SMEs need new cyber habits
March 2019
UK: A Cyber Power
It is little surprise that the internet has become a political weapon. Considering the way in which we have networked citizens, businesses and countries across the world wide web – with so much sensitive data now online – it naturally follows that nation states will start using this powerful resource as a means of collecting intelligence, monitoring and subversion.
That said, the scale of cyber interference for political purposes has recently, noticeably, stepped up. My colleague and Nominet’s CISO Cath Golding recently published a blog on the spate of DNS hijacking attempts that appear to be coming from the Middle East and are suggestive of cyber warfare. This follows other politically-influenced cyber attacks of recent years, including the interference in the US elections and the multiple cyber attacks launched against Ukraine.
Here in the UK, our Government, and particularly the National Cyber Security Centre (NCSC), is well aware of the changing nature of cyber threats and has already made bold moves to signal to the world that we are prepared. In October last year, Ciaran Murphy, NCSC director, admitted that themajority of cyber attacks come from ‘hostile states’ and predicted that the country would soon face a category 1 attack. These pronouncements came soon after NCSC publicly accused the Russian military intelligence service for being behind a campaign of cyber attackers targeting political institutions, among others.
A more recent show of strength came at CyberUK, the Government’s flagship cyber security conference. In his opening address, Jeremy Fleming, Director of GCHQ, outlined ambitions for the UK to become a global ‘Cyber Power’ by providing world-class protection for the digital homeland, creating the legal and regulatory regimes to instil public trust, and having the confidence to wield said cyber power against nation states in times of attack. In short, we are preparing the country to partake in cyber warfare as and when required.
These are bold aims and demonstrate the strident way in which cyber security is being approached by our leaders in the face of increased threats from other nation states. The emphasis on securing the ‘digital homeland’ is the first crucial step in this journey, and is something that Nominet will be able to play a part in.
As the registry for the .UK domain, our responsibility for keeping the country’s internet namespace secure is one we take seriously and conscientiously. We are well versed in top tier security operations and much of our cyber security expertise has been focused on securing the networks we work across, most notably the domain name system (DNS). In the two decades in which we have acted as registry, we have developed tools that use robust network analytics software to turn the traffic moving across the DNS into actionable intelligence that helps to protect our systems.
Our track record is impeccable, and the innovative tools we use attracted the attention of NCSC, for whom we now run a similar service to protect the Public Services Network. This forms part of the NCSC Active Cyber Defence strategy, which has just past its two-year anniversary, and our service has “blocked access 54.47 million times” to risky sites since introduction, according to latest available figures.
There are plenty of other recent successes for the country to celebrate when it comes to the health of the namespace. For example, it was announced at CyberUK that UK’s share of global phishing sites has reduced to 2% from over 5%, and HMRC has tumbled down from 15th most phished brand globally in 2016 to 146th today. Still, challenges will continue to come, and the current issue being addressed is of online harms and how to reduce them. A recent Government whitepaper has set out the issues and proposals for tackling it, including introducing a code of practice for tech companies.
This forms part of the national effort towards protecting individuals from the risks of being online, which remains just as important as ever considering recent statistics in the NCSC’s first UK Cyber Survey. The survey, released in April, found that while 89% of Britons use the internet to make online purchases, only 15% of people feel they know how to protect themselves online.
Such statistics, as Jeremy noted in his speech, highlights the need for security by design when it comes to new digital devices, and for infrastructure that is robust and secure, taking the onus for security away from the individual. This has been much debated recently, as the news that the Government was considering using Huawei technology on sections of the 5G data network was leaked.
In addition to being strong within, we are also looking outwards and seeking international collaboration with our allies across the world. CyberUK brought together representatives from the five countries within the ‘Five Eyes’ intelligence alliance; UK, USA, Canada, Australia and New Zealand. This public show of solidarity between national intelligence agencies was powerful and demonstrative of the ways in which our country balances independence with collaboration to keep the internet safe.
Cyber security is a constant journey, and one that may have entered a tricky stage as political cyberwarfare takes an upswing. That said, CyberUK served to remind us of the technical expertise, the strong leadership and the powerful connections our country has, not to mention the progress already being made to keep the nation secure. We may live in threatening times, but we are striding towards a digital future in which our nation remains a Cyber Power, regardless of the activity of our foes.
Originally posted here.
