The document heralds “a new era of unprecedented co-operation” between the Government and the private sector on cyber security, with the two working hand-in-hand to make the UK one of the most secure places in the world to do business.
Around 6% of the UK’s GDP is generated by the Internet and that figure is set to grow, making it a larger sector than either utilities or agriculture. With the Internet boom predicted to create 365,000 jobs over the next five years, the Government wishes to create “new opportunities for businesses” and “help build a thriving cyber security industry”.
An increasing dependence on digital technologies has given rise to new risks. For example, there are more than 20,000 malicious e-mails on Government networks each month, 1,000 of which are deliberately targeted.
The Government has already ranked cyber security as a Tier 1 national security priority and committed GB pound 650 million over the next four years to bolster its cyber defences. The UK is also leading the way on the world stage, earlier this month hosting the London Conference on Cyberspace to drive forward international dialogue on building a secure digital world.
Official view from 10 Downing Street
Speaking about this latest development, Prime Minister David Cameron said: “While the Internet is undoubtedly a force for social and political good, as well as crucial to the growth of our economy, we need to protect against the threats to our security. This strategy not only deals with the threat from terrorists to our national security, but also with the criminals who threaten our prosperity as well as blight the lives of many ordinary people through cyber crime.”
He added: “Cyber security is a top priority for Government and we will continue to work closely with the police, the security services, international partners and the private sector to ensure that the UK remains one of the most secure places in the world to do business.”
Minister for Cyber Security Francis Maude commented: “The growth of the Internet has revolutionised our everyday lives and promises untold economic and social opportunities in years to come. This strategy sets out how we will realise the full benefits of a networked world by building a more trusted and resilient digital environment, from protecting the public against online fraud to securing critical infrastructures against cyber attacks.”
Maude continued: “The Government cannot do this alone. Closer partnership between the public and private sector is crucial. The strategy heralds a new era of unprecedented co-operation between the Government and industry on cyber security, working hand-in-hand to make the UK one of the most secure places in the world in which to do business.”
Comment from the cyber crime minister
Minister for Cyber Crime James Brokenshire explained: “We want to ensure that everyone can make the most of the Internet and online services while protecting themselves from crime. The new National Crime Agency will share knowledge and expertise across law enforcement agencies, building on the pioneering work already carried out by the Metropolitan Police Service and SOCA.”
Brokenshire went on to state: “We are also reaching out to industry and the public to get involved. We all have a role to play in keeping ourselves and our families safe while enjoying the huge opportunities and benefits of surfing the Internet.”
Minister for Business and Enterprise Mark Prisk said: “With one of the largest online economies in the world, valued at GB pound 100 billion a year, cyberspace is vital for the UK’s economic prosperity. However as well as bringing opportunities for businesses and their customers, cyberspace also brings threats. That’s why it’s important we help all companies, from big multinationals to our small businesses to take some simple, practical measures to protect themselves and their customers online.”
Summary of key actions in the strategy
The Cyber Security Strategy outlines how the Government will take the opportunity to promote growth and minimise the economic impact of cyber attacks by cementing a new partnership with the private sector. The Government will do this by:
- Pioneering a joint public/private sector cyber security ‘hub’: This will allow the Government and the private sector to exchange actionable information on cyber threats and manage the response to cyber attacks. A pilot will begin in December involving five business sectors: defence, telecoms, finance, pharmaceuticals and energy.
- Exploring ways in which GCHQ expertise can benefit economic growth: GCHQ is the home of world class expertise in cyber security. The Government will explore ways in which that expertise can more directly benefit economic growth and support the development of the UK cyber security sector without compromising the agency’s core security and intelligence mission. For example, options examined might include working with private sector partners to explore the potential commercial applications for GCHQ’s unique expertise. Also, working with BIS, the Technology Strategy Board and the Engineering and the Physical Sciences Research Council (EPSRC) to explore strategic vehicles for bringing together industry, academia and Government to exploit the latest innovations in cyber security in order to increase prosperity and security for the UK in cyberspace. In addition, there’s the idea of a Government-sponsored venture capital model to unlock innovation on cyber security in SMEs.
- Supporting SMEs: The Government will ensure smaller companies can play their part as drivers of new ideas and innovation by bringing forward proposals as part of the Growth Review to help SMEs fully access the value of public procurement. This will include setting an expectation that at least 25% of the value of Government cyber security contracts goes to SMEs.
- Encouraging industry-led cyber security standards for private sector companies: UK businesses could use this as a competitive edge by promoting themselves as certifiably cyber secure. BIS will work with domestic, European, global and commercial standards organisations to accelerate this work.
- Promoting the UK’s cyber security industry abroad: UK Trade and Investment (UKTI) will work with the security sector’s trade associations to ensure that this increasing domestic strength is leveraged to help UK firms sell abroad.
Cyber Security Strategy: some of the basic commitments
On tackling cyber crime, the strategy sets out commitments to:
- Expand the use of ‘Cyber Specials’ to help the police tackle cyber crime: The Metropolitan Police Service’s Police Central e-crime Unit (PCeU) has made groundbreaking use of Police Specials with relevant specialist skills to help tackle cyber crime. The Government will encourage all police forces to make use of ‘Cyber Specials’. It will involve people from outside law enforcement to help tackle cyber crime as part of the National Crime Agency Cyber Crime Unit.
- Create a Cyber Crime Unit within the National Crime Agency by 2013: This will help deal with the most serious national level cyber crime and to be part of the response to major national incidents. It will draw together the work of the e-Crime Unit in SOCA and PCeU and provide support to all elements of the National Crime Agency, as well as all police forces.
- Encourage the police and the courts to make more use of existing cyber sanctions for cyber offences: Additional powers are already available when there is strong reason to believe someone is likely to commit further serious cyber crime offences. For example, a range of terms – including restriction on access to the Internet and prohibition from using instant messaging services – have been used to restrict the ability of organised criminals to commit online fraud. The Government will publish new guidance aimed at increasing the use of cyber sanctions for cyber offences.
- Make it easier to report financially motivated cyber crime by establishing a single reporting system for businesses and the public: Action Fraud – the national fraud reporting and advice centre run by the National Fraud Authority – will become the central portal for reporting any financially motivated cyber crime.
Cyber Security Strategy: confronting high end threats
In order to confront high end threats, the strategy sets out commitments to:
- Create a new Defence Cyber Operations Group in the MoD. This will include a Joint Cyber Unit hosted by GCHQ which will develop new tactics, techniques and plans to deliver military cyber capabilities. The Government will also consider the future contribution of reservists in providing access to specialist cyber knowledge and skills. The new Joint Forces Command, led by a Four Star military officer, will take the lead in developing and integrating defence cyber capabilities from April 2012.
- Protect the Critical National Infrastructure (CNI): On behalf of Government, the Centre for Protection of the National Infrastructure is already working with a network of CNI companies to ensure that they take the necessary steps to protect key systems and data. The Government will now work to increase its reach to companies that would not ordinarily be considered part of the critical infrastructure, but collectively they represent and important part of our economy. For example, businesses that innovate and develop new intellectual property.
Cyber Security Strategy: prevention and raising public awareness
On prevention and raising public awareness, the Cyber Security Strategy sets out commitments to:
- Bolster the role of Get Safe Online: Everyone has a crucial role to play in keeping cyberspace safe, including the public. Get Safe Online already provides independent, trustworthy advice on staying safe on the Internet. The Government is increasing its investment to make Get Safe Online the single, authoritative place to go for the public to get the latest information on Internet threats and the simple steps they can take to protect themselves.
- Work is already underway to improve Get Safe Online’s web presence in early 2012 with a new, more interactive website, drawing on user feedback on products to help inform consumer choices. The website will also use an NHS Direct ‘triage’-style of system to guide people through a diagnosis and to give them direct guidance on how to solve their cyber security problems.
- Develop ‘kitemarks’ for cyber security software: This will help consumers and businesses navigate the range of cyber security solutions available, allowing them to make more informed choices and avoid unnecessary ‘scareware’.
- Seek to agree a set of voluntary ‘guiding principles’ with Internet Service Providers (ISPs): This could include seeking agreement with ISPs on the support they might offer to Internet users to help them identify, address and protect themselves from malicious activity on their systems.
Cybder Security Strategy: research, education and training
On research, education and training, the Cyber Security Strategy sets out commitments to:
- Identify Centres of Excellence in cyber security research and provide investment to plug any gaps: this will improve the Government’s research capabilities and expand the number of people with the highest levels of skills and knowledge in cyber security.
- Improve cyber security at all levels of education (so that people are better equipped to go online safely).
- Establish a scheme to certify cyber security specialists by March 2012 (this will drive up the skills levels of information assurance and cyber security professionals).
If you would like to read the all-new Cyber Security Strategy in full click here