# Active Cyber Defence and National Strategy: Protecting Critical Infrastructure

How national cyber strategies and active defence programs work together to protect the infrastructure that societies depend on, and what it means for organizations operating within it.

Critical national infrastructure covers the services a society cannot do without: power grids, water treatment, hospitals, financial clearing, telecommunications, and transport. An outage there does not just cost money. It can endanger lives and public order. For that reason, governments increasingly pair broad **national cyber strategies** with hands-on **active cyber defence** programs, instead of leaving each operator to defend itself alone. This guide explains how the two fit together and what they mean for organizations in these sectors.

## Strategy and active defence: the "what" and the "how"

A national cyber strategy is a government's plan for cyber security: its goals, priorities, and who is responsible. Active cyber defence is the practical machinery that carries some of that plan out at scale. A good comparison is public health. The strategy is the national health plan, and active defence is the vaccination program, clean-water system, and outbreak response team.

## What a national cyber strategy contains

- **Standards for critical sectors.** Minimum security requirements, increasingly set in law, for operators of essential services.

- **Government capability.** The ability to detect and respond to large-scale threats.

- **Information sharing.** Channels for warning operators about active threats.

- **Skills.** Investment in education and training so there are enough defenders.

## What active cyber defence looks like in practice

| Measure | What it does | Everyday comparison |
| --- | --- | --- |
| Automated takedown services | Find and remove phishing↗ sites, malicious domains, and fake pages that imitate government or essential services, often before most people see them | Removing counterfeit signs before travelers follow them |
| Protective DNS filtering | Blocks known-malicious web addresses at the name-lookup stage, so a harmful site fails to load even if someone clicks | A phone book that leaves out known scam numbers |
| Threat intelligence↗ sharing | Gives operators early warning of active campaigns against their sector | A weather alert before the storm arrives |
| Vulnerability scanning↗ and disclosure | Looks for weaknesses in internet-facing government and infrastructure systems and tells the owners privately | A neighbor who tells you your door was left unlocked |
| Sector incident response↗ support | Dedicated help for energy, health, water, and finance during a major incident | Mutual aid from other fire brigades when one is overwhelmed |

Examples of such programs include the UK National Cyber Security Centre's Active Cyber Defence services, and similar services run by agencies in other countries. What is available to you depends on where you operate.

## Why critical infrastructure needs a different risk model

Ordinary business risk asks: what would this cost us, and is the fix worth the price? Critical infrastructure must also ask: what is the cost to society if this fails, even briefly? That changes the answer. Controls that a retailer would find too expensive, such as extra redundancy, separate backup[↗](/backup) control systems, and mandatory reporting deadlines, become normal when a failure could affect a hospital or a water supply.

## Operational technology: the added complexity

**Operational technology (OT)** means the control systems that run physical equipment, such as pumps, valves, and power switching. Many were designed decades ago, never expecting an internet connection. Updating them is hard because a patch[↗](/patch) that has not been tested could cause the very outage security is meant to prevent. That is why separating OT from office networks, strict change control, and close cooperation between engineers and security staff matter so much. Standards such as IEC 62443 and NIST SP 800-82 give guidance for securing industrial control systems.

## What this means for organizations in these sectors

- **Expect mandatory baselines and reporting deadlines.** These are increasingly legal requirements, not suggestions.

- **Join sector information-sharing groups.** News of an attack on a peer is often your earliest warning.

- **Know your authorities in advance.** Find out which agency to call and how, before an incident, not during one.

- **Check your suppliers.** A supplier with remote access is part of your risk.

- **Practice.** Rehearse an incident with the people and agencies you would need.

## Related reading

[Critical Infrastructure and Active Cyber DefenceEnergy, water, healthcare, and transportation systems face security demands beyond typical organizations, and benefit from national-level active defence programs designed specifically for them.](/critical-infrastructure-and-active-cyber-defence) [Active Cyber Defence and National Cyber StrategyBeyond individual organizations, governments run large-scale programs to reduce cyber harm across entire countries. Here's how active defence and national strategy fit together.](/active-cyber-defence-and-national-cyber-strategy) [Supply Chain Security: Protecting Your Vendors and PartnersA growing share of major breaches start with a trusted vendor, not the target organization itself. Here's how to think about supply chain risk practically.](/supply-chain-security-protecting-your-vendors-and-partners)