The much anticipated new version of the Cyber Security Strategy is finally out. But is it any good? Well, generally its reception has been good and, from an Intellect point of view, we support it.
In particular, Intellect was very pleased to see some recommendations from our November 2010 paper Improving Cyber Security Partnerships reflected in the strategy. For example, our recommendations about HMG sharing cyber threat information with the private sector, the adoption of a widely recognisable kitemark, the rationalisation of UK standards applicable to cyber security products and solutions, and greater transparency of public funded research on cyber security have been incorporated into the HMG’s 2011 Cyber Security Strategy. It is also encouraging that our input into this strategy has also been incorporated into the document.
So what does it say?
First of all, the strategy recognises that the Internet is vital to the UK’s economy. Internet businesses comprise 6% of GDP and are slated to create 365,000 jobs over the next five years. Moreover, HMG’s ‘digital by default’ agenda and its move to migrate services to the cloud will mean that the UK will become more and more dependent on cyber space for our public services.
These growth figures are mimicked internationally. For example, e-commerce sees US$8 trillion change hands annually and current estimates suggest that for every 10% increase in broadband access, global GDP will rise, on average, by 1.3%.
As a result, ensuring that the UK is a safe place to do business is critical to the economic wellbeing of the UK.
The strategy also rightly makes the point that cyber security cannot be achieved by placing responsibility solely in the hands of HMG. However, the view from HMG is companies need to ensure their IPR is protected adequately and need to ensure cyber is recognised at a board level. It’s also been suggested by Government that company audit committees should routinely review this risk.
Some companies are already very good at protecting themselves from the cyber threat. Unsurprisingly, these tend to be the Defence Primes or Internet Technology Companies. This means, other companies – both in the UK and worldwide – need to take action to protect themselves and recognise cyber as a real risk to their business. Achieving cyber security does not require massive investment in new technology. It’s largely accepted that 80% of cyber risks can be addressed by applying good practice within companies, which would include keeping anti-malware applications up to date, ensuring operating system and third party application updates are installed quickly and educating staff correctly.
One of the most important recommendations in the new strategy is the call for greater co-operation between HMG and the private sector with regard to cyber security. Organisations such as GCHQ will now need to work in partnership with commercial organisations. This recommendation is being implemented through the development of a hub and node solution to share information and best practice between the public and private sectors. Intellect and its members fully support this activity. In fact, Intellect – along with ADS – has been working with 25 of its members for the last six months to develop a virtual node that will enable companies in the advanced technology industry to share cyber threat information with each other. We hope that, over time, this node will be integrated into HMG’s Hub initiative.
Intellect also praises the strategy’s recognition that cyber presents a host of opportunities to UK business. Therefore, UKTI will be committed to working with trade associations to ‘to turn the threat into opportunity and make strong cyber security a positive for all UK businesses’.
So how will this affect your business?
Intellect suspects that the impact of the Cyber Security Strategy will be that ‘cyber’ will become part of normal business risk assessment. There will be more pressure from clients (particularly public sector clients), shareholders, and auditors to demonstrate how your business is mitigating cyber threats.
These greater expectations will be complemented by the general public, commercial entities, and public sector customers having better knowledge and an easier time in mitigating the cyber threat. This is because ‘kite-marked’ products, cyber-specific standards, and best or good practice guides will be developed and widely distributed.
To support this Intellect will be issuing its good practice guide aimed at SMEs in early to mid 2012 and will continue to work in partnership with ADS to deliver the advanced technology industry node (Virtual Task Force) next year.
