Britain's Cyber Security Strategy Focuses On Resilience

The British government has launched its first Government Cyber Security Strategy, a multi-million pound plan to help better protect vital public services from the growing risk of disruptive and destructive cyber attacks. 

According to the Government statement, Britain’s public services will be strengthened to further protect them from the risk of being shut down by hostile cyber threats. Members of the public will also be able to contribute to the effort, with a new vulnerability reporting service allowing individuals to report weaknesses in digital services.

“Our public services are precious and without them individuals can’t access the support that they rely on... If we want people to continue to access their pensions online, social care support from local government or health services, we need to step up our cyber defences. The cyber threat is clear and growing. But government is acting, investing over £2bn in cyber, retiring legacy IT systems and stepping up our skills and coordination.”said, said Minister Steve Barclay. Minister Barclay also said that Britain is now the third most targeted country in the world in cyberspace from hostile states.

The new strategy will be funded by £37.8 million invested to help local authorities boost their cyber resilience, protecting the essential services and data on which citizens rely on.  “The cyber threat is clear and growing. But government is acting - investing over £2billion in cyber, retiring legacy IT systems and stepping up our skills and coordination.” Barclay added.

The new strategy outlines how central government and the public sector will step up national cyber resilience by better sharing data, expertise and capabilities to allow government to ‘Defend As One’, meaning that government cyber defence is far greater than the sum of its parts.

Of the 777 incidents managed by the National Cyber Security Centre between September 2020 and August 2021, around 40% were aimed at the public sector. 

In 2020, both Redcar & Cleveland and Hackney Councils were hit by ransomware attacks impacting council tax, benefits and housing waiting lists. Gloucester City Council was subjected to damaging cyber attack in 2021. It follows the recent publication of the National Cyber Security Strategy, which called on all parts of society to play their part in reinforcing the UK’s economic strengths in cyberspace, through more diversity in the workforce, levelling up the cyber sector across all UK regions, expanding offensive and defensive cyber capabilities and prioritising cyber security in the workplace, boardrooms and digital supply chains.

Key announcements in the strategy include:

  • Establishing a new Government Cyber Coordination Centre (GCCC), to better coordinate cyber security efforts across the public sector. Building on successful private sector models, such as the Financial Sector Cyber Collaboration Centre, the GCCC will rapidly identify, investigate and coordinate the government’s response to attacks on public sector systems. The centre will be based in the Cabinet Office and will ensure that data is rapidly shared, allowing us to ‘Defend As One’.
  • A new cross-government vulnerability reporting service, which will allow security researchers and members of the public to easily report issues they identify with public sector digital services. This will enable organisations to more quickly fix any issues identified.
  • A new, more detailed assurance regime for the whole of government, which will include robust assessment of departmental plans and vulnerabilities. This will give central government a more detailed picture of government’s cyber health for the first time.
  • £37.8 million invested into local authorities for cyber resilience - protecting the essential services and data on which citizens rely on including housing benefit, voter registration, electoral management, school grants and the provision of social care.
  • An innovative project to reduce government risk through culture change, in partnership with small businesses and academia
  • Stepped up work to understand the growing risk from the supply chains of commercially provided products in government systems, ensuring security is a key part of procurement and working with industry on cyber vulnerabilities.

According to the British Government Chief Security Officer, Vincent Devine,  the new strategy is designed to  ensure that government’s critical functions are significantly hardened to cyber attacks. The strategy is centred around two core pillars:

  • First focussing on building a strong foundation of organisational cyber security resilience.
  • Second aimed at allowing government to ‘defend as one’, harnessing the value of sharing data, expertise and capabilities.

Cyber security expert Dr Süleyman Özarslan, founder of Picus Security commented that we've "seen similar Government announcements before" and that it clearly finds public sector security a challenge. “It’s a positive step good that the UK government recognises the importance of improving the state of cyber security in the public sector... Local authorities are increasingly targeted by cyber criminals and when they are, the impact can be significant for citizens." 

“Defend as One” is a noble aim, but it’s no good improving knowledge sharing if councils aren’t also in a position to apply intelligence and take swift, defensive actions. The public sector increasingly needs to shift its approach from being reactive to proactive... The UK is highly targeted, and it is important that, as a nation, we defend our ability to support our citizens and the services they rely on. I would question whether £37.8m is enough to help local authorities improve cyber reliance, given their current level of resources and the threats they face. It may prove to be a drop in the ocean, but at the £2B investment overall is a significant sum." according to Dr. Özarslan

Gov.UK:      Navy-Net:      Industrial Cyber:      ITPro:      Picus Security:      Computer Weekly:   

You Might Also Read: 

Britain's New Deals On Digital Trade & Cyber Security:

 

« ‘Honey Trap’ Sites Recruiting Israeli Spies
North Korea's Internet Is Faltering »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Zentek Digital Investigations

Zentek Digital Investigations

Zentek has been providing digital forensics services to the public and private sector for computers and mobile devices since 2004.

Delphix

Delphix

Delphix is the industry leader for DevOps test data management.

Morphisec

Morphisec

Morphisec's world leading prevention-first software stops ransomware and other advanced attacks from endpoint to the cloud.

Bolton Labs

Bolton Labs

Bolton Labs is a leading provider cybersecurity services, tools, and analysis for MSPs and organizations who want to scale their security offerings.

CyberWarrior

CyberWarrior

CyberWarrior deliver training and consulting for some of the world’s top brands and also partner with national systems integrators to augment their teams with our expertise.

CybX Security LLC

CybX Security LLC

CybX is the first company of its kind to merge the practice of computer forensics with computer security and information security.

Lifetech

Lifetech

Lifetech is a software development, product engineering and system integration company. Cybersecurity services include SIEM deployment and training.

KETS Quantum Security

KETS Quantum Security

KETS harnesses the properties of quantum mechanics to solve challenging problems in randomness generation and secure key distribution and enable ultra secure communications.

Everything Blockchain

Everything Blockchain

Everything Blockchain offer solutions that transform enterprise data-management capabilities. Increased efficiency, super-charged performance and all with government grade security.

CYSIAM

CYSIAM

CYSIAM provides world-leading expertise in offensive security and critical incident response. We train our clients to be able to protect themselves and respond to attacks and breaches when they occur.

BlastWave

BlastWave

BlastWave’s BlastShield integrates three innovative products into a single solution to help prevent inadvertent and intentional attacks.

Third Point Ventures

Third Point Ventures

Third Point brings deep technical expertise, a strong network of relationships, and decades of investing experience to add value to our partners throughout their journey from idea to IPO and beyond.

Verizon

Verizon

Verizon is a leader in IT technology solutions - Verizon Cloud, Networking, Security, Mobility, Machine-to-Machine (M2M), Advanced Communications and Professional Services.

Bearer

Bearer

Bearer helps modern teams ship trustworthy products with the help of our code security solution built for security, privacy and engineering teams.

SureCloud Cyber Services

SureCloud Cyber Services

Our Cyber Testing capability has been honed since we were founded in 2006 as a disrupter in the penetration testing market.

Secure Enterprise Engineering (SEE)

Secure Enterprise Engineering (SEE)

SEE provides disruptive cybersecurity system engineering, architecture, and operational capabilities to make our customer’s missions execute faster, smarter, and more securely.