The United Kingdom (U.K.) Chancellor of the Exchequer announced $2.1 billion in cybersecurity investments on Tuesday as part of the government’s new National Cyber Security Strategy For 2016-2021.
Philip Hammond MP, U.K. Chancellor of the Exchequer, said that given the country’s reliance on cyberspace in infrastructure, government, and the commercial sector, the technological advancements bring risks as well as opportunities. “We need a secure cyberspace-and we need to work together business and government to deliver it,” he said in a speech in London.
To meet the cyber risks and threats, Hammond announced the government’s new five-year national cyber security strategy, which includes $2.1 billion in new investments and focuses on three pillars of defend, deter, and develop.
Hammond emphasized the importance of the new document. “It is a key component of the government’s ambition for Britain to be the best place in the world to run a tech business. And it sets out clearly how we intend to develop our partnerships with business to achieve that.”
On the defense pillar Hammond said, “We will strengthen the defenses of government, our critical national infrastructure sectors like energy and transport, and our wider economy. We will work in partnership with industry to apply technologies that reduce the impact of cyber-attacks, while driving up security standards across both public and private sectors.”
Practically, the new defense measures entail the government taking a more active cyber defense approach like supporting industry’s use of automated defense techniques to block/disrupt/neutralize malicious activity before it reaches the user, blocking malware attacks by using Domain Name System (DNS) blocking/filtering, using government network email verification systems to prevent phishing attacks through domain spoofing, and investing in government cyber defense programs to enhance their ability to respond to serious cyber attacks.
The government also is looking at making future commercial and government online products and services secure by default, encourage greater security measures, protect government services and provide support to industry when attacks, work to change public and business cyber behaviors, and properly manage incidents.
“We are already deploying active cyber defense in government and we know it works: we’ve already successfully reduced the ability of attackers to spoof government e-mails as a key example,” Hammond said, referencing how the government has already significantly reduced the spoofing of emails purportedly sent from the .gov.uk domain (Defense Daily, Sept. 16).
“The public have much to gain from active cyber defense and, with the proper safeguards in place to protect privacy, these measures have the potential to be transformational in ensuring that UK internet users are secure by default.”
Regarding deterrence, the chancellor said the government is strengthening law enforcement capabilities to raise the cost and reduce the reward of cyber criminality to ensure they can track, apprehend, and prosecute those who commit cyber crimes.
He also reiterated that the U.K. “will continue to invest in our offensive cyber capabilities, because the ability to detect, trace and retaliate in kind is likely to be the best deterrent.”
This is because a small amount of hostile foreign actors have developed and deployed offensive cyber capabilities that threaten the U.K.’s critical infrastructure and industrial control systems (ICS). “If we do not have the ability to respond in cyberspace to an attack which takes down our power networks leaving us in darkness, or hits our air traffic control system, grounding our planes, we would be left with the impossible choice of turning the other cheek and ignoring the devastating consequences, or resorting to a military response,” Hammond said.
He used this example of a nonresponse or kinetic military response as why the government must develop a fully functional and operational cyber counter-attack capability.
“There is no doubt in my mind that the precursor to any future state-on-state conflict would be a campaign of escalating cyber-attacks, to break down our defenses and test our resolve before the first shot is fired.”
Therefore, the government states it will both defend itself in cyberspace and strike back in kind when attacked using cyber means, Hammond said.
He also explained that the U.K. will increase investment in students, experts and companies to further develop cyber capabilities.
As part of this effort Hammond announced the U.K. is creating its latest cyber security research institute as a virtual network of U.K. universities dedicated to technological research with government funding support. This institute will focus on hardware and look to improve the smart phone, tablet, and laptop security “through innovative use of novel technology.”
The U.K. is also building cybersecurity into the education system and committing to provide opportunities for young people to pursue careers in cybersecurity. The government is also working to make sure “that every young person learns the cyber life-skills they need to use the internet safely, confidently and successfully,” Hammond said.
He highlighted these efforts will be supported by the previously announced National Cyber Security Centre (NCSC) in London.
“For the first time the government will have a dedicated, outward-facing authority on cyber – making it much simpler for business to get advice on cyber security and to interact with government on cyber security issues,” he said.
The NCSC will also act as a rapid response force for major cyber incidents, encompassing the U.K. CERT (Computer Emergency Readiness Team).
The chancellor also noted that chief executives and boards of businesses must also recognize their responsibility in managing cyber risks, akin to any other operational risk.
“Similarly, technology companies – many of whom are represented here today – must take responsibility for incorporating the best possible security measures into the design of their products,” he added.
Hammond also emphasized that these new plans add to earlier government actions including:
- A 2015 investment of nearly $1.1 billion over five years to enhance the government’s capabilities to protect government networks, improve incident response, and confront cyber crime;
- establishing 13 academic centers of excellence specializing in developing cybersecurity research and innovation;
- the government’s 2015 Strategic Defence and Security Review classified cyber as a Tier One threat to the U.K.; and
- the establishment of a permanent Cyber Committee consisting of Cabinet Ministers.