The UK Cyber Security Strategy

News Report

After a couple of postponements, the UK Government has finally published its Cyber Security Strategy, which details UK plans to secure critical infrastructure and improve the country’s cyber-defenses to protect national security and citizens from multiple cyber-threats. The UK government classified cyber-security as a "tier one" national security priority in 2010 and set aside 650 million pounds over the next four years to be used for cyber-defense.

The 2015 Vision

The goals of UK Governemnt on Cyber are ambitious. By 2015, the aspiration is that the measures outlined in this strategy will mean the UK is in a position where:

• law enforcement is tackling cyber criminals;
• citizens know what to do to protect themselves;
• effective cyber security is seen as a positive for UK business;
• a thriving cyber security sector has been established;
• public services online are secure and resilient;
• the threats to our national infrastructure and national security have been confronted.

To achieve this vision, 4 main objectives are identified:

1. The UK to tackle cyber crime and be one of the most secure places in the world to do business in cyberspace.
2. The UK to be more resilient to cyber attacks and better able to protect our interests in cyberspace.
3. The UK to have helped shape an open, stable and vibrant cyberspace which the UK public can use safely and that supports open societies.
4. The UK to have the cross-cutting knowledge, skills and capability it needs to underpin all our cyber security objectives

Funding

To achieve the above, UK Government has set aside £650 million of public funding for a four-year, National Cyber Security Programme (NCSP). This funding is intended to transform the UK Government’s response to cyber threats, and has been allocated to those departments and agencies that have key roles to play. UK intelligence agencies and UK Ministry of Defence have a strong role in improving reducing the vulnerabilities and threats that the UK faces in cyberspace. But the UK Home Office, the UK Cabinet Office and UK Department for Business, Innovation and Skills (BIS) are also receiving funding to bolster their specific individual capabilities.

The bulk of the funding will go towards the Government's efforts to detect and counter cyber-attacks. Specifically, around 65 percent is expected to be spent on capabilities, 20 percent on critical cyber-infrastructure, nine percent on cybercrime specifics, five percent on reserves and one percent on education.

Cyber Centres and Organizations

The new UK Joint Forces Command will take the lead in the development and integration of defence cyber capabilities from April 2012. At the same time, UK MoD is creating a new Defence Cyber Operations Group to bring together cyber capabilities from across defence. The group will include a Joint Cyber Unit hosted by GCHQ (Government Communications Headquarters) whose role will be to develop new tactics, techniques and plans to deliver military effects, including enhanced security, through operations in cyberspace.

The UK Ministry of Defence has already opened a new Global Operations and Security Control Centre, to act as a focus for cyber defence for the armed forces. A second Joint Cyber Unit embedded within this centre will develop and use a range of new techniques, including proactive measures, to disrupt threats to our information security.

As part of the creation of the UK National Crime Agency (NCA), UK Government will create a new National Cyber Crime Unit, drawing together the work currently carried out by the e-crime unit in SOCA (Serious Organised Crime Agency) and the UK Metropolitan Police’s Central E-Crime Unit. The new unit will underpin the work of all four operational commands of the NCA (borders, organised crime, economic crime and Child Exploitation and Online Protection – CEOP) by providing specialist support, intelligence and guidance. The unit will act as the national capability to deal with the most serious national-level cyber crime, and to be part of the response to major national incidents.

UK authorities will also set up a simplified cyber-crime reporting system through the existing Action Fraud reporting center. Users will also receive training to increase public awareness of online threats. A voluntary code of conduct with Internet service providers will also outline how users whose computers are infected with malware will be notified and receive instructions on how to mitigate the problems.

The "Hub"

In February 2011, the UK Prime Minister met the heads of some of the largest companies from all sectors of the UK economy to discuss the cyber threat and their shared interest in getting the response right. In the months since, the private sector and UK Government have come together to design and build an innovative new approach for cyber security.

Within such context, the Cyber Security Strategy outlines a new public-private sector collaboration in which the government and businesses will exchange information on cyber-threats and responses. A joint public/private sector ‘hub’ will pool government and private threat information and pass that out to ‘nodes’ in key business sectors, helping them identify what needs to be done and providing a framework for sharing best practice. A pilot will commence in December involving five business sectors: defence, finance, telecommunication, pharmaceuticals, and energy. Lessons from this will be used to inform roll-out of the initiative to other sectors from March 2012.

Similar to the Defense Industrial Base Pilot launched by the United States Department of Defense, the "Hub" will allow organizations to receive classified details about cyber-attacks and information on how to counter them. The U.S. version of the program is limited to defense contractors and similar organizations. The British counterpart will include companies from the defense, finance, telecommunications, pharmaceutical and energy industries.

Business Considerations

Though the scale of the challenge requires strong national leadership, UK Government cannot act alone. It must recognise the limits of its competence in cyberspace. Much of the infrastructure they need to protect is owned and operated by the private sector. The expertise and innovation required to keep pace with the threat will be business-driven. UK Government will create a thriving market in cyber security products and services that can win the UK business abroad and contribute to growth. It will also enable to promote the UK as a good place to do business in cyberspace

For cyber security, UK Government is setting an expectation that at least 25% of the value of Government cyber security contracts go to SMEs, either by breaking contracts into lots or by including SME sub-contracting arrangements in contracts awarded to larger suppliers.

Comments

"The Cyber-Security Strategy document heralds a new era of unprecedented co-operation between the government and the private sector on cyber-security, working hand in hand to make the U.K. one of the most secure places in the world to do business," said Francis Maude, the Minister for U.K.'s Cabinet Office and Paymaster General.

"Just as in the nineteenth century we had to secure the seas for our national safety and prosperity, and in the twentieth century we had to secure the air, in the twenty first century we also have to secure our position in cyber space in order to give people and businesses the confidence they need to operate safely there," said UK Prime Minister David Cameron. "That is why today I am announcing - alongside our updated National Security Strategy - the UK's first strategy for cyber security".

References: UK Cabinet Office (1), eWeek (2), NTA Forensics (3), The Hacker News (4)