NCSC Active Cyber Defence Year 5: Scaling Automated Protections Against Commodity Attacks

Overview of ACD Program Evolution

The National Cyber Security Centre (NCSC) has released its fifth-year review of the Active Cyber Defence (ACD) initiative. The program focuses on reducing the impact of high-volume, low-sophistication attacks through automated intervention. By centralizing defense mechanisms, the ACD aims to remove the burden of security from end-users and individual organizations by neutralizing threats at the infrastructure level.

Key Mitigation Services for Defenders

Several core services define the ACD's operational output, providing critical data and protection for UK-based infrastructure:

• Takedown Service: Automatically identifies and requests the removal of malicious content, including phishing sites and malware distribution nodes.
• Protective DNS (PDNS): Prevents organizational systems from resolving known malicious domains, effectively blocking command-and-control (C2) traffic.
• Web Check and Mail Check: These tools provide automated auditing for web server configurations and email authentication protocols, such as DMARC, SPF, and DKIM, to prevent domain spoofing.
• Early Warning: Uses multiple data feeds to notify organizations of potential compromises, such as presence in a botnet or exposed vulnerable services.

Impact on the Commodity Threat Landscape

In its fifth year, the program has demonstrated significant scale in neutralizing infrastructure used by attackers. By automating the identification of vulnerabilities in public-facing assets, the NCSC helps organizations remediate weaknesses before they are exploited by automated scanning tools. The program's success lies in its ability to handle the 'long tail' of commodity attacks, allowing security teams to focus on more sophisticated, targeted threats.

Recommended Actions for Defenders

SecOps teams and sysadmins should prioritize the following actions to align with ACD findings:

• Enroll in Available Services: Public sector organizations and eligible critical infrastructure providers should ensure they are fully integrated with PDNS and the Early Warning service.
• Audit Email Security: Utilize Mail Check or similar tools to verify that DMARC policies are set to 'reject' to mitigate business email compromise (BEC) risks.
• Attack Surface Management: Implement automated scanning for all internet-facing assets to identify outdated software versions and misconfigured TLS settings.

The aim of ACD is to protect the majority of people from the majority of the harm caused by the majority of cyber attacks the majority of the time.