NCSC puts critical infrastructure to the test with new assessment scheme

The UK’s National Cyber Security Centre (NCSC) has announced a new scheme that will match critical infrastructure providers and public sector organizations with accredited partners for security wargaming exercises.

The new Cyber Adversary Simulation (CyAS) initiative will allow organizations to access a database of approved providers for ‘red teaming’ exercises.

“You cannot improve what you do not know,” said NCSC CTO Ollie Whitehouse. “That is why I am delighted to see the launch of the Cyber Adversary Simulation scheme.”

“By enabling rigorous, realistic end to end assessments by the very best adversary simulation experts, CyAS will help organisations build a clearer picture of how they would stand up to genuine cyber attacks and take action to strengthen their security and resilience.”

Red-teaming is a detailed procedure which puts an organization’s security policy to the test by replicating the tactics employed by sophisticated threat groups, including nation-state actors and organized crime rings.

As part of these exercises, the simulated attackers may employ methods such as target reconnaissance, custom exploit creation, or blending physical and digital intrusion.

How the CyAS scheme works

The procedure for the CyAS scheme includes a pre-engagement scoping meeting to set out terms (including any business impacts which must be avoided), as well as clean-up efforts to repair any security holes created or discovered during the test.

It will also include a post-exercise report to support remediation. Clients have the ability to pause or stop the test at any time, the NCSC revealed.

Andrew Costis, engineering manager of the Adversary Research Team at cybersecurity firm AttackIQ, said the scheme could prove vital in bolstering cyber resilience for critical infrastructure and public sector organizations.

“The value with this program comes from being able to test how an attacker could reach the systems that keep essential services running,” Costis commented. “Building each simulation around an organization’s actual exposure should uncover weaknesses that a generic assessment might miss. Looking back, that approach could have exposed gaps in detection or containment before an intrusion became a prolonged outage.”

“The longer-term opportunity is turning those findings into an ongoing practice through adversarial exposure validation. After fixing a weakness, teams need to repeat relevant attack behaviours to check whether the fix holds,” he added.

“They’ll also need to adapt those tests as their environments change. An assured provider gives organizations confidence in the assessment’s quality. Keeping those lessons current will determine how much resilience the scheme delivers.”

Under the terms of the scheme, providers must use a UK-based testing team for engagements, with any attack infrastructure hosted in the UK “wherever reasonably possible”. They must also register every engagement with the NCSC in advance.

The program is designed to complement existing NCSC frameworks such as the Cyber Assessment Framework (CAF) and Cyber Resilience Audit (CRA) scheme, and is also intended to help industry regulators, watchdogs, and government departments establish and verify cyber resilience across their specific sectors.

“Moving beyond traditional pen testing and auditing of controls, the CyAS service enables organizations to practically test their cyber defences,” said NCSC Deputy Director Chris Ensor, “ensuring they are able to protect, detect and respond to cyber attacks.”

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.