NCSC issues advice on cyber adversary simulation

The National Cyber Security Centre (NCSC) has released guidance on cyber adversary simulation, in the run-up to its launch of a new assured Cyber Adversary Simulation (CyAS) scheme.

Also known as red teaming, cyber adversary simulation involves testing an organization's defenses by mimicking the actions an adversary is likely to use in a real attack. This can be carried out by either internal or external teams.

It's not quite the same as penetration testing, as it focuses on the effectiveness of an organization's technical controls and detection, rather than identifying technical vulnerabilities.

The NCSC CyAS scheme will see a number of commercial organizations approved to offer their services, but is still in its early stages, with plans to refine the scheme in light of feedback from partners, buyers and providers.

When it formally launches in November, there should be a range of approved providers – currently, the NCSC said, the quality of services available across the market can vary significantly.

These first documents include the Scheme Standard and the Working Practices Document, detailing what potential providers need to do. They cover everything from how services should be set up and managed to security, ethics and technical competence.

"These documents give an early and transparent view of the standard we will use to assess applicants, including expectations on companies, key role holders, technical delivery and reporting," the NCSC said.

"As a result, buyers will have a transparent and consistent benchmark for assessing providers, helping them make more informed procurement decisions and giving them greater confidence in the quality of NCSC-assured services."

The scheme supports two different approaches to evaluating an organization's ability to detect and respond to a cyber attack, depending upon the attacker's starting location.

A full-spectrum approach starts from outside the network, and evaluates an organization during an end-to-end attack that attempts to breach the perimeter.

Alternatively, an assumed breach approach starts from a point within the customer network and simulates a threat once an attacker has managed to gain an initial foothold.

"For organizations with a mature security posture, assumed breach can provide greater value by bypassing the initial access phase and concentrating on the consequences of a successful compromise, specifically whether an attacker can expand their access beyond the initial point of entry and reach high-value targets," the NCSC advised.

The CyAS scheme is best suited to organizations with a mature understanding of the cyber risks they face – larger firms, or those operating within critical national infrastructure or the UK government.

To make the most of the services on offer, they should have already identified and assessed their risks, and have well-established mitigations and defences and robust network monitoring and detection systems in place.

"A carefully scoped adversary simulation engagement will help organizations understand where their defences are working, where they are not, and what needs to improve," the NCSC said.

"It will also evaluate whether an organization can identify threats early, triage them quickly and appropriately, and escalate where necessary."