1. Written Evidence submitted by Rowland Johnson, Chief Executive of Nettitude

 

2. As well as being the Chief Executive of Nettitude, a medium sized cyber security company with offices in the UK and the US, I am also a Director of CREST, a not for profit organisation with specific focus on professionalising and maturing the technical cyber security industry.  Within CREST, I have specific responsibility for internationalisation, and work closely with Financial Services Regulators, the FCO and DIT.  Both of these roles provide me with a unique insight in to how UK cyber security functions in comparison to other nations around the world.

 

3. Executive Summary
4. Although in 2018 the cyber security industry should be moderately mature, the events of 2017 demonstrate that the lack of cyber hygiene across many organisations continues to be a concern.  An expectation that targeted attacks would be more impactful, was turned on its head with the ransomware outbreaks of WannaCry and NotPetya.  Although they were not believed to have directly targeted CNI, their impact was felt across large parts of the health service as well as industry as a whole.

 

5. The UK cyber security ecosystem is more collaborative and is more effective than many other nations around the world.  Schemes such as CHECK and CLAS/CCP raised the bar in the UK, and consequently the capability of professionals operating in the market is high.  However as cyber becomes more embedded in digital society there is still significant levels of asymmetry in expectation and understanding between people that are procuring cyber services, and those that provide them.  Many would argue that the market is dysfunctional, and consequently the disconnect in expectations results in organisations and individuals being vulnerable to the cyber threat.  The idea behind running the Cyber Essentials scheme to raise the levels of Cyber Hygiene in SME’s is entirely sound.  However, both cyber essentials, and other schemes such as CIS top 20 or the NIST Cyber Security framework continue to be optional in nature.  As a consequence, only the organisations that are already consciously competent choose to become accredited.  UK government needs to find a way by either working with the insurance sector, financial sector, or by introducing regulation to raise cyber standards more rapidly.  In the absence of a more proactive approach, evidence from the past 3 years, points to the likelihood that Cyber Essentials adoption will continue to be slow, and the overall median point for the industry as a whole, will only rise slowly.

 

6. Over the past 3 years, UK government has been proactive in building cyber security schemes that are aligned to industry verticals.  We have seen schemes from the Bank of England, DCMS and other industries that are designed to align with the sector specific threats as well as technology dependencies that each market segment has.  This approach can only be praised, as it has both raised the levels of skills within the market, as well as increasing the resiliency within the industries themselves.  However, government must keep the momentum, and continue to promote cyber resiliency programs that are delivered sector by sector.  Clearly, the technology requirements on a ship or an oilrig are hugely different to a Bank.  Similarly, the technology requirements in a Nuclear Power Station are very different to a retailer.  Encouraging sector aligned cyber security schemes, that actively promote improvement will have a significant benefit to the wider UK system as a whole.

 

 

7. Focus on Critical National Infrastructure (CNI)

 

8. Although it is important for UK government to continue focusing cyber initiatives on CNI, within the current cyber landscape it is possible for threat actors to have systemic impact on the nation without targeting these resources directly.  Untargeted attacks such as WannaCry and NotPetya provide a poignant insight in to the type of impact that untargeted attacks can have on an economy.  Although Ransomware, and untargeted threats may not have historically been on the NSS committees agenda, the events of 2017 demonstrate these vectors can still have a devastating impact on the economy, even when the attack was untargeted in nature.  Although NotPetya had limited impact to the UK SME, due to the nature of it targeting and propagating through Ukrainian based accountancy packages, the impact could have been very different if it had targeted a more mainstream UK financial or accounting package.  If a large percentage of the UK SME population had been denied access to their financial systems, the compounding impact across the whole of the economy could have been systemic in nature.

 

9. Historically it may have been easier to secure and assure the IT elements of the CNI, as most Internet connected devices were identifiable in nature.  Schemes such as CTAS and CPA were designed to accredit IT products being deployed within government and the wider CNI.  However, with IOT, and Internet connected industrial control systems, so CNI is inadvertently introducing a whole series of potentially vulnerable devices in to their operating environments.  It is critical that government looks beyond direct CNI, to observe at the wider ICS and IOT ecosystem if it is to succeed in its goals of making the UK one of the safest countries in the world to live and do business.

 

10. The CNI is naturally integrated with the wider economy.  Threat actors are known to be targeting organisations customer bases and the supply chain as a means to gain foothold in the CNI through these interconnected channels.  As a consequence, it makes sense for the NSS committee to look at cyber more holistically than just CNI.  In a world that is growing in connectivity, with mushrooming volumes of data and an always on mentality, so the whole ecosystem becomes more interconnected and increasingly more vulnerable.

 

11. In 2017, the MITRE organisation allocated and reserved more than 18,000 CVE numbers for computer based vulnerabilities.  Over a 1 year period, that equates to 50 new vulnerabilities being identified and disclosed every single day.  In a society that has traditionally approached cyber security as a series of point in time activities, breaches like that seen at Equifax demonstrates the need for cyber security to evolve in to something that is continual in nature.  Although Equifax is reported to have had a defined cyber security strategy, and had been conducting assurance exercises on a periodic basis, their cycle was arguably too long.  Conducting an assurance activity on an annual basis, when 18,000 vulnerabilities are identified per year inevitably presents a new type of challenge for organisations.  In the case of Equifax, the time from vulnerability publication to server compromise was less than 3 months.

 

12. When the Vault7 leak was disclosed in 2017, it took a matter of months for a threat actor to weaponise a series of exploits and turn them in to the WannaCry ransomware.  In early 2018, we have seen vulnerabilities called Spectre and Meltdown being disclosed in the media that impact most types of computer devices including, PCs, Macs, Smartphones and cloud computing services.  The historic evidence experienced with Vault7 and WannaCry suggests that the likelihood of a sophisticated threat actor leveraging this vulnerability to target unpatched machines around the world is likely in the coming months.  Although this may not ultimately result in a ransomware attack such as WannaCry, a vulnerability that could be exploited to harvest credentials from individuals and organisations indiscriminately across the UK may still warrant a nations government and regulatory systems to take some form of action.

 

13. Activities that look at Cyber Security as a point in time exercise are becoming increasingly ineffective.  With the current velocity of attack, the increasing dependency on technology, and the growing number of vulnerabilities being identified on a daily basis, so the likelihood of data or systems  compromise increases.  We need to encourage organisations to think about cyber security as a continual process, one that extends out of pure play technology and that considers people and process in unison.  Only by addressing cyber security continually, will organisations or individuals be able to detect and respond to the developing cyber threat.

 

14. Coherency of Government approach

 

15. The NCSC has been promoted as a cross government body responsible for coordinating cyber initiatives.  Although the early signs have been encouraging, there continues to be significant levels of departmental cyber programs, that appear to be uncoordinated with the NCSC.  Examples of this include government and regulatory initiatives that have followed on from CBEST. (An intelligence led penetration testing program that was created by the BoE).  Since this inception, similar industry aligned programs have been launched including TBEST and GBEST and there are wider initiatives being discussed in other parts of CNI.  All of these initiatives are being driven by different government departments, and although there may be involvement behind the scenes from the NCSC, the public image is that of lots of disparate departments delivering similar programs, without the coordination through one single security authority. 

 

16. In parallel, there continues to be an apparent mix of agendas between inwardly facing government and outwardly facing government.  The Department of International Trade (DIT) continues to take the lead in promoting UK cyber overseas, however this often pulls in a different direction to the goals and objectives of the NCSC.  The UK has a very special role to play in the International cyber industry and we have a hugely talented skill base that has been generated by both the CHECK scheme and the CREST schemes.  A more coordinated approach both domestically and internationally, would be hugely valuable to demonstrating a stronger public/private cyber partnership.

 

17. Government Relationships with Industry

 

18. The relationship between UK Government, regulators and industry has been integral in shaping the domestic cyber ecosystem.  Having conducted significant research in this space, it is apparent that there is no other country or region that has the closeness of relationship between buyers, suppliers, government, regulators and academia.
19. There continues to be an opportunity to raise the bar.  Although government, regulators and industry work together, they continue to do so in a stop-start manner.  Sector aligned initiatives are launched to focus on individual parts of the CNI.  However, these have often resulted in a closed group of attendees being invited, without much in the way of overlap between regulatory bodies in ensuring a consistent and coordinated message.  In time, it is conceivable that the NCSC may have more of a role in coordinating these types of initiatives on an ongoing basis.

 

20. The Need for Increasing Regulation 

 

21. The cyber security market continues to be dysfunctional due to the asymmetry of information between buyers and sellers.  If you operate as a cyber security practitioner or work for a cyber security company, you will be used to phrases such as DLP, EDR, SOC, 2FA and APT.  However, for many boards of directors, and indeed most procurement organisations the propensity for the cyber security sector to communicate in a confusing and highly technical language results in misalignment of expectations and inadequate levels of cyber resiliency.  Although the appeal of an unregulated cyber security market may be desirable, the past 10 years of experience demonstrates that a market free from government or regulatory intervention, will result in a less secure or resilient economy.  As consumers, organisations and government rely increasingly on data, connectivity and smart devices, so the need to build cyber security in to systems, processes, IOT and infrastructure grows.

 

22. In the past 3 years, we have seen a highly successful regulatory driven program from the BoE in the way of CBEST.  This has been designed to measure and mature the cyber security resiliency of UK systemically important financial institutions.  It is clear that government has seen some benefits from this, as there are further initiatives being delivered in Telecommunications, (TBEST) central government (GBEST), and potentially within Nuclear (NBEST) and the wider CNI.  Focusing on CNI through the xBEST schemes is a sensible approach to maturing the levels of cyber resiliency in critical infrastructure.  By providing prescriptive guidance of what is required, in clear unambiguous language it is possible to mature the resiliency of a sector.  However, there needs to be a wider review of other industries outside of CNI, so as to drive improvement and resiliency across the whole of the nation.  In an economy which is becoming increasingly connected, with complex supply chains, and a growing web of people, process and technology, it is important that government looks at UK cyber holistically.  Greater promotion or even regulation around Cyber Essentials, would be hugely beneficial in achieving cyber resiliency across SME’s.  Focus on improving the cyber security of IOT devices would also be advantageous.  If UK government could create a scheme to assess or certify IOT devices, this would have huge value to the UK population.  (Something similar to CTAS or CPA, but applied to IOT would be ideal).  A scheme that assured IOT systems being sold within the UK, would have a wider benefit to the wider international environment.  It will take a bold, and forward-facing government to implement such an approach, however only through such measures, will it be possible to remove the innate conflict between security versus functionality that exists in this market segment today.

 

23. Skills & Development

 

24. There is a well-documented cyber security skills gap both within the UK, as well as within the international arena.  The UK is comparatively mature within this space, with strong academic alignment, apprentice schemes, and proactive communication between industry, training and development organisations.  The training for people entering the industry from schools and universities is becoming increasingly robust, however there needs to me more support for training individuals with portable skills that want to enter the cyber security arena.  In particular, as we see a growing trend of smart devices, IOT and Internet connected industrial control systems, we need to find a way to support people with engineering backgrounds, gain skills within the cyber domain.  Currently within the UK, there is an acute scarcity of individuals that hold IT and OT skills in unison.