Private sector is endangering national cyber security: UK report

UK network security specialists have aired their grievances with the private sector, as doctrines, research, and discussion, all point to a need for definitive cyber resilience planning across the board.

Additionally, the UK's critical national infrastructure is at huge risk of attack and the companies that own it must take greater responsibility in securing their systems.

The above are summaries of some of the key points made in a new report from Chatham House.

Written in conjunction with BAE Systems Detica, the report is the result of interviews with many of those involved in the protection of utilities, communications networks, health services, food services, banks, and power grids.

Although considered to be on the front-line of the threat, critical national infrastructure enterprises have shown a ‘haphazard’ implementation of security practices, and ‘need to look further ahead to identify potential threats and to develop anticipatory responses to the potential cyber risks.’

The study concludes that there is ‘a marked lack of uniformity and consistency in policy and practice, such that it would be very difficult to describe the UK as possessing anything approaching a society-wide response to cyber vulnerabilities and threats.’

Other key points include:

Government cannot provide all the answers and guarantee national cyber security in all respects for all stakeholders. As a result, critical national infrastructure enterprises should seek to take on greater responsibilities and instil greater awareness across their organizations;
All organizations should look in more depth at their dependencies and vulnerabilities. Awareness and understanding of cyberspace should be 'normalised' and incorporated and embedded into standard management and business practices within and across government and the public and private sectors;
Cyber terminology should be clear and language proportionate to the threat. It should also encourage a clear distinction to be made between IT mishaps and genuine cyber attacks;
Research and investment in cyber security are essential to meeting and responding to the threat in a timely fashion. However, cyber security/protection should not be the preserve of IT departments but of senior executive boards, strategists and business leaders and it should be incorporated into all levels of an organization.

Read the report as a PDF.

•Date: 16th September 2011 • Region: UK/World •Type: Article • Topic: Critical infrastructure protection

Sign up for Continuity Briefing, our weekly roundup of business continuity news. For news as it happens, subscribe to Continuity Central on Twitter.

How to advertise on Continuity Central.

To submit news stories to Continuity Central, e-mail the editor.

Want an RSS newsfeed for your website? Click here