These notes accompany the short video lecture giving an overview of cybersecurity in the UK from the viewpoint of organisations (involved), careers, frameworks and standards. Watch the video for more remarks.
There are inevitably more organisations, courses, standards, etc. that we could include here. I am focussing on the ones that I see as particularly relevant or noteworthy in my day-to-day practice. In general, presence or absence on this list is not an endorsement or otherwise….
Declaration of interest: I am a member of two of the bodies mentioned below (BCS and CIISec). This project was funded by RAEng.
Links all last checked July 2022.
British Computer Society (BCS), “The Chartered Institute for IT” — “broad church” body offering a range of professional accreditation, plus various qualifications / certifications
Chartered Institute of Information Security (CIISec) — formerly the Institute of Information Security Professionals (IISP). Specialist infosec body offering professional membership. Of particular note is its Skills Framework
The Institution of Engineering and Technology (IET) — a “multidisciplinary professional engineering institution”, formed from two precursor bodies (IEE and IIE) themselves with a long history
Engineering Council (EngC) — “The Engineering Council is the UK regulatory body for the engineering profession. We hold the national registers of over 229,000 Engineering Technicians (EngTech), Incorporated Engineers (IEng), Chartered Engineers (CEng) and Information and Communications Technology Technicians (ICTTech).” Importantly, BCS and IET are two of the PEIs or licensed member institutions
Royal Academy of Engineering (RAEng) — “a charity delivering public benefit, a National Academy providing progressive leadership, and a Fellowship bringing together an unrivalled community of leaders from every part of engineering and technology”
Association of Computing Machinery (ACM) — US-based learned society for computing, with world-wide reach
Institute of Electrical and Electronics Engineers (IEEE) — US-based professional association, with world-wide reach
The National Cyber Security Centre (NCSC), part of Government Communications Headquarters (GCHQ) — a successor to the Communications-Electronic Security Group (CESG) (will still see “CESG” on various documents and standards from time-to-time!), and incorporates some other national elements.
The UK government produces a range of materials on cyber security. Of particular note is the [National Cyber Strategy] (https://www.gov.uk/government/publications/uk-national-cyber-strategy-2022). Part of the government’s work include a January 2022 consultation on “Embedding standards and pathways across the cyber profession by 2025”. This relates to UKCSC (next item!)…
The UK Cyber Security Council UKCSC — claims to be a “voice for the cyber security profession”
Information Commissioner’s Office (ICO)
Cyber Essentials — one of the most useful schemes for organisations. Promotes a good standard of security hygiene and is effectively essential if wanting to sell products or services into the public sector
Cyber Essentials Plus — adds a technical audit to the Cyber Essentials scheme
ISO/IEC 27000-series aka ISO27k — a set of standards published by the International Organization for Standardization
The US National Institute of Standards and Technology (NIST) has a Computer Security Resource Center
European Union Agency for Cybersecurity (ENISA) — some excellent resources relating to data protection and technical controls
(ISC2) is one of many organisations providing certifications. Of particular interest for educators is Cybersecurity principles and learning outcomes for computer science and IT-related degrees. Although dating from 2015, the five core themes in this CPHC/(ISC)2 paper
provide a solid baseline for generalist ICT students
UK academics will (should!) be award of the QAA subject benchmark statement on computing specifically mentions security both within the threshold for a bachelor’s honours degree as well as referring to it as a specific discipline
Cyber Security Body of Knowledge (CyBok) — currently version 1.1 covering 21 knowledge areas — detailed
Vendor-specific — vendors, such as Microsoft, Cisco and Amazon (AWS), provide (or license) training courses and certification. The value of these varies widely, with much depending on your actual practice
Generalist ICT / computing — you need a solid understanding of general information security, particularly risks and when to call on an expert. The CPHC/(ISC)2 paper above is a good baseline, along with an awareness of the ICO’s resources (e.g., when should a project be referred to data protection / information security specialists?)
Specialist infosec / cybersecurity…