RiskUKSeptember2017

Cyber Security: Risk Management in the Digital World
ensure that our property is properly and
adequately protected in the first place.
This is the world we live in and understand,
but it’s only a part of security. There’s another
world of security: national security. We expect
Governments to maintain the intelligence and
surveillance capability to know what’s going on
in the wider world and the military capability to
deter or deal with any aggression that comes
from beyond our borders. There are places
where these two worlds overlap, such as in
foreign-inspired domestic terrorism, but the
challenge involved merely illustrates how
separately we can maintain the distinction.
As businesses and private individuals, we
rely on physical distance to keep these two
worlds apart and on Governments to manage
global threats. We expect the national security
apparatus to maintain a physical barrier
between threats in the Middle East and a
domestic business in an English town.
Individuals and businesses have concentrated
on local protection. This form of thinking
persists in approaches towards cyber security.
Now, the increasing prevalence of digital
technology is making physical distance
irrelevant. As more of our world is connected,
geography becomes less relevant and distance
is almost useless at insulating us from far-off
threats. Security officials believe that hackers
in North Korea were behind the attack that
crippled parts of the NHS earlier this year.
Security is still reliant upon protection,
enforcement, intelligence and military domains,
but the barriers between these domains are
dissolving while the domains themselves now
increasingly overlap.
Assessing the implications
The blurring of the boundaries of these
domains means that we need to revise the
established model of security and the
responsibilities of individuals, organisations
and Governments.
Changes to the traditional security model
have three implications. First, it changes the
division of responsibility between businesses
and Government. Protecting a business’ assets
would traditionally have been something that
was entirely the responsibility of that business,
but there’s increasing willingness by
Government to undertake protection activities,
particularly so where it can do this most
effectively by working on core infrastructure.
In the UK, for example, we’ve seen the
creation of the National Cyber Security Centre, a
bold step taking part of GCHQ out of the
intelligence world and giving it a broad public
role in cyber protection for the whole country.
“Security is still reliant upon protection, enforcement,
intelligence and military domains, but the barriers between
these domains are dissolving”
Meanwhile, the Chinese Government has just
brought in its first cyber security law with the
stated aim of shielding domestic Chinese data
from foreign espionage.
Conversely, financial services organisations
and technology platforms are sometimes better
placed than police forces to help the victims of
online criminality. Someone who falls prey to a
fraudster on a website such as Amazon is less
likely to report it to the police and more likely
simply to seek a refund through Amazon or, as
an alternative, their credit card company.
Second, we need a way in which to defend
global business networks and technology
platforms that doesn’t trip over the national
focus of Government agencies. Governments
understandably prioritise their own countries
when it comes to security, whereas technology,
infrastructure and financial systems are all
fundamentally international with big
businesses and social networks typically
running across countries.
Law enforcement organisations in particular
have evolved from a primarily territorial remit.
This is challenging for collaboration even within
countries, but leads to real problems
internationally where enforcement activity
needs to work across jurisdictions and
investigators have to navigate differences in
legal structures and approaches, never mind
the nuances of language and culture.
Businesses cannot rely on distance and
Governments to insulate them from risk. We
need active business defence to protect our
organisations. This involves very different
capabilities from those traditionally in place
within IT and risk teams in business.
Business defence uses intelligence on
adversaries, technical vulnerabilities and the
organisation itself to build a full understanding
of the situation and prioritise resources to deal
with those risks of most significance. This
needs to include an understanding of the
relevant activities and implications of all four
domains of security globally rather than the
traditional local perspective.
Importantly, business defence engineers
organisations to be robust such that their
systems, processes and people are difficult to
compromise. Business defence maintains the
vigilance to identify problems early as well as
the readiness to deal with them before they can
cause serious damage.
James Hatch:
Director of Cyber Services at
BAE Systems Applied
Intelligence
57
www.risk-uk.com