Can the new National Cyber Strategy make the UK a security leader?

An immi­nent cyber attack is an inevitabil­i­ty. Research by cyber­se­cu­ri­ty firm Trend Micro shows that more than three-quar­ters of glob­al organ­i­sa­tions expect to be suc­cess­ful­ly hacked in the next 12 months.

Changes to the way we work have increased the like­li­hood of cyber­se­cu­ri­ty breach­es. Remote work­ing and cloud com­put­ing are high­light­ed as two of the most high-risk fac­tors. The cur­rent geopo­lit­i­cal cli­mate is anoth­er sig­nif­i­cant fac­tor. The Five Eyes intel­li­gence alliance warned recent­ly of increased mali­cious cyber activ­i­ty from Rus­sia, since the inva­sion of Ukraine. 

The rev­e­la­tion that details of UK gov­ern­ment employ­ees appeared on Russ­ian sites makes the suc­cess of the UK government’s recent­ly revised cyber­se­cu­ri­ty strat­e­gy even more cru­cial to secure the coun­try and busi­ness­es with­in it.

In Jan­u­ary, the UK government’s Nation­al Cyber Strat­e­gy set out its three-year vision to improve the country’s dig­i­tal resilience. It focus­es on five pil­lars: strength­en­ing the cyber ecosys­tem, improv­ing resilience, devel­op­ing new tech­nolo­gies, inter­na­tion­al influ­ence and coun­ter­ing threats. It lays out plans to expand the exist­ing approach of 2016 to 2021, with the ambi­tion of mak­ing the UK a glob­al leader in cyber. 

Dan Pate­field is head of the cyber and nation­al secu­ri­ty pro­gramme at TechUK. He believes the Nation­al Cyber Strat­e­gy con­tin­ues “the robust lead­er­ship” the UK gov­ern­ment has tak­en across the cyber domain over the past decade. “The UK has built strong foun­da­tions, enabling the indus­try to strength­en its cyber resilience in the face of the ever-grow­ing threat land­scape,” he says.

One of the key dif­fer­ences between the pre­vi­ous strat­e­gy and the revised one is the onus it places on the whole of soci­ety to improve the country’s cyber capa­bil­i­ties. Although it is a gov­ern­ment-led strat­e­gy, there is a much greater empha­sis on the respon­si­bil­i­ty of the pri­vate sec­tor and cit­i­zens to man­age cyber risks.

As Chan­cel­lor of the Duchy of Lan­cast­er, Steve Barclay’s respon­si­bil­i­ties include over­sight of the Cab­i­net Office’s cyber secu­ri­ty remit. At the strategy’s launch, he said: “The new Nation­al Cyber Strat­e­gy sets out a clear vision for build­ing cyber exper­tise in all parts of the coun­try, strength­en­ing our offen­sive and defen­sive capa­bil­i­ties and ensur­ing the whole of soci­ety plays its part in the UK’s cyber future.”

This change in tack is one that David Woodfine, man­ag­ing direc­tor of Cyber Secu­ri­ty Asso­ciates, wel­comes. “Peo­ple mis­tak­en­ly think cyber is all about tech­nol­o­gy,” he says. “But it isn’t. Cyber­se­cu­ri­ty involves peo­ple, process­es, cul­ture and soci­ety. By focus­ing on the cyber ecosys­tem of the UK, we’re not just rely­ing on the big tech­nol­o­gy com­pa­nies to pro­tect us, we’re encour­ag­ing every­one to be more cyber secure and improve aware­ness.” 

Ran­somware is mal­ware that tar­gets indi­vid­u­als and is “the most sig­nif­i­cant cyber threat” fac­ing the UK, warned the Nation­al Cyber Secu­ri­ty Cen­tre in its 2021 review. Sim­i­lar­ly, Verizon’s 2021 Data Breach Inves­ti­ga­tions Report showed that 85% of attacks involved a human ele­ment, high­light­ing the need for greater edu­ca­tion in cyber­se­cu­ri­ty across the board and jus­ti­fy­ing the Nation­al Cyber Strategy’s soci­ety-wide approach.

Woodfine was involved in the devel­op­ment of ear­li­er iter­a­tions of the UK’s nation­al cyber­se­cu­ri­ty strate­gies when he was at the Min­istry of Defence. He says: “In some regards, peo­ple are our weak­est points in cyber defence. But if we get it right, peo­ple can equal­ly be our strongest defence mech­a­nism.”

There is also an empha­sis on resilience through­out the new strat­e­gy. Dayne Tur­bitt is senior vice pres­i­dent and UK gen­er­al man­ag­er of Dell Tech­nolo­gies, which worked close­ly with the UK gov­ern­ment to help devise its cyber strat­e­gy. He thinks resilience is “crit­i­cal”. 

The fore­word of the strat­e­gy ref­er­ences the impor­tance of using tech­nol­o­gy sup­pli­ers that share the UK’s val­ues. This pro­vides an open­ing for UK-based tech­nol­o­gy com­pa­nies to work across the country’s crit­i­cal nation­al infra­struc­ture. “It gives a great oppor­tu­ni­ty for us here in the UK to serve our cus­tomers and help them through their cyber strat­e­gy,” he says.

Anoth­er impor­tant pil­lar of the new strat­e­gy is strength­en­ing the UK’s cyber ecosys­tem, cit­ing the need for a more “diverse and tech­ni­cal­ly skilled work­force” to cre­ate a more inter­na­tion­al­ly com­pet­i­tive sec­tor. Cur­rent­ly, more than half (53%) of the UK’s 1,838 cyber secu­ri­ty firms are reg­is­tered in Lon­don and the South East, employ 45% of the country’s cyber pro­fes­sion­als and account for 91% of exter­nal invest­ment. To address this region­al imbal­ance, cyber clus­ters – 12 gov­ern­ment-fund­ed organ­i­sa­tions locat­ed across the length and breadth of the UK – are being instruct­ed to strength­en their links between local busi­ness and acad­e­mia and to encour­age greater col­lab­o­ra­tion across the UK.

As chair of Gloucester’s Cyber Tech group, Woodfine has seen how clos­er inter­ac­tions between schools, uni­ver­si­ties and busi­ness­es can improve path­ways for peo­ple to get into the cyber indus­try. 

“The strat­e­gy pro­vides a good build­ing block but what I would like to see now is a more con­crete plan,” Woodfine says. “We can see the strate­gies and the plan for the next 36 months but as a busi­ness own­er, I’d like to know how I can influ­ence it and under­stand how we’re going to pro­tect the UK dig­i­tal infra­struc­ture of the future.”

There is also an empha­sis on improv­ing edu­ca­tion and skills in this area. There has long been a dig­i­tal skills gap in the UK; Tur­bitt describes cyber tal­ent as “rare as hen’s teeth”.

The strat­e­gy doc­u­ment promis­es to “expand the nation’s cyber skills at every lev­el” but there are few details on how this can be achieved, beyond upskilling teach­ers and encour­ag­ing more young peo­ple to take up cyber. 

“Arguably, the gov­ern­ment hasn’t done enough to increase the take-up of STEM sub­jects. But it isn’t just the respon­si­bil­i­ty of the gov­ern­ment,” he says. “It’s the respon­si­bil­i­ty of indus­try, in part­ner­ship with the gov­ern­ment, to fig­ure out how we address this and any spot­light on this top­ic is a great thing.”  

As an ini­tial doc­u­ment, there seems to be wide agree­ment that the Nation­al Cyber Strat­e­gy address­es many of the key chal­lenges cur­rent­ly fac­ing the sec­tor. Tur­bitt believes that it’s now up to the pri­vate sec­tor to “step into the breach”. 

“What will fol­low from this is invest­ment of pub­lic mon­ey in these areas, and it will then be behold­en to UK indus­try to work with­in that frame­work to go and exe­cute it,” he adds.