New British Telecoms Security Law

The British government has introduced new security rules and duties for telecoms companies in a move to ensure further protection from cyber threats. The Telecommunications (Security) Bill aims to give the government unprecedented new powers to boost the security standards of the UK’s telecoms networks and remove the threat of high-risk vendors.
 
The Bill will strengthen the security framework for technology used in 5G and full fibre networks including the electronic equipment and software at phone mast sites and in telephone exchanges which handle internet traffic and telephone calls.
 
This will be a significant step to protect the UK from hostile cyber activity by state actors or criminals. Over the past two years the Government has attributed a range of cyber attacks to Russia and China, as well as North Korea and Iranian actors.
 
The Bill will also provide the Government with new national security powers to issue directions to public telecoms providers in order to manage the risk of high-risk vendors, principally targeting the leading Chinese telecoms infrastructure company, Huawei. While Huawei are already banned from the most sensitive ‘core’ parts of the network, the Bill will allow the Government to impose controls on telecoms providers’ use of goods, services or facilities supplied by high risk vendors.
 
Companies which fall short of the new duties or do not follow directions on the use of high-risk vendors could face heavy fines of up to ten per cent of turnover or, in the case of a continuing contravention, £100,000 per day. Ofcom will be given the duty of monitoring and assessing the security of telecoms providers.
 
In July, following advice from the National Cyber Security Centre (NCSC), the government announced new controls on the use of Huawei 5G equipment, including a ban on the purchase of new Huawei equipment from the end of this year and a commitment to remove all Huawei equipment from 5G networks by 2027. 
 
The Bill creates the powers that will allow the government to enshrine those decisions in law and manage risks from other high-risk vendors in the future. Digital Secretary Oliver Dowden said: We are investing billions to roll out 5G and gigabit broadband across the country, but the benefits can only be realised if we have full confidence in the security and resilience of our networks.... This groundbreaking bill will give the UK one of the toughest telecoms security regimes in the world and allow us to take the action necessary to protect our networks.”
 
Currently, telecoms providers are responsible by law for setting their own security standards in their networks. However, the Telecoms Supply Chain Review concluded by the government last year found providers often have little incentive to adopt the best security practices. As part of the new bill, fines of up to 10% of turnover, or £100,000 per day, have been planned for failure to meet standards, and the UK communications regulator Ofcom will be responsible for monitoring and assessing the security of telecoms providers.
 
To deliver the revolutionary economic and social benefits of 5G and gigabit-capable broadband connections, the government has decided to strengthen the overarching legal duties on providers of UK public telecoms networks and services as a way of incentivising better security practices.
 
These duties will mean telecoms providers will need to take appropriate action to bring in minimum security standards for their networks and services and to limit the damage of any breaches.
 
The Bill will allow the government to issue specific security requirements that providers will need to follow to meet these duties. These requirements will be set out in secondary legislation, but are likely to involve companies acting to:
 
  • Securely design, build and maintain sensitive equipment in the core of providers’ networks which controls how they are managed.
  • Reduce the risks that equipment supplied by third parties in the telecoms supply chain is unreliable or could be used to facilitate cyber-attacks.
  • Carefully control who has permission to access sensitive core network equipment on site as well as the software that manages networks.
  • Make sure they are able to carry out security audits and put governance in place to understand the risks facing their public networks and services.
  • Keep networks running for customers and free from interference, while ensuring confidential customer data is protected when it is sent between different parts of the network.
New codes of practice will demonstrate how certain providers should comply with their legal obligations. The British 
telecoms regulatory authority, Ofcom, will be given stronger powers to monitor and assess operators’ security, alongside enforcing compliance with the new law.
 
This will include carrying out technical testing, interviewing staff, and entering operators’ premises to view equipment and documents.
 
Markets across the world have become overly reliant on too few vendors due to a lack of competition in the global telecoms supply chain. The government has been engaging extensively with operators, vendors and governments around the world and will soon publish its 5G Diversification Strategy to address this issue. The strategy will outline new measures to boost competition and innovation in the telecoms supply chain and reduce dependence on individual suppliers.
 
GovUK:          GovUK:       Information Age
 
You Might Also Read:
 
British Spies Find Big Software Problems With Huawei:
 
 
 
« NCSC Come Off Bench To Help Manchester United
Diving Into The Dark Web »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

AVG Technologies

AVG Technologies

AVG is focused on providing home and business computer users with the most comprehensive and proactive protection against computer security threats.

DG Technology

DG Technology

DG Technology is a customer-centric technology expert and business consultant that delivers services and products to minimize your information security, compliance, and business risks.

EdgeWave

EdgeWave

EdgeWave provides simple but highly effective data security and advanced threat protection in solutions that are affordable, scalable and easy to use.

Plixer

Plixer

Plixer delivers a network traffic analytics system used for monitoring, visualization, and reporting of network and security incidents.

SafenSoft (SnS)

SafenSoft (SnS)

SafenSoft delivers high-efficiency, low-impact proactive protection against malware, insider threats, and confidential data leakage.

NLnet Labs

NLnet Labs

NLnet Labs is a not-for-profit foundation with a long heritage in research and development, Internet architecture and governance, as well as security in the area of DNS and inter-domain routing.

Cybersecurity Innovation Hub

Cybersecurity Innovation Hub

The main objective of the Hub is to bring cybersecurity and other advanced technologies closer to companies and as a result help to increase their performance as Industry 4.0.

NSEIT

NSEIT

NSEIT offers end-to-end Information Technology products, solutions and services including cybersecurity to organizations in the financial sector.

Mjenzi Cloud

Mjenzi Cloud

Mjenzi Cloud is a provider of cloud IaaS solutions including managed backup services, affordable & secure cloud virtual compute/storage/compute services, bare-metal services and cloud security.

LBMC

LBMC

LBMC is a professional services solutions provider in accounting and finance, human resources, technology, risk and information security, and wealth advisory services.

Stronghold Cyber Security

Stronghold Cyber Security

Stronghold Cyber Security is a consulting company that specializes in NIST 800, the Cybersecurity Framework and the Cybersecurity Maturity Model Certification.

Accenture

Accenture

Accenture is a leading global professional services company providing a range of strategy, consulting, digital, technology & operations services and solutions including cybersecurity.

MiC Talent Solutions

MiC Talent Solutions

MiC Talent Solutions provides recruiting, direct hire, augmented staff, and professional service contracting solutions for organizations searching for minority cybersecurity talent.

Cyber Capital Partners

Cyber Capital Partners

Cyber Capital Partners build strategic and financial partnerships with small and mid-sized cybersecurity companies in highly regulated markets.

Resillion

Resillion

Resillion (formerly Eurofins Digital Testing) is a global leader in quality engineering and cyber security services with operations in Europe, US, UK, India and China.

Security Solutions Services (S-3)

Security Solutions Services (S-3)

S-3 specialize in crafting tailored network design, security hardware, software, and storage solutions for businesses of all sizes.