The Roaring Twenties: Future foreign policy will rely on rejuvenated 'cyber' sector, UK government claims
(2021/03/18)
- Reference: 1616059807
- News link: https://www.theregister.co.uk/2021/03/18/ukgov_integrated_review_cyber/
- Source link:
The British government has published its [1]Integrated Review into defence and security policy – and though you'll like it if you're in the UK infosec industry, threats of nuking North Korea in revenge for WannaCry are very wide of the mark.
While the Cyber-Integrated Cyber-Review of Cyber-Security, Cyber-Defence, Cyber-Development and Cyber-Foreign Cyber-Policy was cyber-short on cyber-concrete cyber-promises, it did use the word "cyber" 114 times.
[2]
Yet in terms of "things that will flow from this" the Integrated Review (IR) mentioned only the National Cyber Security Centre and the nascent National Cyber Force, both already in existence. The IR was long on ambition but clothed in the impenetrable language of defence and management consultancy. A sample of it reads as follows:
We will adopt a comprehensive cyber strategy to maintain the UK's competitive edge in this rapidly evolving domain. We will build a resilient and prosperous digital UK, and make much more integrated, creative and routine use of the UK's full spectrum of levers – including the National Cyber Force's offensive cyber tools – to detect, disrupt and deter our adversaries.
[3]
Under the heading "responsible, democratic cyber power" the government promised to "use cyber capabilities to influence events in the real world," including more use of "offensive cyber" – and, eye-catchingly for the UK infosec sector, UK.gov plans to build "an advantage in critical cyber technologies."
Try to avoid thinking of the internet as a flashy new battlefield, warns former NCSC chief [4]READ MORE
Offensive cyber is what ordinary people call "state-backed hacking". Two years ago the then Foreign Secretary, Jeremy Hunt, [5]said in a major speech : "If cyber interference were to become commonplace, the danger is that [6]authoritarian states would damage public confidence in the very fabric of democracy."
One would hope that policymakers have been paying attention to the former head of NCSC, Ciaran Martin, who [7]publicly warned in late 2020 that all this warlike talk neither contributes to international peace nor helps anyone understand what the hell UK.gov actually intends on doing.
Hunt's far-sighted speech, taken together with the Integrated Review, could be seen today as a warning that British foreign policy for the 2020s will contribute further to international instability – especially after the Ministry of Defence spun a temporary increase in nuclear missile warheads as meaning that the UK would nuke state-backed attackers.*
Cyberup campaign: 80% of infosec pros fear they might fall foul of UK's outdated Computer Misuse Act [8]READ MORE
Britain's so-called "whole of nation approach" to cyber policy and capabilities in the post-Brexit world will, so we're told, rest on UK.gov "supporting a UK research base that can compete with allies and adversaries" and nurturing an industry capable of delivering "innovative and effective cyber security products" – something that may warm even the hearts of the occasionally jaded infosec industry.
Yet the creation of a bigger infosec industry that successfully competes on a commercial footing with products and services from the US and infosec powerhouse Israel is years away; individual British SMEs employ fine and talented people but the only truly global infosec company the UK has ever produced is Sophos. It's a crowded marketplace out there too, with thousands of companies competing for business.
R&D
It's not only the infosec industry that's mentioned in the review; the government wants "to take the lead in the technologies vital to cyber power, such as microprocessors, secure systems design, quantum technologies and new forms of data transmission."
Quantum (as in cryptography) seems to be one of those marketing buzzwords that crept into the report; the tech [9]is about 15 years away from becoming reality .
While there won't be any sleepless nights in Silicon Valley or Shenzhen after political leaders in those places read about Britain's wider tech ambitions, the review's contents bode well for companies looking to base R&D departments in the UK – perhaps building on the international reputations of Cambridge and Manchester.
Indeed, the latter is receiving specific attention; the National Cyber Force [10]will be based in the city , as UK.gov briefed the press on Sunday. Manchester University has close links to spy agency GCHQ and a significant amount of the British infosec industry is already based there.
Mop-topped Prime Minister Boris Johnson said in a statement: "Cyber power is revolutionising the way we live our lives and fight our wars, just as air power did 100 years ago. We need to build up our cyber capability so we can grasp the opportunities it presents while ensuring those who seek to use its powers to attack us and our way of life are thwarted at every turn."
The review did not, however, mention anything about changes to the law to allow British firms to compete on an equal footing with [11]overseas infosec companies , particularly in the areas of threat intelligence and research. Industry has tried making noises about this in the past but they have largely fallen on deaf ears in Westminster.
Kevin Bocek, VP security strategy and threat intelligence at US machine identity firm Venafi, opined that the review was a good thing for his business and urged UK.gov to send more cash its way, saying: "So far there has been too much emphasis on trying to change people's behavior in cyberspace but attackers have moved on to target the machines that make autonomous, millisecond decisions. Attacks on machines and the machine identities that uniquely define them is the new battleground that the government will rapidly need to defend." ®
Nukenote
* The review claimed, implausibly, that Britain could nuke nations that attack its digital infrastructure, raising the spectre of Trident missiles [12]raining on Pyongyang in the aftermath of some future WannaCry-style worm.
[13]
"Britain could use nuclear weapons against a state that threatens to inflict a devastating cyber or biological attack," [14]reported The Times , along with several other national newspapers, following clandestine government briefings (and a string of identical "exclusives") the night before the review was formally published.
Get our [15]Tech Resources
[1] https://www.gov.uk/government/collections/the-integrated-review-2021
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YFMyyhLBMnJo67VjgDXMrgAAABc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YFMyyhLBMnJo67VjgDXMrgAAABc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2020/11/11/ciaran_martin_speech_cyber_policy/
[5] https://www.theregister.com/2019/05/23/uk_will_hack_other_countries_say_ministers/
[6] https://www.theguardian.com/uk-news/2021/mar/16/bill-that-curtails-ability-to-protest-in-uk-passes-its-second-reading
[7] https://www.theregister.com/2020/11/11/ciaran_martin_speech_cyber_policy/
[8] https://www.theregister.com/2020/11/19/computer_misuse_act_reform_cyberup/
[9] https://www.theregister.com/2020/04/09/cryptocracking_quantum_kit/
[10] https://www.forces.net/news/cyber-corridor-north-england-follow-integrated-review
[11] https://www.theregister.com/2020/11/19/computer_misuse_act_reform_cyberup/
[12] https://www.theregister.com/2017/10/27/uk_gov_wannacry_blame_north_korea/
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YFMyyhLBMnJo67VjgDXMrgAAABc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[14] https://www.thetimes.co.uk/article/uk-builds-up-nuclear-arsenal-to-counter-cyber-threat-cl96v0wbb
[15] https://whitepapers.theregister.com/
While the Cyber-Integrated Cyber-Review of Cyber-Security, Cyber-Defence, Cyber-Development and Cyber-Foreign Cyber-Policy was cyber-short on cyber-concrete cyber-promises, it did use the word "cyber" 114 times.
[2]
Yet in terms of "things that will flow from this" the Integrated Review (IR) mentioned only the National Cyber Security Centre and the nascent National Cyber Force, both already in existence. The IR was long on ambition but clothed in the impenetrable language of defence and management consultancy. A sample of it reads as follows:
We will adopt a comprehensive cyber strategy to maintain the UK's competitive edge in this rapidly evolving domain. We will build a resilient and prosperous digital UK, and make much more integrated, creative and routine use of the UK's full spectrum of levers – including the National Cyber Force's offensive cyber tools – to detect, disrupt and deter our adversaries.
[3]
Under the heading "responsible, democratic cyber power" the government promised to "use cyber capabilities to influence events in the real world," including more use of "offensive cyber" – and, eye-catchingly for the UK infosec sector, UK.gov plans to build "an advantage in critical cyber technologies."
Try to avoid thinking of the internet as a flashy new battlefield, warns former NCSC chief [4]READ MORE
Offensive cyber is what ordinary people call "state-backed hacking". Two years ago the then Foreign Secretary, Jeremy Hunt, [5]said in a major speech : "If cyber interference were to become commonplace, the danger is that [6]authoritarian states would damage public confidence in the very fabric of democracy."
One would hope that policymakers have been paying attention to the former head of NCSC, Ciaran Martin, who [7]publicly warned in late 2020 that all this warlike talk neither contributes to international peace nor helps anyone understand what the hell UK.gov actually intends on doing.
Hunt's far-sighted speech, taken together with the Integrated Review, could be seen today as a warning that British foreign policy for the 2020s will contribute further to international instability – especially after the Ministry of Defence spun a temporary increase in nuclear missile warheads as meaning that the UK would nuke state-backed attackers.*
Cyberup campaign: 80% of infosec pros fear they might fall foul of UK's outdated Computer Misuse Act [8]READ MORE
Britain's so-called "whole of nation approach" to cyber policy and capabilities in the post-Brexit world will, so we're told, rest on UK.gov "supporting a UK research base that can compete with allies and adversaries" and nurturing an industry capable of delivering "innovative and effective cyber security products" – something that may warm even the hearts of the occasionally jaded infosec industry.
Yet the creation of a bigger infosec industry that successfully competes on a commercial footing with products and services from the US and infosec powerhouse Israel is years away; individual British SMEs employ fine and talented people but the only truly global infosec company the UK has ever produced is Sophos. It's a crowded marketplace out there too, with thousands of companies competing for business.
R&D
It's not only the infosec industry that's mentioned in the review; the government wants "to take the lead in the technologies vital to cyber power, such as microprocessors, secure systems design, quantum technologies and new forms of data transmission."
Quantum (as in cryptography) seems to be one of those marketing buzzwords that crept into the report; the tech [9]is about 15 years away from becoming reality .
While there won't be any sleepless nights in Silicon Valley or Shenzhen after political leaders in those places read about Britain's wider tech ambitions, the review's contents bode well for companies looking to base R&D departments in the UK – perhaps building on the international reputations of Cambridge and Manchester.
Indeed, the latter is receiving specific attention; the National Cyber Force [10]will be based in the city , as UK.gov briefed the press on Sunday. Manchester University has close links to spy agency GCHQ and a significant amount of the British infosec industry is already based there.
Mop-topped Prime Minister Boris Johnson said in a statement: "Cyber power is revolutionising the way we live our lives and fight our wars, just as air power did 100 years ago. We need to build up our cyber capability so we can grasp the opportunities it presents while ensuring those who seek to use its powers to attack us and our way of life are thwarted at every turn."
The review did not, however, mention anything about changes to the law to allow British firms to compete on an equal footing with [11]overseas infosec companies , particularly in the areas of threat intelligence and research. Industry has tried making noises about this in the past but they have largely fallen on deaf ears in Westminster.
Kevin Bocek, VP security strategy and threat intelligence at US machine identity firm Venafi, opined that the review was a good thing for his business and urged UK.gov to send more cash its way, saying: "So far there has been too much emphasis on trying to change people's behavior in cyberspace but attackers have moved on to target the machines that make autonomous, millisecond decisions. Attacks on machines and the machine identities that uniquely define them is the new battleground that the government will rapidly need to defend." ®
Nukenote
* The review claimed, implausibly, that Britain could nuke nations that attack its digital infrastructure, raising the spectre of Trident missiles [12]raining on Pyongyang in the aftermath of some future WannaCry-style worm.
[13]
"Britain could use nuclear weapons against a state that threatens to inflict a devastating cyber or biological attack," [14]reported The Times , along with several other national newspapers, following clandestine government briefings (and a string of identical "exclusives") the night before the review was formally published.
Get our [15]Tech Resources
[1] https://www.gov.uk/government/collections/the-integrated-review-2021
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YFMyyhLBMnJo67VjgDXMrgAAABc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YFMyyhLBMnJo67VjgDXMrgAAABc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2020/11/11/ciaran_martin_speech_cyber_policy/
[5] https://www.theregister.com/2019/05/23/uk_will_hack_other_countries_say_ministers/
[6] https://www.theguardian.com/uk-news/2021/mar/16/bill-that-curtails-ability-to-protest-in-uk-passes-its-second-reading
[7] https://www.theregister.com/2020/11/11/ciaran_martin_speech_cyber_policy/
[8] https://www.theregister.com/2020/11/19/computer_misuse_act_reform_cyberup/
[9] https://www.theregister.com/2020/04/09/cryptocracking_quantum_kit/
[10] https://www.forces.net/news/cyber-corridor-north-england-follow-integrated-review
[11] https://www.theregister.com/2020/11/19/computer_misuse_act_reform_cyberup/
[12] https://www.theregister.com/2017/10/27/uk_gov_wannacry_blame_north_korea/
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YFMyyhLBMnJo67VjgDXMrgAAABc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[14] https://www.thetimes.co.uk/article/uk-builds-up-nuclear-arsenal-to-counter-cyber-threat-cl96v0wbb
[15] https://whitepapers.theregister.com/
Anonymous Coward
Kind of bad news for all of us really - when we realise that the 'sophisticated state sponsored attack' was actually a misconfigured email out of office message set up by a retired accountant in Eastbourne, just after the subs launched their hack seeking missiles of atomic doom. Still, every cloud....would definitely improve Eastbourne,
Let's start a nuclear ware in a spiteful tantrum
Christoph
"Britain could use nuclear weapons against a state that threatens to inflict a devastating cyber or biological attack,"
The only place for someone who seriously contemplates that is a padded cell.
Re: Let's start a nuclear ware in a spiteful tantrum
osakajin
Haven't you noticed? They're in charge
We will adopt a comprehensive cyber strategy to maintain the UK's competitive edge ...
Mike 137
The top of the list in the strategy could usefully be to beef up on information risk assessment, which is still conducted around the globe by crystal ball gazing because nobody either understands the basic principles of probability or is prepared to investigate what actually happens. Instead they sit around at committee meetings and guess. Even international standards advocate guesswork rather than research because research "can take a lot of time". Consequently, the results of almost all information security and cyber security risk assessments are random nonsense. Fix this and we might make some progress towards achieving real security, via proactive resilience rather than merely reactive knee jerk response.
What I glean from the article, is that the UK.gov is thirty years late (or more) in recognising the importance of things cyber and may still not know what the word actually encompasses.
The other thing I gleaned is that your mum's basement is probaby not deep enough to protect you from the wrath of the UK if you upset their cyberlords.