JCNSS Inquiry into the National Cyber Security Strategy – Cabinet Office Written Evidence
1.1.The 2015 National Security Strategy reaffirmed cyber as a tier one risk to UK’s interests – highlighting cyber threats as one of the key challenges to drive the UK security priorities for the coming decade. Since the last National Cyber Security Strategy was published, the scale of the threat from cyber-attacks has continued to increase, and the means of attack have continually evolved. Technological developments have brought with them significant opportunities for our society, but as our reliance on technology grows, so do the opportunities for those who would seek to compromise our systems and data.
1.2.Foreign states, criminals, hacktivists, and terrorists all pose different kinds of threat. States and state-sponsored groups may penetrate UK networks for political, diplomatic, technological, commercial and strategic advantage. These actors may seek to deploy sophisticated cyber-attacks against systems and networks to acquire sensitive commercial, Government, technological, military and economic information. The capacity and impact of state cyber programmes varies, and only a handful of state’s have the technical capabilities to pose a serious threat to the UK’s overall security and prosperity. More commonly, far less sophisticated malware can be developed and deployed to target networks and systems to steal data and passwords through a variety of means, either by directly penetrating an operating system, by masquerading in a format that tricks the operator into downloading the malware via a link (email or website), or by infecting hardware that is subsequently installed onto the target system.
1.3.Terrorist groups aspire to conduct damaging cyber activity against the UK and its interests. Terrorists may have the desire to denigrate or disrupt an adversary's critical national infrastructure such as utilities, financial systems and military capability, but this would require a high level of technical sophistication. The current technical capability of terrorists is judged to be low. However, low-level attacks include terrorist groups seeking to acquire and publish personally identifiable information in order to identify individuals or groups of individuals to target (Doxing attacks), or stealing financial information or accessing accounts in order to fund their activities.
1.4.Hacktivists tend to engage in disruptive activity in response to perceived grievances. They may seek to disrupt websites through Denial of Service attacks either for publicity or to inflict reputational damage. They may seek to deface websites or redirect individuals to specific content in order to impart a particular message (e.g. extremist media or propaganda).
1.5.Our challenge is to ensure that our defences are evolved and agile enough to counter these threats, to reduce the ability of malicious actors to attack us and to address the root causes of the vulnerabilities that leave us open to attack.
2.1.A key purpose of the National Security Council (NSC) is to ensure that Ministers consider national security in the round and in a strategic way. The council is chaired by the Prime Minister.
2.2.NSC (Cyber) is one of four Sub-committees under the National Security Council, and is chaired by Chancellor of the Exchequer. The sub-committee brings together senior ministers and security officials from across Whitehall.
2.3.The primary role of NSC (Cyber) is to provide strategic leadership for all cyber security activity across HMG. In doing this, this Committee sets and oversees the delivery of the UK National Cyber Security Strategy and can hold to account the departments and agencies that are responsible for delivering the Strategy’s objectives. The Chancellor is currently chair of NSC Cyber, not in his role as HMT Secretary of State, but as a senior government Minister capable of convening action across government. The Minister for Cabinet Office is responsible for ensuring the day-to-day delivery of the National Cyber Security Strategy, and for HMG security (of which cyber plays an important part).
2.4.NSC (Cyber) is supported by an (OFFICIALS) Sub-Committee, chaired by the Deputy National Security Advisor.
2.5.The National Security Secretariat (NSS), within Cabinet Office, supports NSC (Cyber) by providing coordination on cyber security issues across Government. The NSS also manage the National Cyber Security Programme. The Programme funds a wide range of activity in support of the National Cyber Security Programme, including a programme of active cyber defence; a dedicated ability to counter-attack in cyber space; an ambitious cyber skills programme; making Government cyber resilient and growing the cyber sector. It has also supported the creation of the National Cyber Security Centre
2.6.Almost all parts of government contribute to the delivery of the National Cyber Security Strategy: there are key roles for the Department, Culture, Media and Sport on skills, growth, research and development and the protection of the whole economy and society; the Home Office for public protection and tackling cybercrime; the Foreign and Commonwealth Office on the international aspects of cyber security; the Security and Intelligence Agencies on understand and responding to the threat; the Ministry of Defence for the cyber security of our defence assets and offensive cyber capability; and a number of departments with responsibility for assuring the security of our Critical National Infrastructure.
2.7.As promised by the Minister for Cabinet Office in the preface of the NCSS, the government is committed to ensuring that the objectives set out within the strategy are carried out, and that we accurately monitor and regularly report of progress in meeting them. The NSS will coordinate this reporting across government.
2.8.The National Cyber Security Centre (NCSC) is the UK's authority on cyber security. As part of GCHQ, its vision is to make the UK the safest place to live and work on-line. As part of GCHQ, the NCSC is able to draw upon their unique capabilities to detect and disrupt the most sophisticated form of activity and provide an effective defence against a range of threats. As well as protecting the country from illiberal state actors and the largest scale cyber-attacks, it will defend businesses and the public from day-to-day malicious cyber activity. Its main purpose is to reduce the cyber security risk to the UK by improving its cyber security and cyber resilience. The NCSC works together with UK organisations, businesses and individuals to provide authoritative and coherent cyber security advice and cyber incident management. This is underpinned by world class research and innovation.
2.9.The four aims of the National Cyber Security Centre are to:
2.10. Since launching in October 2016, the NCSC has already started working with public and private sectors to build cyber security skills, developing innovative defences and helping to manage cyber incidents. The NCSC has dealt with nearly 200 incidents since it became operational, offering incident management capabilities, fostering technical innovation to help prevent attacks and providing real-time cyber threat information to 3,000 organisations from over 20 different industries.
3.1.The first National Cyber Security Strategy (NCSS), published in 2011, set out Government’s approach to tackling cyber threats in order to promote economic growth and protect the nation’s security. The strategy adopted a market-based approach, providing advice and guidance to industry to encourage development of good cyber practice, standards and products. The NCSS successfully supported the market to drive secure cyber behaviours. However, the persistence and ingenuity of malicious actors has significantly increased and it is now clear that Government cannot rely on the market solely, in the short term, to increase its cyber capability at a commensurate rate without greater support and intervention
3.2.The second NCSS therefore sets out a new approach. Government is in a unique position of having access to relevant intelligence and various levers to stimulate secure behaviours. These will be used to drive interventions such as Active Cyber Defence (which will automatically tackle cyber attacks at source so that they don’t reach the user at all) and, where necessary, the right regulatory framework.
3.3.The new strategy also recognised that the Government cyber security landscape was too complex. In response, we created the National Cyber Security Centre to act as the Government’s authority on cyber security and to coordinate how government responds to cyber attacks.
3.4.The UK Cyber Security Strategy 2011-2016 annual report set out the many successes of the strategy but also acknowledged that there is more to do to keep up with cyber threat. It is not enough to maintain existing efforts as this effectively increases our vulnerability in comparison to the ever-evolving threat. Some specific priorities are described below.
3.5.Skills and growth: the first NCSS successfully took a number of steps to promote routes into the profession and broaden the talent pool; however, the UK is not keeping pace with rapid developments in technology, so addressing the UK’s skills shortage in the cyber security sector remains a priority. This forms a key part of the second NCSS, with the development of a specific skills strategy, clear roles for Government, employers and industry supported by a skills advisory group, and a range of initiatives to bring about immediate improvements.
3.6.Cyber crime: the first NCSS made significant progress in addressing cyber crime, with the creation of the National Cyber Crime Unit, and regional cyber units, the number of prosecutions rising, and the prioritisation of tackling online fraud. However, cyber crime and fraud continue to affect citizens. The second NCSS aims to reduce the vulnerability of the UK and its citizens by enhancing the UK’s law enforcement capabilities, making cyber criminal services harder to access and improving interventions.
3.7.Risk to businesses: the first NCSS put in place processes and frameworks to support businesses of all sizes, such as best practice guidance, information-sharing processes and emergency response exercises. However, both the 2014-15 Health check of FTSE 250 companies and a 2016 survey by the Government’s Cyber Streetwise campaign indicate that businesses need to give greater priority to assessing and protecting against cyber risk. The second NCSS aims to support businesses in protecting themselves by providing information, tools and training, and improving cyber security culture by working with a broad cross-section of organisations such as insurers, regulators and investors. The new National Cyber Security Centre has also created a unified source of advice and support for businesses.
3.8.A key tenet of the second NCSS is that the UK needs to take collective responsibility for securing the country against cyber threats. This means a greater offering from Government in terms of investment, education and support, but also a higher expectation on businesses, organisations and citizens to work in partnership to secure the UK in cyberspace.
3.9.The Cabinet Office is also working with the Infrastructure and Projects Authority and the National Audit Office to review how it governs delivery of the Strategy and to ensure the new National Cyber Security Programme is well managed.
4.1.Closing the cyber security skills gap is essential if the UK is to maintain its competitive edge in the cyber security market and continue to be a leading nation in the global digital economy. We have a clear understanding of some of the issues – such as a lack of young people entering the profession; the shortage of current cyber security specialists; insufficient exposure to cyber and information security concepts in computing courses; a shortage of suitably qualified teachers; and the absence of established career and training pathways into the profession – and we are taking immediate action to address them. However, in common with digital skills more broadly, our full understanding of cyber security skills needs, and how to address them, is still developing.
4.2.The Government is investing in a range of initiatives to bring about immediate improvements to the level of UK cyber skills. We are establishing a schools programme for 14-18 year olds, creating higher and degree-level apprenticeships to address skills gaps in essential areas, creating a fund to retrain members of the workforce who show high potential for the security profession and we are developing a cyber security profession. But we recognise that we also need to address the cyber skills gap in a way that will create lasting change, so we will develop and implement a long term cyber skills strategy. It will build on existing work to integrate cyber security into the education system, such as continuing to improve the state of computer science teaching overall and embed cyber security into the curriculum. To have a significant and lasting impact, the approach to bridging the cyber skills gap must be a collaborative effort between government, industry, professional bodies and academia.
4.3.We are also committed to increasing cyber skills and capabilities in the public sector. We are developing a cyber skills and cyber career pathway across government departments, to ensure that we are able to train people with the necessary cyber skills, as well as able to recruit and retain experts. We are also looking to recruit experts who will help to build strong private sector partnerships, sharing skills and expertise.
4.4.The UK’s thriving science and technology sector, and its cutting edge research, underpins our world-leading cyber security capabilities. To maintain and enhance the UK’s reputation as a global leader in cutting-edge research, we need our research establishments to continue to attract the best and the brightest minds in the field of cyber security. We will continue to provide funding for Academic Centres of Excellence, Research Institutes and Centres for Doctoral Research. Shortly we will publish a new Cyber Science and Technology Strategy, which will look to identify significant technological trends for cyber security. Where capability gaps are identified, we will invest in further research.
5.1.On 29 September 2013 the Defence Secretary announced that Britain would build both defensive and offensive capabilities to operate in cyber space as part of our full-spectrum military capability. The need to be aware of, and prepared for, the full spectrum of threats that face the UK in a modern, technologically-enabled world is imperative. The technological landscape in which we live, work and operate is arguably changing more rapidly than ever before, and a full-spectrum approach to meet and deter threats is required. Key within the UK’s approach to counter the breadth of threats that we face is a pledge to respond to cyber-attacks via any means deemed most appropriate.
5.2.The objective of the UK OC capability, as stated in the 2016 National Cyber Security Strategy, is to: ensure that we have at our disposal appropriate offensive cyber capabilities that can be deployed at a time and place of our choosing, for both deterrence and operational purposes, in accordance with national and international law.
5.3.As part of this approach, the UK is actively ensuring that all the tools and capabilities required to respond in defence of the nation are developed and held at high readiness – in cyberspace, just as in the physical and traditional realms of defence. Of primary importance is the Chancellor’s announcement that the UK is building an offensive cyber capability – a dedicated ability to counter-attack in cyberspace. This capability is being developed through investment in a National Offensive Cyber Programme (NOCP). The NOCP combines the operational and managerial expertise of both the Ministry of Defence and GCHQ in a joint partnership designed to most effectively counter the threat in cyberspace. This mission aims to - and succeeds at – harnessing the specialist skills and world-class knowledge of both Departments to deliver a world-class capability. This includes the processes, tools and techniques necessary for the UK to occupy cyberspace in an increasingly competitive and technologically-enabled world, where the traditional lines delineating peacetime and conflict are less evident. However, it is not merely sufficient to have a vision for the NOCP capability; sufficient funding, safeguarded to assure the longevity of the mission, is essential. It is for this reason that the Rt Hon George Osborne MP announced in his 2015 speech the commitment to resource the NOCP for five years, ensuring a long-term, strategic approach to one of the most pertinent capabilities of this – and future – generations.
5.4.Offensive cyber capabilities involve deliberate intrusions into opponents’ systems or networks to manipulate data. This act is designed to create a real-world effect, and is underpinned by the intention of causing damage or disrupting business as usual. The operational capability of others is advanced, evidenced by recent instances of cyber-attack such as the November 2015 infringement of the French TV station TV5 Monde, attack of the German Bundestag, telecommunications providers and alleged interference in the 2016 US elections. Alongside information and psychological operations, and energy, economics and political levers as tools of global manipulation and warfare, OC therefore forms a prominent part of the full spectrum of capabilities deployed by adversaries. In response, as declared by George Osborne and the National Cyber Security Strategy, OC forms part of the UK armoury which will be developed to deter adversaries and to frustrate opportunities to attack the UK, in both cyberspace and the physical sphere. We are working actively to integrate OC into the UK national response at a time and place of our choosing. As part of this, the UK Armed Forces’ ability to deploy offensive cyber capabilities is being developed; OC will form an integrated part of operations, ensuring a truly full-spectrum military approach fit for purpose in a cyber-enabled world. Through the UK National Offensive Cyber Programme (NOCP), we are actively enhancing a dedicated capability to protect the UK and her interests in cyberspace – a realm in which the traditional lines between war and peacetime are blurred and in which we must be consistently vigilant. The UK has committed, as detailed in the National Cyber Security Strategy, the pledge to invest resources to develop and improve this imperative capability – work on which is underway.
6.1.Government recognises that, to have a significant and lasting impact, the approach to closing the skills gap and building cyber resilience must be collaborative, so we will draw on external thought leadership from the private sector to continue to refine our perspective. As announced in the National Cyber Security Strategy (NCSS), the Government is developing a cyber security skills strategy to address the systemic issues at the heart of the skills shortage, which affect both government and the private sector. This work is being informed by an Advisory Group of experts, including senior figures from across government, industry, academia and relevant professional bodies. This will strengthen the coherence between these sectors, drawing on their significant expertise and ensuring that the strategy benefits from wide input from across the UK economy.
6.2.Through the NCSS and the development of the specific skills strategy, the Government will continue to partner with others to develop new approaches to nurturing cyber talent. A number of initiatives are being developed as a model for both the public and private sector. For example, GCHQ’s CyberFirst bursary scheme is partnering with government departments and wider industry to offer talented STEM undergraduates financial assistance and work placements to support and prepare them for a career in cyber security. The successful Cyber Security Apprenticeship scheme within government is underpinned by apprenticeship standards which were developed in conjunction with employers. This scheme provides departments with a new cadre of cyber talent and, under the NCSP2, government is developing a pilot scheme to support the uptake of cyber security apprenticeships in critical sectors. Again, this work is being informed by employers.
6.3.There is a need to attract and develop talent and ensure a much greater awareness of cyber security as a discipline, so it is seen as an interesting and rewarding career choice in both the public and private sectors. We are committed to building a strong Security Profession within government, a core component of which focuses on cyber and the development of cyber skills and career pathways across departments. This work will adhere to and complement the wider work on building a recognised Cyber Security Profession, as announced in the NCSS. Internally, the Government in looking to recruit experts who will help to build strong private sector partnerships, sharing skills and expertise.
6.4.One strategic outcome from the NCSS is that ‘Government networks and services will be as secure as possible from the moment of their first implementation’. This means working with the private sector to ensure that government departments, their networks and IT infrastructure are as resilient as they can be. Government will work with experts from the private sector to identify best practice in cyber security and ensure that departments can respond effectively to cyber incidents, maintaining functions and recovering quickly. Though much of this work is at an early stage, partnerships between government and the private sector are likely to play a major role in the development of new tools and techniques for protecting government. There is to be a review of external cyber security training, with a focus on using and building on these offering where possible and appropriate.
6.5.The Chancellor also recently announced the National Cyber Security Centre’s Industry 100 initiative. This will see 100 industry experts seconded to the Centre to share and develop cyber security expertise.
7.1.Ensuring privately owned or operated critical national infrastructure is secure and resilient against cyber attack is a priority for the Government. The Government is committed to understanding the level of cyber security across our CNI and having measures in place to intervene where necessary to drive improvements that are in the national interest. It will work in close partnership with infrastructure owners and operators to do this.
7.2.However, neither the Government nor other public bodies will take on the responsibility to manage this risk for the private sector, which rightly sits with boards, owners and operators. Organisations and company boards are responsible for ensuring their networks are secure. They must identify critical systems and regularly assess their vulnerability against an evolving technological landscape and threat. They must invest in technology and their staff to reduce vulnerabilities in current and future systems, and in their supply chain, to maintain a level of cyber security proportionate to the risk. They must also have tested capabilities in place to respond if an attack happens. They must do this with government bodies and regulators so that the Government can be confident that cyber risk is being properly managed and – if it is not – intervene in the interests of national security.
8.1.The Government will make sure that the right regulatory framework for cyber security is in place, one that ensures industry is taking appropriate steps to protect itself, without stifling competitiveness.
8.2.The Government concluded in a review published in December 2016 that there is a strong justification for regulation to secure personal data, but that it should ultimately be for organisations to manage their own risk in respect of their own sensitive data (e.g. intellectual property) and online presence.
8.3.The Government will, therefore, at present, not seek to pursue further general cyber security regulation beyond the EU General Data Protection Regulation (GDPR). It will, as the review recommended, work with the NCSC and the ICO to further develop relationships with businesses and the wider economy and produce guidance to help them prepare for the implementation of GDPR by May 2018. The Government will, however, keep its policy on regulation under review as the evidence base grows and the threat from cyber attacks develops.
8.4.The Government is also considering whether additional regulation might be necessary to ensure that industry is taking the right steps to safeguard the provision of essential services to the nation. Consideration of the need for additional regulation will be made in the context of the Network and Information Security Directive, due for implementation by 2018, which places risk management and incident reporting requirements on operators of essential services and key digital service providers.
9.1.International engagement is an important component of the National Cyber Security Strategy as our economic prosperity and social wellbeing increasingly depend upon the openness and security of networks that extend beyond our borders. The UK engages with a range of countries, at different levels of cyber security maturity, in support of the following objectives:
9.2.The UK uses our influence with multilateral organisations such as the United Nations, G20, European Union, NATO, OSCE the Council of Europe and the Commonwealth to achieve international cyber objectives such as to promote internet freedom through enshrining the applicability of human rights online as they do offline; to promote internet openness and champion the multi-stakeholder model of Internet Governance; to promote voluntary norms of state behaviours in and confidence building measures for cyberspace; To promote the resilience of cyberspace by shaping the technical standards governing emerging technologies e.g. encryption or the Internet of Things; To promote international standards around cybercrime.
9.3.The UK also helps key partners develop their own cyber security, recognising that we share a single cyberspace and that we collectively become stronger when each country improves its own cyber defences. We contribute to projects ranging from high level policy advice on developing national cyber security strategies to highly targeted support such as training law enforcement officers or incident response teams.
9.4.Finally, international co-operation on cyber threat information currently includes joint working with close allies – the US, Australia, Canada and New Zealand – based on our existing intelligence sharing structures, both bilaterally and as a group. Collaborative discussions are held bi-annually, supported by regular exchanges between officials.
9.5.In addition, the new National Cyber Security Centre, which includes the UK’s computer emergency response team, will continue to engage with international partners on both capability building and intelligence sharing: managing incidents; building bilateral relations with counterparts in a large number of countries; sharing situational awareness; and developing technical capabilities and capacity (e.g. through exercising).
1