Britain's National Cyber Security Strategy Beyond 2021

With the UK midway through its second National Cyber Security Programme, focus now needs to consider future strategy beyond the conclusion of the current cycle in 2021. 

Clearly much has been achieved in the UK this decade, from the ever-widening network of GCHQ-accredited Academic Centres of Excellence (ACE) across the country, a gradual re-addressment of STEM  (science, technology, engineering and mathematics) subjects in schools, through to the organisational innovation in setting up the National Cyber Security Centre (NCSC). 

The UK has certainly not rested on its laurels in addressing cyber security at the national level. Despite these strides, however, this overwhelmingly domestic focus has left a critical gap that now needs to be addressed: the international arena. 

The global WannaCry attack of 2017 should serve to reveal a reality not to be ignored; that UK resilience, no matter how well constructed, can only offer a reactive ‘band aid’ in a global environment where cybercrime remains rampant and international law is not respected. That environment cannot be allowed to develop without the influence of leading democracies.

To that end, a series of questions should help shape the agenda for an international approach to the next cyber security strategy, chief among them being ‘in what ways can the UK better influence norms and rules in cyberspace?’ While it is excellent to have a developing pipeline of STEM talent to plug the skills gap across cyber security, the professionals of tomorrow will be overrun if the international environment is either lawless or shaped by fundamentally authoritarian norms. 
Serious and concerted political support to efforts like the UN Groups of Government Experts (GGE) is essential to begin rebuilding momentum on dialogue such as the ‘finding the rules of the road’ initiative championed by then Foreign Secretary William Hague at the 2011 Munich Security Conference. 

Alignment with the efforts of NATO to find suitably applicable international law would be another fruitful avenue of not only finding consensus, but working within existing alliance frameworks. 

Consensus should very much be built among allies to strengthen any hand at future UN GGE processes. The platforms to advance the agenda already exist; what is missing is ‘bandwidth’ at the top level of British politics to contribute as needed.

The Missing Dimension in UK Cyber – Our Values
A critical point should be established in the development of cyber security strategy, by refocusing attention on the values that were set out in the 2011–15 strategy. For the UK to meaningfully contribute in shaping norms, it must promote itself both tangibly through the export of technical expertise and products, but also lead the way in establishing a standard for what behaviour a liberal democracy abides by and expects in cyberspace.

Shaping the international agenda for cyberspace should in the next strategy be as much about aligning the rights of citizens based on core values, the balance between privacy and security paramount among them, as it should be centred on technical requirements such as ‘secure by design’ for consumers of new tech products. What rights and values does a liberal democratic society subscribe to in the Information Age? To focus on technology without also focusing on the rights of the citizenry risks ceding the political ground entirely to a competing political position.

The New Great Game – The Threat from Cyber Sovereignty
While it may seem an indulgence to focus on norms and not purely on technology, the reasoning lies not in pure abstraction, but in the recognition that the liberal view is under direct challenge from a competing political belief set, Cyber Sovereignty. 

Championed by Russia and China, this view directly disputes the multi-stakeholder model that has so far been effective in governing cyberspace, calling instead for direct and exclusive management of cyberspace by nation states. This viewpoint poses a direct threat to the type of cyberspace that was not only originally created by liberal states and underpinned by liberal values, but also any future cyberspace. 

Next Steps and Challenges
Two key challenges must be navigated as the next steps in building towards a 2021 cyber security strategy: Brexit; and strategic alignment. In the first instance, Brexit remains the known unknown in the short term, an issue really only because of its uncertainty. 

One certainty that can be established, however, is that cyber security remains important regardless of Brexit, and thinking can afford to progress in an almost agnostic manner. When the last strategy was written the idea of a Brexit referendum was not even a political likelihood, the next one must be prepared without worrying about how Brexit may conclude.

This leaves the core challenge of establishing broad strategic alignment. Any future strategy needs to be assessed against a clear political vision for what the UK wants to achieve globally, based on a foundational value set. Strategy is instrumental in nature, helping to turn political vision into reality; UK political leaders must specify an international political vision against which a cyber security strategy can orient its mission effectively. 

Without this broad vision underwritten by clear values, the next cyber security strategy risks becoming merely a budgetary exercise that fails to shape the international dynamics framing the development of cyber security for decades to come.

RUSI

You Might Also Read:

Britain Aims To Lead In CyberSecurity:

 

« FBI Takes Too Long To Alert Victims
Top Blockchain Challenges For CIOs »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Proofpoint

Proofpoint

Proofpoint provide the most effective cybersecurity and compliance solutions to protect people on every channel including email, the web, the cloud, social media and mobile messaging.

Schneider Electric

Schneider Electric

Schneider Electric develops connected technologies and solutions to manage energy and process in ways that are safe, reliable and sustainable.

Carson & SAINT

Carson & SAINT

Carson & SAINT is an award-winning consulting firm with deep experience in cybersecurity technology, software, and management consulting.

WeSecureApp (WSA)

WeSecureApp (WSA)

WeSecureApp is specialized in providing Cyber Security Solutions to safeguard your applications and networks.

Eseye

Eseye

Eseye is a global specialist supplier of cellular internet connectivity for intelligent IoT (Internet of Things) devices.

Philippine National Police Anti-Cybercrime Group (PNP-ACG)

Philippine National Police Anti-Cybercrime Group (PNP-ACG)

The mission of the PNP Anti-Cybercrime Group is to implement and enforce pertinent laws on cybercrime and other cyber related crimes and pursue an effective anti-cybercrime campaign.

Council for Information & Communication Technologies (CTIC)

Council for Information & Communication Technologies (CTIC)

CTIC was set up to address specific issues in the field of ICT relevant to the implementation of electronic government.

Axiomtek

Axiomtek

Axiomtek is a leading design and manufacturing company in the industrial computer and embedded field.

Adyta

Adyta

Adyta specializes in cybersecurity solutions adapted to the needs of sovereign institutions, business groups and other organizations that handle information and sensitive or classified data.

Pentest Limited

Pentest Limited

Pentest Limited provide information security consultation, penetration testing & red teaming services to companies across the globe.

Saepio Solutions

Saepio Solutions

Saepio promote an all-encompassing approach to cybersecurity, ensuring the appropriate balance of budget and resource across Policy, Product and People.

Advantio

Advantio

Advantio offers a unique combination of technologies and managed, advisory and testing services to increase your cyber resilience and compliance.

International Cyber Threat Task Force (ICTTF)

International Cyber Threat Task Force (ICTTF)

The International Cyber Threat Task Force is a not-for-profit initiative promoting the ecosystem of an International independent non-partisan cyber security community.

Corsearch

Corsearch

Combining AI-powered technology and decades of industry expertise, Corsearch is revolutionizing how companies establish and protect their brands.

Framework Security

Framework Security

With Framework Security, you get more than a consultancy; you get a partner dedicated to simplifying cybersecurity and protecting your business in the most efficient way possible.

Cynch Security

Cynch Security

Cynch Security are passionate about building a world where every business is resilient to cybersecurity risks, no matter what their size.