Advancing UK Aerospace, Defence, Security & Space Solutions Worldwide
  • Home
  • /
  • Security
  • /
  • NCSC marks 20th anniversary of first response to state-sponsored cyber attack

Security

NCSC marks 20th anniversary of first response to state-sponsored cyber attack

The National Cyber Security Centre (NCSC) has marked the 20th anniversary of GCHQ’s first response to a cyber attack perpetrated against the UK Government by another state, with the response acting as the forerunner to a capability that became the National Cyber Security Centre, a part of GCHQ.

Above: The National Cyber Security Centre (NCSC), Nova South, London.
Image by Simone Flamigni / copyright Shutterstock

In June 2003, GCHQ experts were involved in responding to a cyber attack against the UK Government for the first time. Unlike today, in 2003 there was no government agency set up to deal with cyber attacks, nor was there a dedicated national incident management function. This all changed in 2016 with the establishment of the National Cyber Security Centre (NCSC), a part of GCHQ.

Advertisement
ODU RT

The NCSC can reveal that in June 2003 cyber experts were called upon to investigate after a government employee detected suspicious activity on one of their workstations.

A suspected phishing email had been identified, so technical specialists sought help from the Communications-Electronics Security Group (CESG) – the information assurance arm of GCHQ at that time.

CESG’s analysis discovered that malware, designed to steal sensitive data and evade anti-virus products, had been installed, raising suspicions about the attacker’s intent and setting in motion a series of actions that was transformative to cyber incident investigations.

For the first time, GCHQ fused its signals intelligence capabilities with its cyber security function to investigate and identify the actor responsible.

The ground-breaking analysis, coupled with international engagement, led CESG to conclude the intent of the attack had been cyber espionage by a nation state, setting in train a mission that today is at the heart of NCSC operations; namely, understanding and responding to cyber threats to the UK.

Paul Chichester, Director of Operations at the National Cyber Security Centre, said: “Twenty years ago, we were just crossing the threshold of the cyber attack arena, and this incident marked the first time that GCHQ was involved in a response to an incident affecting the UK Government.

Advertisement
ODU RT

“It was also the first time that the UK and Europe started to understand the potential online risks we faced and our response transformed how we investigate and defend against such attacks.

“The NCSC and our allies have come such a long way since this incident, and it is reassuring to be at the forefront of efforts to develop tools and techniques to defend against cyber threats and keep our respective nations safe online.”

The National Cyber Security Centre, a part of GCHQ, was set up in October 2016 to help keep the UK safe online. It combined existing expertise from CESG, the Centre for Cyber Assessment, CERT-UK and the Centre for Protection of National Infrastructure (now the National Protective Security Authority).

The NCSC responds to cyber security incidents to help reduce the harm they cause to organisations and the wider UK, as well as working with other law enforcement, defence, the UK’s intelligence and security agencies and international partners.

 

Advertisement
Roke Roke
Marshall approved by CAA as RAE(F) for UAS

Aerospace Security

Marshall approved by CAA as RAE(F) for UAS

30 April 2025

Marshall has been approved by the UK’s Civil Aviation Authority (CAA) as a Recognised Assessment Entity for Flightworthiness (RAE[F]) of Unmanned Aircraft Systems (UAS).

Axon introduces new products and partnerships

Security

Axon introduces new products and partnerships

24 April 2025

Axon has introduced a number of new products and partnerships, expanding its real-time network and public safety ecosystem.

Heathrow Airport extends partnership with Safe365

Aerospace Security

Heathrow Airport extends partnership with Safe365

23 April 2025

Heathrow Airport has renewed its commitment to workplace and passenger safety by extending its partnership with Safe365 - a New Zealand-based safety technology company - for a further three years, which was witnessed in a ceremony attended by New Zealand Prime Minister Christopher Luxon.

Independent review turns to tackling Britain’s biggest crime

Security

Independent review turns to tackling Britain’s biggest crime

23 April 2025

Better protections for the British public against fraud, and tougher enforcement against the perpetrators, will be the goals of the first independent review carried out in 40 years into the UK’s fraud laws.

Advertisement
ODU RT
Unifi secures Oxford Airport ground handling and security contracts

Aerospace Security

Unifi secures Oxford Airport ground handling and security contracts

17 April 2025

Unifi has secured its first business aviation ground handling contract and its third Fixed Base Operation/FBO security contract in the UK at London Oxford Airport, marking a major expansion of its services and a new milestone in its global growth.

M Group acquires Telent

Defence Security

M Group acquires Telent

16 April 2025

M Group has aquired Telent, a provider of operational technology and digital solutions for Critical National Infrastructure (CNI) across the UK and Ireland.

Advertisement
DSEI 2025