UK to invest £1.9B to improve cyber defences

The UK government is to almost double its investment in cybersecurity, spending £1.9 billion (€2.1 billion) over the next five years to reinforce defences, fund research, and establish a National Cyber Security Strategy, to fight back against cyber attacks.

This will include funding for a Cyber Security Research Institute – a virtual coalition of UK universities, which will look to improve the security of smartphones, tablets and laptops. One area of research will be replacing passwords with new authentication technologies.

In addition, a Cyber Innovation Centre will launch a scheme to retrain high-aptitude professionals as cybersecurity experts, and there will be funding for a cyber innovation fund, to support the commercialisation of start-ups based on academic research in the field.

The government will also strengthen law enforcement, recruiting an extra 50 cyber-crime investigators to the National Cyber Crime Unit.

EU-wide reaction

Legislators across Europe are similarly stepping in to stem the rising tide of cyberattacks.

The European Commission is working on legislation to require better security in internet-connected devices, including security cameras, routers and digital video recorders.

That may result in a certification system to help consumers evaluate how vulnerable devices are to exploitation by hackers. This will be similar to the labelling system used to rate the energy efficiency of electrical appliances.

The Commission has laid down rules in the EU General Data Protection Regulation, requiring companies across Europe for the first time to disclose data breaches to national data protection authorities. Failure to do so may result in fines of up to 4 per cent of total revenues.

Mounting attacks

The UK’s announcement follows recent high-profile data breaches at Sony, Target, the US Office of Personnel Management, and a huge denial of service attack on the servers of Dynamic Network Services in October that knocked out Twitter, Reddit, Netflix and PayPal, for several hours.

It is not clear where the attacks originated, although security analysts suspect they are either Chinese or Russian.

About one-third of targeted attempts to breach big companies’ cyber defences succeed. This represents an, “alarmingly high failure rate”, according to an Accenture report published on Wednesday. The report surveyed 2,000 security officers from multinationals around the world.

“On average, an organisation will face more than a hundred focused and targeted breach attempts every year, and respondents say one in three of these will result in a successful security breach,” the report says. That is, “Two to three effective attacks per month,” according to the authors.

Broad response

The message from the UK is to fight back. Security services are mandated under the new strategy to cause, "damage, disruption or destruction" against cyber attacks.

The UK government lays claim to some recent success in fighting digital assaults, saying that whereas previously phishing sites impersonating its own departments would have stayed active for two days, it is now less than five hours.

Previously a website serving web-inject malware would stay active for over a month, but is now be silenced in less than two days.

Europe-wide response

Products at risk of cyber breaches are starting to be identified and taken off the market. The Chinese firm Hangzhou Xiongmai Technology announced it would recall devices recently targeted by malicious botnets.  

Elsewhere, there are plans to devote more money to staff training, to increase awareness and help them to ward off attacks. 

Leaks from the e-mail accounts of US Democrat Party officials prompted France’s cyber-security watchdog, the National Defence and Security Secretariat, to give a brief on hacking threats last week.