Jonathan Edwards

“Yeah, well Cyber Essentials didn’t help Land Rover, did it?” I agree. As an advocate of the Cyber Essentials scheme since 2014, you might wonder why I agree with such a negative train of thought. Well, that’s easy. It’s not the scheme that’s the problem. It’s the interpretation, scope and lack of progression past a self-assessment. JLR’s scope of certification didn’t cover their whole organisation and they limited what was covered by the questions asked in that self assessment. Remember, the clue with Cyber Essentials is in the name - it is merely the essential technical controls an organisation needs to have in place to stop the most basic attacks. The larger the organisation, the more competent and capable they should be in defending against attacks because they should have a more mature approach to securing their network infrastructure. If JLR couldn’t cover the basics across their whole organisation, that’s a problem. A problem that was compounded by the scope of their IT provider’s certification because their scope specifically rules out customer networks. Two large organisations here, struggling to achieve a minimum standard that only covers the bare essentials. And we wonder how it happened? This is something you can help prevent in your supply chain with two questions. If someone isn’t certified to Cyber Essentials, why aren’t they? If someone IS certified to Cyber Essentials but their scope of certification ISN’T “whole organisation”, what are they hiding? Two simple questions that reveal telling answers. Check your suppliers certificates here: https://lnkd.in/eSbzzhNW

136

67 Comments

#CyberAlert | Foundations for OT cyber security We have joined international partners to release guidance for owners and operators on foundations for operational technology cyber security and asset inventory. Read it here: https://lnkd.in/esEEhNFc

54

3 Comments

A fantastic Cyber Security Breaches Survey 2025: What Schools Need To Know event from Secure Schools this morning! Some real food for thought! 𝐈'𝐥𝐥 𝐥𝐞𝐚𝐯𝐞 𝐬𝐨𝐦𝐞 𝐥𝐢𝐧𝐤𝐬 𝐢𝐧 𝐭𝐡𝐞 𝐜𝐨𝐦𝐦𝐞𝐧𝐭𝐬 The Cyber Security Breaches Survey 2025 has once again made it clear UK schools and colleges are in the firing line. But what’s changing is how we're talking about it. Cyber risks are growing, and yet budget, licensing, and policy decisions are holding back progress, especially when it comes to Multi-Factor Authentication (MFA). No phones, no MFA? Many schools banning phones are finding themselves stuck, especially for student accounts. Alternatives like YubiKeys, QR badges, and Conditional Access exist, but they cost. And even those aren’t bulletproof. Conditional Access ≠ compliance – It’s becoming clear that relying on location-based MFA exemptions won’t cut it for Cyber Essentials for much longer. Attackers don’t wait until you’re offsite. Licences matter Microsoft A3/A5 unlock essential security features like Conditional Access and TAPs. But most schools are stuck on A1, and funding remains a barrier. Not all schools/colleges use the Microsoft platform No silver bullet, YubiKeys can be lost, cloned, or underutilised. SMS isn’t ideal. Training, planning, and layered defences still matter most. The real problem? A lack of central support. There's a strong appetite for DfE or local authority-negotiated tools, bundled at reduced cost. This could lift the burden and improve adoption Free resources do exist, including NCSC's Active Cyber Defence tools and LGfL’s Elevate Toolkit but many schools aren’t aware or supported enough to use them effectively. This conversation shows just how complex cyber security is becoming in education. What’s needed isn’t just awareness, but leadership, funding, and practical support at every level from classrooms to governors. Full survey: https://lnkd.in/eYTB-Gvt Tools mentioned: https://lnkd.in/ekVa89R3 | https://lnkd.in/esjJ_Wdf #CyberSecurity #EdTech #CyberEssentials #Microsoft365 #EducationSecurity #MFA #UKSchools #DigitalStrategy

28

5 Comments

Thanks National Cyber Security Centre for two very informative days on all things cyber with #cyberuk25 My key takeaways: - passkeys. If you’re a Sibrossa Ltd client, we’ll be discussing. If you’re a supplier we’re working with, we’ll be asking questions! 🔑 - collaboration. The cyber community needs to be better at talking to each other and sharing knowledge 🤝 - the Cyber Security and Resilience Bill is coming! Whilst it might not be perfect, it’s a step in the right direction. It’s going to impact MSPs … and about time 📑 - Quantum computing isn’t (currently) with us on a practical basis, but we’re already dealing with the impact it will have on asymmetric encryption ⚛️ - AI is changing the cyber world, from writing code (often containing vulnerabilities) to growing the next generation of bot armies! 🤖 - the world is becoming more autonomous and we won’t be able to understand everything … that’s a total paradigm shift 🤯 Great conference and venue (Manchester Central) … here’s to Glasgow in 2026 🏴󠁧󠁢󠁳󠁣󠁴󠁿

19