CYBER RESILIENCE HOW TO PROTECT SMALL FIRMS IN THE DIGITAL ECONOMY

fsb.org.uk
The role of the private sector in increasing cyber resilience
The private sector also needs to adapt to improve overall cyber resilience. The rebalancing of
responsibility within the private sector should include:
• Businesses taking as much responsibility as is practical for them to do so. Small businesses
need to be made more aware of the risks that come through operating online. Only with a
better understanding of the risks and the possible negative impact they can have, will small
businesses be able to adjust their practices and processes in the most effective ways. Owing to
the constraints they operate under, small businesses need support from others to help take the
actions necessary to increase their cyber resilience. There are also many things that resource
and knowledge constraints mean small businesses will not be able to do or are not best placed
to do.
• More measures taken by the digital infrastructure providers to help protect users who are not
adequately resourced to protect themselves, such as small businesses.
• The larger economic infrastructure providers taking more responsibility through increasing the
cyber resilience of their systems and practices, in addition to helping their vulnerable users,
such as small businesses, improve their own cyber resilience.
1. Strong foundations for cyber resilience policy
Before outlining specific measures aimed at dealing with the three categories of causes of cyber risk,
Government can make a number of reforms that will provide a set of strong foundations.
A more flexible approach to regulation
Before looking at specific areas of regulation or specific regulations and regulatory reforms, the
Government should look in detail at:
• Its general approach to regulating cyber resilience issues. The fast changing world of cyber
threats and the risks they pose raise questions about the viability of aspects of the current mode
of regulation.
• Making sure that its ability to deliver services to the business community is resilient. There is little
point in the Government playing a major role in implementing measures to help and encourage
the private sector to be more cyber resilient if Government is not sufficiently resilient itself.
Regulating for cyber resilience
Traditional regulation is based on a prescriptive command and control model, where detailed
standards are set out and compliance with those standards is monitored through reporting and
external inspection.
These standards do not usually reflect risk, but instead are based on hazard. The latter can lead to
regulatory micro-management and unnecessary burdens rather than generating buy in from those
being regulated. This hinders the development of broader behavioural changes which are needed
to change the norms of complex systems.
The problems of regulating security issues associated with the digital communications technologies
this way, are well known:
“Regulations that dictate specific solutions can be a poor fit for cyberspace…[a]…focus on
compliance can turn security from an iterative, adaptive process to an organisational routine
disconnected from the risks faced. Compliance replaces accountability, since organisations can
avoid any decision that might improve security”. 81
Singer, P W and Friedman A, Cyber Security and Cyber War: what everyone needs to know
81 Singer, P W and Friedman A, Cyber Security and Cyber War: what everyone needs to know, 2014.
33