By Lynn Studd, Director of Global Secure Solutions

Last weekend I had the honour of presenting prizes to the winners of the East of England Final at this year’s National Cyber Security Centre’s (NCSC) CyberFirst Girls Competition.

The event, one of 13 finals held around the country, took place at the home of BT research and innovation, Adastral Park, Ipswich, where Watford Grammar School for Girls were announced the winners by the NCSC.

For a number of years, voices from across the security industry have highlighted a cyber skills gap – a profession that needs to attract more than 4 million more dedicated and trained colleagues globally.

And yet, the strong job stability and career path that cybersecurity offers aren’t so widely enjoyed by women and girls who are under-represented in the profession. So, what’s going on?

Well, as Sheryl Sandberg once said, “you can’t be what you can’t see.” Nearly a decade on, this still rings true. Just 16% of the cyber workforce identify as female.

Education from an early age is, of course, a major part of closing the gender gap in cyber. Schools are persistently working to encourage gender diversity in STEM. But it goes beyond education and requires encouragement and exposure to the world of cybersecurity from an early age.

We need to provide a forum for school children to engage with and understand the profession, using demonstrations, workshops and classes to inspire them to strive for cybersecurity careers.

The answer may lie in the perception of the cybersecurity profession as aspirational, only for those with a set of highly specialised technical skills. But, for girls who don’t fancy themselves as the next ethical hackers of the world, cyber security isn’t just about computers and coding, and it’s not only for hackers and geeks.

We too often focus on the components of cyber security (like coding networks and hardware), but not what the role itself looks and feels like. The reality is that the field needs a broad array of skills and experts to fill a range of roles, and these roles include people with all skill sets.

This is why collaborative initiatives like CyberFirst are focused on introducing girls aged 12 to 13 to the fast-paced world of cyber security and support those interested in a career in the industry, and the broad array of roles that come with it.  

By showing how accessible it can be to young women and girls we’re building momentum that will create the workforce needed to tackle the security problems of the future.

For more information on careers at BT Security, visit: https://www.bt.com/careers/careers-at-bt/security

For more information on the CyberFirst programme, visit: https://www.ncsc.gov.uk/cyberfirst/overview

BT was recently designated a ‘Partner’ of the National Cyber Security Centre’s (NCSC) ‘CyberFirst’ programme. In this blog, Kevin Brown (Managing Director, BT Security) and Chris Ensor (Deputy Director for Cyber Growth, NCSC) look at the cyber skills gap, and how initiatives such as CyberFirst are helping to tackle this issue.

For a number of years, voices from across the security industry have highlighted a cyber skills gap, where there simply aren’t enough people with the right knowledge and skills to fill the number of cyber security jobs available. Both private & public sector organisations from across the world are impacted by this, with many publicly committing to work collaboratively to tackle this issue.

Developing the next generation of skilled cyber professionals is understandably a long-term process – whether that be training young people from school onwards through to reskilling current professionals with transferable experience. Yet the need for new talent is already immediate. The unprecedented growth in people spending more time online over the past 18 months has highlighted the importance of the cyber security industry and some estimates suggest there could be currently 3.5 million unfilled cyber security vacancies across the globe.

The CyberFirst programme, run by the National Cyber Security Centre – a part of GCHQ – is at the core of the UK’s response to this issue. The programme was set up in 2016 to help young people aged 11 to 21 explore their passion for technology through cyber security and to support those with an aptitude for the subject to pursue careers in the field.

It also has a clear objective to improve diversity in the cyber sector, with initiatives aimed at inspiring more girls to take up opportunities to enter cyber security jobs. The CyberFirst Girls Competition, for example, is the UK’s flagship cyber contest for schools, and through online challenges and puzzles, girls aged 12 to 13 are introduced to the fast-paced world of cyber security.[1]

BT has supported CyberFirst since its inception, and in recognition of its long-term advocacy and increased support over the past 12 months it was recently awarded ‘Partner’ status. BT is one of only 7 companies[2] to have this status, which will allow it to play a more active role in defining the strategy and direction of the programme. It also recognises how BT has engaged with the CyberFirst programme to develop its recruitment processes and provide real near-term benefits to its workforce.

BT has achieved this by ensuring that its work with CyberFirst is focused on one key principle – that, fundamentally, everyone benefits if we can make it easier for skilled and passionate people to actually enter roles in the cyber industry. It may sound simplistic or obvious, but one of the most impactful things we can do is to remove some of the hurdles, complications and delays that young people face when trying to join the sector.

For example, every year, the CyberFirst programme sets up hundreds of summer placements for carefully selected and security-checked university students on its bursary programme and they are placed at organisations across the cyber industry, including BT.

The benefits of these placements are evident, for the students who gain practical real-world experience of cyber careers and for the organisations in identifying talented people. However, some organisations do not take the logical next step and set up a process which allows talented students to create a future commitment with the company they were placed with. Instead, upon graduating from university, students simply go onto the job market.

In response to this, BT has streamlined its recruitment processes to improve its conversion of CyberFirst summer placement students onto its graduate programme. We have worked collaboratively to align our respective recruitment and assessment processes, resulting in a model where CyberFirst placement students receive an offer to join BT’s graduate scheme prior to their return to the final year of university (rather than needing to wait until they’ve finished their degrees).

This year, 22 CyberFirst bursary students were recruited by BT for its 2021 Summer Placement programme, which is the largest number since it started working with CyberFirst. The placements began in June and will run for 10 weeks, and provided the students meet the criteria we hope that many will go on to join the graduate programme.

Solutions for the cyber skills gap, and the impact of initiatives to tackle it, will not be instant. However, by working collaboratively across the public and private sector, we can build momentum that will create the workforce needed to tackle the security problems of the future. Shorter term, removing the obstacles that can hinder young people starting and progressing their careers provides an excellent way of encouraging more immediate entrants to the industry.

For more information on careers at BT Security, visit: https://www.bt.com/careers/careers-at-bt/security

For more information on the CyberFirst programme, visit: https://www.ncsc.gov.uk/cyberfirst/overview

While large organisations often have entire teams dedicated to security, many smaller businesses with limited bandwidth and resources struggle to understand the steps they need to take to protect their organisation. In fact, in a recent survey 65% of small businesses said they had sought external information or guidance on security in the last 12 months[1], with many organizations remaining unclear on the appropriate methods to safeguard their business.

In response, BT have partnered with the National Cyber Security Centre (NCSC) to provide businesses with top tips for staying secure online. The NCSC is the nation’s technical authority on cyber security and provides products and guidance for SMEs, larger organisations, government agencies and the public.

Tip 1 – Backing up Your Data

All businesses, regardless of size, should take regular backups of their important data, and make sure that these backups are recent and can be restored. By doing this, you are ensuring your business can still function following the impact of flood, fire, physical damage, or theft. Furthermore, if you have backups of your data that you can quickly respond and recover in the event of a cyber breach

Your first step is to identify your essential data. This is the information that your business could not function without. Normally, this will comprise of documents, photos, emails, contacts, and calendars, most of which are kept in just a few common folders on your computer, phone, tablet, or network.

Once you have identified your most important data, keep your backups separate from your main computers. Whether it's on a USB stick, on a separate drive or a separate computer, access to data backups should be restricted so that they are not accessible by unauthorised staff members and are not permanently connected to the device holding the original copy. You can also back up your data with cloud storage, which means your data is physically separated from your computers and can be accessed from any device, simply by logging into your cloud environment.

Tip 2 – Protecting Your Organisation from Malware

Malicious software (also known as 'malware') is software or web content that can harm your organisation. This can include viruses, spyware, or ransomware which prevents users from accessing their computers (or the data stored on them) until a ransom is paid.

For all your IT equipment, make sure that the software and firmware is always kept up to date with the latest versions from software developers, hardware suppliers and vendors. Applying these updates is one of the most important things you can do to improve security - the IT version of eating your fruit and veg.

Ensure that your organisation is also running antivirus software across all your laptops and computers. Antivirus software is often included free within popular operating systems and can typically be enabled with one click. This is the same for firewalls which create a 'buffer zone' between your own network and external networks (such as the Internet). BT works with the NCSC on its ‘Active Cyber Defence’ programme, which aims to prevent the majority of malicious emails from reaching individuals and businesses in the UK – but most popular operating systems also now include a firewall, which you can switch on to protect yourself even further.

Tip 3 – Avoiding Phishing Attacks

A phishing attack is when scammers send fake emails to potential victims, asking them for sensitive information (such as bank details), or containing links to malicious websites. Scammers might try to trick you into sending money, giving away business details to sell on, or have their own motives for accessing your organisation's network.

Many phishing emails will often have similar warning signs which can include:

• Poor spelling, grammar, and punctuation

• Generic greeting, such as ‘Dear Customer’ rather than using your name

• A sense of urgency

• Email from high-ranking persons within your organisation, asking you to do something outside normal processes

• An offer of money or exclusive benefit

However, expecting your staff to identify and report all phishing emails is an unrealistic request, as fraudulent emails are becoming harder to spot. Never punish users who are struggling to recognise suspicious emails – users who fear reprisals will not report mistakes promptly, if at all. Instead, build a culture where users can confidently report phishing attempts (including ones that are clicked on) by having an effective process in place for reporting. You can then take steps to scan for malware and change passwords in a timely manner if you suspect a successful breach has occurred.

For further information on implementing these top tips, check out the NCSC’s Small Business Guide: Cyber Security

BT’s Top Tips on Tech page also has a dedicated section of security for businesses alongside wider guidance for staying safe online. In addition, our Skills for Tomorrow site has a range of guidance on improving Cyber Security in your organisation.

[1] Cyber Security Breaches Survey 2020: https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2020

The last few weeks have changed the way we use technology in ways we probably never imagined. Many of us are spending more time online, whether that’s home schooling, home working, shopping, gaming, or video calling with friends and family.

BT has produced a range of ‘Top Tips on Tech’, which give guidance on online issues ranging from children’s safety through to working from home and taking your business online. Throughout all these activities, it’s vital that you are doing them securely and protecting yourself from cybercrime. To help you, BT is supporting the government’s Cyber Aware campaign which gives six important tips to stay secure online.

Alongside these top tips, the National Cyber Security Centre (NCSC) has also produced helpful guidance on the secure use of video conferencing, online gaming and shopping to help keep us protected during this period of social distancing. Both BT and the NCSC believe making this guidance both easily available and understandable is crucial to keeping the UK safe online, and will explain below how following these steps can help your security.

Your email account contains lots of important information about you and is the gateway to all your other online accounts. If you think about it, if someone gets into your email, they could potentially reset the password on all your online accounts. That’s why it’s so important to keep it secure by protecting it with a strong password that is different to all your others. But what makes a strong password? Essentially the longer and more unusual your password is, the stronger it becomes and the harder it is for a criminal to hack or guess. The best way to make your password hard to hack is by using a sequence of three random – but memorable – words. For example, “BeachTarantulaOranges” (don’t copy this one though…).

You’ve probably got more online accounts than you can keep track of, from banking to shopping to social media to TV streaming services. You should avoid using the same password for different websites and do this by finding a way to remember passwords that works for you. Saving your passwords in your browser or by using a third party password manager is a great way to do this.

For an added layer of security on your important accounts, turn on two-factor authentication (2FA). This is a free security feature that’s available on many popular services and helps to prevent criminals accessing your accounts, normally by sending you a text or code when you log in, to check you are who you say you are. So if another person tries to access your account, they’re prevented from doing so.

Making sure your devices – your laptop, phone, tablet, smart speaker – have the most up to date software and apps is one of the best things you can do to immediately improve your security. Cyber criminals exploit weaknesses in software and apps to access your sensitive personal data, but providers are continually working to keep you secure by releasing regular updates. We’d encourage you to regularly check for updates on your devices and apps or set them to automatically update so you don’t have to think about it anymore.

If you’ve ever left your phone in your pocket and not realised until you heard it bouncing round the washing machine, your first two thoughts were probably ‘that’s going to be expensive’ and ‘I hope I haven’t lost all my photos’. We can’t help with the first thought, but the second one is easy to prepare for – just turn on automatic backup on your device. Not only will it help keep those treasured memories safe so you can access them again when you get a new device; it will also mean that if your phone, tablet or laptop is hacked you can recover quickly from your backup.

Finally, you may have noticed that cyber criminals using our fear of coronavirus (COVID-19) when sending scam emails that try and trick people into clicking on a bad link. The link could take you to a dodgy website or infect your device with malicious software. You may have received an email that claims to have a ‘cure’ for the virus or encourages you to donate. If you receive an email that you’re not quite sure about, you can send it to the NCSC’s Suspicious Email Reporting Service by forwarding it to report@phishing.gov.uk. If anything is found to be malicious, the NCSC will take it down and you will have helped protect others from falling victim to scams.

For more information visit www.ncsc.gov.uk/cyberaware