Global Matters

Cyberspace and the National Security of the UK

Yesterday evening I attended the launch of Chatham House's important report on Cyberspace and National Security entitled "Cyberspace and the National Security of the United Kingdom: Threats and Responses". This report is part of the first stages of research and seeks to identify threats and begin to examine methods for analysis and response.

 

The authors, Dr Paul Cornish, Dr Rex Hughes and David Livingstone, are pioneering discussion on deployment of proactive, interventionist resources against internet based attackers, following an assessment and understanding of the "business processes" of adversaries. This approach of disruption of cyber-criminals is hugely different to the current practice of pure security by defence.

 

The full report is available from Chatham House.

 

There is an argument that this may require greater control of the internet by government and there were mentions of protection of rights and freedoms. Perhaps this requirement for control is in fact not necessary and just a natural reaction to decades of government control of UK communications infrastructures (postal and conventional switched telecoms with GPO).

 

The challenges faced from crime and compromise of critical infrastructure require action in a more co-ordinated way. Due to the highly distributed nature of the internet, society faces challenges ranging from fraud and identity theft to loss of vital means of communication and loss of infrastructure critical systems. The report also considers full-scale state sponsored cyber-warfare. Current responses are not part of any cohesive strategy.

 

Whilst enterprise and government systems will be easier to govern (or to co-ordinate better self governance), in my opinion the greatest challenge will be defining strategies which can be adopted to control the huge platform of private systems owned by individuals and to an even greater extend owned by small business, itself accounting for a huge proportion of total IT systems and infrastructure. According to Graham Cluley, senior technology consultant at Sophos, involuntary use of poorly protected PCs as botnets to launch cyber attacks "is a prime way in which criminals these days commit crime".

Cyber Security - A Small Business Perspective

On 2nd February 2009, Dr Paul Cornish completed an important manuscript for a study requested by the European Parliament's Committee on Foreign Affairs entitled "Cyber Security and Politically, Socially and Religiously Motivated Cyber Attacks."

The paper examines the nature of the threats in some detail and prevents an up to date assessment of the nature and source of potential attack and significantly, a detailed analysis of initiatives being taken by global organisations to counter these risks.

It is clear from evidence within this document and from other studies that of course there is work to be done. My interest focuses on one aspect of future work on cyber security. Small business has vast ownership of, and control over global IT infrastructure - this infrastructure is less secure and likely to continue to a major source of security threats to the global infrastructure - future efforts on cyber security must take this sector into account.

It is my intention to research and publicise my findings and evidence on this. There is a detailed abstract online which is currently very much a work in progress. I am seeking input and contribution from relevant colleagues and interested people generally to formulate what I hope will become a useful resource.