RAN0012

Written evidence submitted by NCC Group

Introduction

Following the oral evidence provided by our Global CTO Ollie Whitehouse in November 2022, NCC Group welcomes the opportunity to respond to the Joint Committee on the National Security Strategy’s written call for evidence and to offer our expertise as a UK headquartered, globally-operating cyber security and software resilience business.

NCC Group’s mission is to make the world safer and more secure. We are trusted by more than 14,000 customers worldwide to help protect their operations from ever-changing cyber threats. We support organisations to identify and assess their security risks, and work with them to remediate and manage vulnerabilities to improve their overall resilience, provide real-time detection and response, and have helped build some of the largest and most well-known bug bounty and vulnerability disclosure programs in the tech industry. Our Threat Intelligence capability provides our customers with regular insights into the current threat landscape and the latest victims of ransomware attacks, using software solutions to gather data on ransomware data leaks on the dark web in real time.

To ensure we match the rapidly evolving and complex technological environment, we continually invest in research and development as an intrinsic part of our business model. We have many years’ experience researching ransomware, including the tactics, techniques and procedures (known as “TTPs”) deployed by threat actors such as cybercriminals and nation states, the impact on victims, and the steps that can be taken, and tools that can be deployed, to improve an organisations’ resilience against attacks. As well as publishing a Monthly Threat Pulse[1] and Annual Threat Monitor[2], recent highlights include:

• Our analysis of the Russian-speaking Conti gang’s internal structures and procedures, as revealed in the ‘ContiLeaks’[3];
• Our research into the economics of ransomware negotiations which revealed (among other things) that in two thirds of cases examined, victims were able to negotiate a discount of more than 50%[4];
• The development of a tool that can be used to target parts of a ransomware attack to minimise impact and overall success of operations[5]; and,
• Our assessment of the real-world impact of ransomware on patient-outcomes in the healthcare sector[6].

Through our work and our research, we see the real-world impact ransomware has on its victims and wider supply chain. The ransomware ecosystem is becoming increasingly complex, commoditised, and is penetrating all parts of the UK and global economies. While the UK is a leader on cyber resilience in many regards, there is still much more to be done to protect organisations at scale, and to appropriately safeguard (overseas) suppliers and assure the integrity of the (overseas) supply chains that UK critical infrastructure depends on. It is vital that the Government uses all its levers to prioritise and tackle ransomware, in partnership, and driven by a culture of information sharing and open dialogue, with the private sector. NCC Group is therefore delighted that the Committee is taking the time to review this important issue, and we are keen to continue supporting the inquiry by sharing our expertise and insights from operating at the ‘coalface’ of cyber security.

Principally, we advocate for a national response to ransomware that:

• Establishes the evidence-base needed to make informed decisions on ransomware policies, through the formation of an Office for National Cyber Statistics. While we do not need more data to tell us that ransomware is a pervasive threat, we do need to understand the effectiveness of interventions to tackle ransomware and other cybercrimes and for that we need an accurate picture of the current and future threat landscape;
• Explores the need for an equivalent to universal healthcare in cyberspace, promoting ways of protecting the most vulnerable in society, such as SMEs, including clarifying the role of cyber insurance;
• Does not shy away from the use of proportionate regulatory levers, considering how basic cyber hygiene can be rolled out in the same way health and safety measures are now embedded in the UK economy;
• Uses all the statecraft tools at the UK’s and its partners’ disposals, disrupting criminal networks’ financial flows and ability to spend the fruits of their labour;

• Establishes clear roles and responsibilities of the various public and private sector bodies involved in the nation’s response, with the Home Office providing overall coordination and direction;
• Equips decision-makers with the ‘cyber literacy’ they need to understand the risk of ransomware to their organisation, take responsibility, and prepare proportionally;
• Attracts and trains the workforce we need to defend the UK’s cyberspace; and,
• Ensures the UK’s cyber legislative framework – in particular the Computer Misuse Act 1990 – supports, rather than hinders, the national response.

Below we explore these points in more detail, responding directly to the inquiry’s terms of reference. Unless otherwise stated, the data referenced in this response has been sourced from NCC Group’s Threat Intelligence Team, which gathers data on ransomware ‘leak sites’ on the dark web in real time to provide regular insights into the most recent ransomware victims. By recording this data and classifying the victims by sector[7], we can highlight the sectors that have been targeted and how current ransomware threats compare to previous years and months. Of course, this does not represent the full picture of the ransomware landscape – no single pane of glass that collates all ransomware-related data points currently exists. However, we do believe it serves to provide a good overview of the current landscape and we hope it will assist the Committee in understanding key trends and developments.  

The extent and nature of the ransomware threat (including sources), modes of extortion, and how the threat could evolve in future

At a high-level, our insights show that the UK is the most targeted country outside of the US, with the number of known UK-based ransomware victims in the first 10 months of 2022 already outstripping the total number in 2021[8]. However, it is worth noting that while we are set to see a year-on-year increase in the number of UK victims, the global picture shows a slight decline in the total number of ransomware attacks globally, following a 92.7% rise from 2020 to 2021. This may suggest a levelling off following last year’s surge. That said, ransomware remains an ever-present threat that has evolved significantly, becoming increasingly sophisticated and underpinned by complex business models. In particular, we have observed the following developments:

• A significant increase in the sophisticated, targeted deployment of ransomware against selected high-value targets. This lower volume, higher skill approach is an inversion of the more traditional “Spray and Pray” model – whereby ransomware groups “spray out” as many phishing[9] attempts as possible, casting their net wide. Instead, groups have found that the financial reward is greater when targeting specific, larger enterprises using, for example, targeted phishing attacks against key role holders within an organisation (known as “spear phishing”).
• As groups have sought to find a scalable business model, ransomware has evolved to Ransomware-as-a-Service (RaaS), which can be summarised by three key actors:
• Initial access brokers obtain initial access to organisations’ networks, selling this access to affiliates.
• Ransomware operators, who own the malware source code, distribute it to affiliates after vetting their technical skills and their country of origin. Ransomware operators are also usually responsible for negotiating with victims.
• Affiliates pay to use the malware developed by ransomware operators to target victims, agreeing on a service fee per collected ransom.

As we see the development of the ransomware ecosystem, there are also other actors often involved in ransomware attacks, including data managers, accountants and negotiators. All this adds up to an increasingly complex system with tasks and functionality split across several actors in several geographies. It means that the ransomware attack vector has been opened up to a wider range of criminal actors where previously it was restricted to those with the requisite technical expertise. We also see criminal groups acting more and more like legitimate enterprises, implementing recruitment programmes and establishing HR functions (for example) with coordination around annual leave (as shown through the ContiLeaks[10]).

• During the course of 2021, the modus operandi of groups changed further in some cases, moving away from purely extorting victims by making them pay for the decryption key to unlock files on their networks to the ‘hack and leak’ business models sometimes referred to as ‘double extortion’. This is where a victim’s compromised data can be leaked online or sold to a third party, if the victim does not pay the ransom. Indeed, our analysis showed a 220% increase in the number of double extortion victims from 2020 to 2021.
• We have also seen a rise in Distributed Denial-of-Service (DDoS) extortion attacks, whereby threat actors threaten to disrupt the normal traffic of a targeted system or network unless a ransom is paid. Unlike ransomware, actors performing DDoS extortion attacks do not need to access the company’s systems or network. Instead, the targeted system or network is disrupted by overwhelming it, or its surrounding infrastructure, with a flood of internet traffic.

Levels and sources of vulnerability of UK organisations to ransomware, including operators of critical national infrastructure

The extent to which organisations are resilient to ransomware will depend on a complex mix of incentives, governance, operational hygiene, and skills. Nevertheless, the below graph provides an overview of the number of ransomware victims across key sectors of the economy in 2021, based on our analysis, and should provide the Committee with a sense of the most-targeted sectors in the UK. Of note, the industrials sector was the most targeted sector by quite some margin, with consumer cyclicals a notable second. Our analysis for the year to date suggests that we will see similar trends in 2022.

We have also observed the following trends and developments through our work and research:

• In our experience, some of the more mature organisations within the financial services sector (such as larger retail banks) have seen a steady decline in ransomware incidents. As an early victim of cyberattacks, we believe that regulation has driven the widespread implementation of good cyber security practices across established financial firms. The sector provides an excellent case study of how well-formed regulation, combined with industry buy-in, can deliver good security outcomes, demonstrating the critical role that policymakers and regulators must play in building the UK’s cyber resilience. However, it should be noted that the number of victims of double extortion ransom activity has remained constant (albeit low in volume), as our Threat Intelligence analysis has shown that less mature organisations, particularly insurers and investment managers, continue to be targeted successfully.
• The impact of ransomware and other cyberattacks is increasingly seen in the physical world, with safety a concern for some organisations. As thousands of lines of complex code control new and evolving physical functions and systems, such as unmanned air systems, autonomous vehicles and smart cities, cyber security vulnerabilities can be (and are being[11]) exploited to effect change in the real-world. This could result in catastrophic outcomes. The safety risk will, however, differ depending on the application of the system and its kinetic effects, and this should be reflected as part of a proportionate risk management approach.
• Legacy operational technology (OT) is a particular issue in industrial sectors. The digital transformation of industries like energy and manufacturing is seeing OT assets, never designed with smart functionality in mind, overlayed with IT and hyper connectivity. Unlike IT, OT assets are usually designed to remain in operation for decades, and, as a result, OT systems are much more likely to include components that are 20 to 30 years old and/or use older software that is less secure and no longer supported. Integrating these legacy assets – which operators are eager to sweat and thus reluctant to replace – with modern security solutions can be very difficult. To address these challenges policymakers should take steps to identify legacy technologies where the risk cannot be reduced to acceptable levels by built-on controls (for example, physical security) and agree with industry a timeline for phasing out these outdated technologies.
• While we have seen ransomware actors target larger organisations in search of a higher financial reward, that does not mean that smaller organisations are any less vulnerable. In fact, their lack of skills, knowledge and resource to invest in cyber resilience measures often means they are among the most vulnerable, and should, in our view, be among the Government’s priorities for enhanced protections.

The UK victim experience, including sources of support for prevention, detection and recovery, public-private partnerships, the role of the media, access to and availability of insurance cover, and regulatory requirements placed on ransomware victims

The experience of victims varies significantly depending on who they are. A FTSE100 operator of critical national infrastructure, who is subject to incident reporting requirements and has access to the resources necessary to enact an effective response to an incident, will have a very different experience to a small business. Indeed, the impact of an incident on smaller organisations like SMEs and charities may be disproportionately large and an existential threat, with cyber hygiene across these organisations remaining poor. While we have not yet observed a notable movement toward small organisations being a key target of ransomware attackers, there remains a question as to how small organisations can and should be protected against rising cyberattacks.

Insurance can provide support, increasing resilience while transferring risk. However, this will depend on the type and scope of the policy taken out and whether the organisation in question has been the victim of a cyberattack in the past. Indeed, we have observed rising costs and a tightening of cyber insurance policies over recent months, with some providers no longer covering state-sponsored attacks[12]. In reality, attribution is rarely straightforward, and it can be difficult to ascertain whether a threat actor is linked to a nation state. Therefore, the impact of this policy change could see insurance pay outs shrink significantly. More broadly, cyber security risk remains a very difficult thing to insure. In our experience, there remains a notable gap in the data required for insurers to assess the scale of the threat to organisations and thus the risk involved. As we explore in more detail below, we believe that there is a role for Government to play in helping bridge this information gap, by collating, assessing and distributing more data on the state of UK-wide cyber resilience.

As the Committee point to, public-private partnerships are a critical part of the UK’s “whole of society” approach to tackling cybercrime and enhancing cyber resilience. In particular, the UK’s cyber industry is working closely with law enforcement, the public sector, academia and other private firms to ensure the UK remains confident, capable and resilient in this fast-moving digital world. Vulnerability researchers, for example, identify security vulnerabilities in products, software and services, and work with manufacturers and vendors to fix them before they can be exploited by malicious actors, such as initial access brokers, for nefarious purposes. Meanwhile, threat intelligence researchers detect cyberattacks and gain insight into attackers and victims. Researchers then work with and pass on this important information to law enforcement and intelligence agencies, enabling them to defend the UK against rising cybercrime and geo-political threat actors. However, the current legal framework, specifically the Computer Misuse Act 1990, is holding back a large proportion of cyber security researchers from doing all they can to protect the UK. This is because the Act, which was written over 30 years ago, blanketly prohibits all forms of unauthorised access to computer material, irrespective of intent or motive. NCC Group has long been a strong advocate for reform of the Act, which we believe, if done correctly, will greatly strengthen researchers’ ability to fight the scourge of ransomware and other cybercrime, supporting national cyber resilience, driving growth and helping to cement the UK as a global cyber power. The Home Office carried out a review of the Act last year, and we are expecting a response imminently. In the meantime, we would be grateful for anything the Committee could do to make the case for a 21st century Act that reflects modern cyber security practices. 

The effectiveness of the response to ransomware by Government, law enforcement agencies and other UK state actors, including key operational challenges and ministerial oversight

The UK Government is, in many regards, world-leading in its approach to tackling ransomware. The UK’s National Cyber Security Centre (NCSC), for example, is, in our experience, the envy of the world, providing free cyber security tools and services and excellent technical advice for businesses and organisations looking to improve their cyber resilience. Recognising that cyber skills are in great demand, NCSC also works extremely well with the private sector to deliver a genuinely whole-of-society response. Meanwhile, the National Cyber Crime Unit (NCCU) provides national leadership and coordination of response to significant cyberattacks, while the Government is also developing the UK’s offensive response with the National Cyber Force.

That said, there is some work to be done to ensure that victims and the cyber ecosystem understand who and at what level they should reach out to when seeking different forms of support. We believe that a clear overview of the roles and responsibilities that local, regional, national and supranational actors play in the UK’s response to ransomware, across the prevent, protect, detect, disrupt and deter functions[13], would help in this regard. Further, with access to skills and resources a core challenge for actors within the cyber ecosystem, clarity of responsibility and a push to more closely collaborate across entities would be beneficial. For example, while the Local Cyber Crime Units (LCCUs) embedded in England and Wales’s 43 police forces play an incredibly important role supporting victims at a local level, we must be realistic that many do not have the skills nor resources needed to provide a full-scale service. We therefore believe that the NCCU should be bolstered and used as a central resource hub which LCCUs can more easily access when dealing with local cybercrime such as ransomware attacks.

Reforms that might enhance the UK’s resilience to ransomware, reduce the economic and societal damage that it causes, and/or support the law enforcement response

Unfortunately, there is no silver bullet solution. Ransomware is a complex, ever-evolving problem that requires a complex, ever-evolving response. We do, nevertheless, believe that there are a number of measures that should be prioritised as part of the nation’s response.

A foundational building block will be a reliable, extensive dataset on the cyber threats facing the UK (and our allies). While data on cyber incidents does exist, and we do not need more data to tell us that ransomware is a pervasive threat, there is currently no centrally coordinated effort to bring these metrics together to build a full picture of the cyber threat landscape. A fuller centralised data set would allow the Government to prioritise threats, allocate resources to policy efforts, and measure the success of those efforts. As US National Cyber Director Chris Inglis recently commented[14] when speaking about similar considerations in the US, “to properly address risk, we have to first understand it, we have to understand where it's concentrated, where it cascades, what causes it, and more importantly to then discover how to address it.” We therefore propose establishing an Office for National Cyber Statistics that anonymises, collates and disseminates incident data from existing sources (for example, Action Fraud incident response data, public sector threat information which – in future – is set to be automated and enhanced right across Government, and incidents reported by critical national infrastructure under the NIS regulations) and new sources (for example, working with the cyber threat intelligence and incident response community to more systematically share incident response information). 

In support of this initiative, the Government should consider how it can use ‘carrots’, as well as ‘sticks’ to encourage greater incident reporting. In our experience, organisations are often reticent to report incidents through fear of the reputational and regulatory repercussions. This culture of fear needs to change to one where organisations are encouraged and actively rewarded for their transparency. Only then can we gain a full picture of the threat landscape.

Through our work, we see how frequently attackers exploit poor security practices to gain a foot in the door that results in a ransomware attack. There are, however, a number of low effort, high reward ‘secure by design’ steps that can, and should, be taken by organisations that would hamper much of the initial access activity we see. If, for example, NCSC’s Cyber Essentials[15] were adopted across the economy, this would greatly increase resilience to ransomware and other attacks. This could be akin to the UK’s health and safety regulations, ensuring all businesses do the low effort, high reward basics to create a higher level of protection for everyone. To that end, we welcome the UK Government’s exploration[16] of the steps that could be taken by providers of online services and accounts to better protect users, including SMEs, from cybercrimes committed by actors with a relatively low level of technical sophistication. There is also a question as to whether proportional ransomware insurance cover should be mandated (for example, like car or buildings insurance). As we have set out above, there are challenges with the cyber insurance market that will need be worked through before such a measure could be explored. Nevertheless, we do believe that insurance will form part of the future solution and enable some degree of protection to be rolled out at-scale.

In higher-risk sectors, where the impact of a ransomware attack would be greater (for example, for critical national infrastructure), we believe there is a need for more widespread adoption of realistic, intelligence-driven cyber security assurance testing. The value of such testing has been clearly demonstrated by the CBEST scheme[17] led by the Bank of England for the financial sector, and adopted by the telecoms, civil nuclear and government sectors. The schemes allow the participants, regulators, NCSC and the Government to understand the cyber risks and resilience issues and respond to the needs of the sector. They are intelligence-led, so the ethical attack teams replicate the tactics, techniques and procedures of known threat actors. Organisations learn what and how attacks could have an impact; assess their ability to detect and respond; and measure the return of their investment and training in improving their cyber resilience. Meanwhile, regulators gain important insight as to the actual real-world resilience and risk to their sector, which could be fed back – on an anonymised basis – to the centrally coordinated Office for National Cyber Statistics we proposed above, to help build a (more authoritative) nationwide picture of the threat.

Further, we believe the Government should prioritise assuring the integrity of the UK’s critical supply chains, ensuring that if key suppliers, particularly where they are based outside the UK, (for example, major cloud providers) were to be the victims of a ransomware attack then the impact across the economy would be minimised. To that end, we support the UK Government’s plans to expand NIS regulations for digital service providers[18]. We also advocate ‘Resilience by Design’, a two-fold approach to mitigating the associated risks that includes:

• Prevention of supply chain failure through cyber resilience solutions; and,
• Mitigation of the risk and impact of supply chain failure, by mandating the use of cloud, software and technology escrow solutions. Indeed, the US Cybersecurity and Infrastructure Security Agency’s (CISA) guidance on ransomware[19] states that, in being prepared for a ransomware incident, organisations should ensure the availability of the source code that underpins critical systems through backups or escrow agreements. We have seen similar regulatory provisions[20] adopted in the financial services sector.

Use of regulatory levers aside, there is much more that could be done to improve understanding of cyber security concepts across organisations of all sizes and at all levels of seniority, so that decision-makers can make informed decisions about their cyber resilience proportionate to the risks they face. We need a step change to demystify cyber and embed awareness and incentives into everyday conversations, to make it an integral part of our national psyche. At the heart of this should be the concept of ‘pervasive cyber literacy’ - a basic level of cyber competence across all levels of society, age groups and professions to allow everyone to use technology securely. This could involve:

• The deployment of behavioural insights experts to shift user behaviour so that device security updates and other basic measures are further embedded in the nation’s psyche as standard practice.
• A renewed focus on the people element of cyber security, developing human cyber risk skills and their interactions with technology or human factors.
• Commissioning ‘Cyber Beebies’, keeping with the concept of CBeebies to “help pre-schoolers learn while they play fun games, watch clips, sing songs and make things”, to start cyber education and awareness in the earliest years.
• Including cyber competence, covering safe and secure online behaviours, privacy, and use of technology alongside broader technology and computing lessons, as a mandatory part of the school curriculum which should be reviewed and tested with an industry advisory board on a regular basis to ensure it keeps pace with technological developments and industry requirements. Teachers must also be regularly supported to understand new developments and how they should be reflected in the school curriculum. To this end, we note, and welcome, Ofsted’s review of computing education, and hope our recommendations are reflected.
• Applying the lessons of a safety-first culture to the cyber challenge across all domains by requiring mandatory basic cyber security training as part of individuals’ induction upon their entry into the workforce.

As well as establishing a base-level of digital and cyber literacy across society, we also need to train and attract a skilled cyber workforce who can defend the UK online. However, there remains a significant skills shortage, and much more needs to be done to encourage talent into the profession, particularly those from diverse and underrepresented backgrounds. This should include: 

• Greater flexibility in the use of the apprentice levy to upskill or train career ‘transitioners’ through non-traditional apprenticeships. 
• Efforts to make cyber security attractive for all, committing explicitly to measure trends in the proportion of candidates coming into the cyber profession from non-traditional backgrounds or at different and varying points in their adult lives.  
• The creation of a national institute for secondary and integrated further education, targeted at exceptionally gifted cyber security students, to build up a cadre of excellence, and a deployable elite in multi-disciplinary cyber domain matters. The Government could also consider introducing an assessment for all secondary school children to assess their suitability for a career in cyber security.

The scope for international cooperation to combat the global ransomware threat more effectively, including on crypto-currency regulation

When it comes to tackling ransomware and other cybercrime, no country is an island. As set out above, the criminal landscape is complex, involves many actors and the complicit involvement of nation states, with cyberattacks very rarely originating from the UK alone. In addition, even if the UK was impervious to ransomware, overseas suppliers – many of whom are critical to the functioning of the UK economy and critical national infrastructure – may not be. Close international cooperation is therefore critical and should be front and centre of UK policymakers’ minds when developing the UK’s approach to ransomware. Specifically, we recommend that the Government:

• Utilises existing successful partnerships, including the ‘Five Eyes’ alliance and the US-led International Counter Ransomware Initiative (CRI), strengthening global cooperation and coordination against ransomware gangs;
• Invests time in developing practical outcomes with other governments, that go deeper than high-level principles;
• Ensures that civil society and industry - who will play a central role in delivering governments’ objectives - are involved in discussions from the outset; and,
• Works with partners to disrupt financial flows of, and disincentivise, ransomware actors, including through greater regulation of crypto exchanges, use of individual indictments and red notices, and enhanced coordination across borders.

Lessons that could be learned from other countries’ approaches and responses to ransomware

The UK is comparatively mature in its approach to ransomware and cyber resilience. Nevertheless, the UK could draw on the US Federal Government’s full statecraft approach to ransomware, using all statecraft tools at our and our partners’ disposals to disincentivise nation state threat actors at scale.

15 December 2022