@NCSC Hey Mat; your categorisation has issues at the very first hurdle - understandable considering that it comes from a perspective of attribution. In the private sector it's rarely about how godlike the attackers are, it's about how long they persist before if they get bored. 
@NCSC It's a concrete example of the old joke about "I don't have to outrun the bear, I just have to outrun you" - the private sector is not and should not be collectively responsible for each other's security. As such we strive amongst ourselves to be secure sufficient to our needs.
@NCSC Of course one of the benefits of a "elitism based approach" to qualifying hacking risk is that it sediments GCHQ as role as arbiter of how bad threats are; NCSC becomes a bit like the IOC, vetting the state of the hacker "athletic" field...
@NCSC But if you stopped the cyber and instead promoted "bug bounty programs" (for one) - British companies would learn how vulnerable they are to (say) a solitary Indian teenager, delightful in person, who is really really focused on your risk posture.
@NCSC And - get this! - he will tell you what's wrong for a nominal fee and be delighted when you reward him for it, and you will build a relationship, going forwards. Everybody wins.
This is why the mythos of state attribution is deeply harmful to British cybersecurity.
This is why the mythos of state attribution is deeply harmful to British cybersecurity.
@NCSC @GCHQ @threadreaderapp unroll please
