How the UK cyber security strategy will protect businesses

In January, the UK Government launched its first ever Cyber Security Strategy, aimed at further protecting the public services that people in this country rely upon.

A new Government Cyber Coordination Centre (GCCC) is to be established with the goal of transforming how data and cyber intelligence is shared. The public will be able to contribute to this effort by reporting cyber incidents or weaknesses with digital services. The strategy will make core government functions, such as the delivery of essential public services, more resilient than ever before to cyber-attack from malicious actors.

In his launch speech, the Chancellor of the Duchy of Lancaster, Steve Barclay, said that Britain is now the third most targeted country in the world in cyberspace, so this is a welcome announcement and a great step forward to shore up Britain’s defences and overall resilience.

As the growing global dependence on digital services and connectivity increases, a reliance accelerated by COVID-19, the volume of cyber-attacks in the UK has exploded. For example, between September 2020 and August 2021, of the 777 incidents managed by the National Cyber Security Centre, around 40% were aimed at the public sector.

Hardening Defences by 2025

The Strategy sets out a commitment to have the government’s critical functions significantly hardened to cyber-attack by 2025 with all government organisations across the whole public sector being resilient to known vulnerabilities and attack methods no later than 2030. 

This is an ambitious target for many government departments, but with commitment and investment from key organisations such as Government Security Group, the National Cyber Security Centre (NCSC), and the Central Digital and Data Office, it is achievable; especially with private sector partnership. 

The overall concept of ‘defend as one’ rings strongly throughout the whole report. It recognises the benefits of pooling resources into the soon-to-be-formed GCCC for their collective benefit. While responsibility will be divested to the government department for their own security, they will be able to draw upon a collective intelligence and knowledge pool from across government and the private sector. Like the financial sector cyber collaboration centre (FSCCC) which is a successful initiative to pool collective knowledge across the financial services sector, the GCCC will be an important vehicle to aid government departments to achieve its various goals. 

Focusing on Data-Driven Cybersecurity

The focus on data-driven cybersecurity certainly puts data at the heart of the government’s strategy. This will mean that it needs to concentrate on getting access to the right data, which it will then have to analyse and process into intelligence to get value from it. 

The Minister for the Cabinet Office’s claim that 40% of all attacks identified by the NCSC were aimed at the public sector is very alarming and highlights the challenges for cybersecurity leaders in central government.

The stakes are much higher than for those working in the private sector, given the national security implications and, while they have access to the resources of GCHQ and NCSC, how they direct their time in remediating these risks is crucial. Central government’s success will be derived from how it turns this data into actionable intelligence, to help government departments to defend themselves. 

Significant Backing and Investment

The UK National Cyber Security Strategy will be backed by £37.8 million invested to help local authorities boost their cyber resilience — protecting the essential services and data on which citizens rely. It goes without saying that if we want people to continue to access their pensions online, social care support from local government or health services, we need to step up UK Government cyber defences to enable them to do this in a secure way.

This announcement follows the recent publication of the National Cyber Security Strategy, which called on all parts of society to play their part in reinforcing the UK’s economic strengths in cyberspace, through more diversity in the workforce, levelling up the cyber sector across all UK regions, expanding offensive and defensive cyber capabilities and prioritising cybersecurity in the workplace, boardrooms and digital supply chains.

The new Strategy is underpinned by five key objectives. These set the dimensions of what needs to be considered with regard to cyber resilience, providing a consistent framework and common language that can be applied to the whole of government. One of the key objectives outlined in the Strategy document is to better manage cybersecurity risk, so that government organisations can more clearly identify, assess and understand them. The foundation of this lies in the visibility and understanding of assets, their vulnerabilities, and the threat to them - whether internal to an organisation or emanating from its supply chain. In our work here at BlueVoyant, we have found UK companies are struggling with this risk. In fact, recent research which we launched in December last year revealed that 97% of UK organisations have suffered a cybersecurity breach because of weaknesses in their supply chain.

Why The Cyber Threat is Clear and Growing

The cyber threat, particularly from the supply chain is very clear and growing.

You only have to look at the rise, for example, in ransomware attacks which have increased dramatically in the past couple of years, doubling in frequency in some industries and — in some instances — quadrupling in other industries. In fact, since the pandemic broke almost two years ago, ransomware attacks have become prolific and plagued multiple industries. That’s because the ransomware threat is difficult to understand and face down because at its heart it is a series of complex dynamics between attacker and victim, state and citizen, private and public sector, policymaker and geopolitical manoeuvring. However, as pressure on victims increases, attackers will continue to evolve their tactics to gain the maximum payoff.

The surge in attacks has been fuelled in part by the rise of the "triple extortion" ransomware technique, whereby attackers not only steal sensitive data from organisations but threaten to release it publicly unless a payment is made, while also targeting the organisations' customers, vendors and business partners. But it is more than just a criminal enterprise of holding individuals, companies and governments to ransom; it has become a tool for geopolitics, an issue for policymakers and a threat to the health and safety of citizens.

This is where I hope the new UK Government Cyber Security Strategy will make core government functions, such as the delivery of essential public services, more resilient than ever before to cyber-attack from malicious actors.