber maturity of suppliers.
The NCSC has also partnered with a healthcare organization, using data science tools to help it understand and prioritize supplier risk. There are plans to expand this initiative, by combining data such as incident history, alert and vulnerability activity from the NCSC Early Warning service with technical indicators including remediation patterns and exposed attack surfaces.
The NCSC highlighted how it has helped NHS England, the NHS Business Services Authority and NHS Scotland to establish internal vulnerability disclosure processes. This is in addition to its own Vulnerability Reporting Service (VRS), which has supported GP surgeries, NHS trusts, ambulance services, acute hospital trusts and health boards since 2019.
Other efforts include:
The need for resilience building in the UK’s healthcare sector is much needed, given historic incidents.
The WannaCry campaign in 2017 cost the health service an estimated £92m, while a more recent ransomware attack on supplier Synnovis in 2024 led to the cancellation of 1500 operations and appointments and has been linked to the death of a patient.
The NHS was also rocked by a 2022 ransomware attack which struck IT partner Advanced Computer Software Group. That resulted in the theft of data on tens of thousands of individuals and major disruption to patient referrals, out-of-hours appointment bookings, emergency prescriptions and ambulance dispatches.
The key to the NCSC-driven plan for boosting resilience is collaboration across multiple industry and government stakeholders, said Nicholas W.
“Taken together, this work shows what is possible when organizations align around a shared goal. Effort is coordinated rather than duplicated, lessons are reused, and risk is reduced across the system, not just within individual organizations,” he concluded.
“Most importantly, this approach offers a model for other critical sectors. Cybersecurity challenges are too complex for any one organization to tackle alone.”
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。