Business unity is essential to beat cyber attacks
Comment piece in The Times from Chancellor of the Duchy of Lancaster and No 10 Chief of Staff Steve Barclay and Director General of the CBI Tony Danker
6 April 2022
In the spring of 2021, America’s Colonial Pipeline – the 5,500-mile fuel superhighway, which supplies half the East Coast’s petrol and diesel – abruptly shut down for six days. The cause was a cyber-attack, launched by a Russian-based criminal gang. The stuff of nightmares for every board director.
President Putin’s war in Ukraine has included cyber-attacks on the country’s government and banking sites. Western intelligence has warned that more is likely to come, with Russian cyber actors potentially already pre-positioned in Ukrainian IT systems, collecting intelligence and preparing to launch disruptive activities.
The UK has given strong support for Ukraine and is proud to have helped coordinate the international regime of sanctions against Moscow, and many British businesses including CBI members have led the way in divesting from Russia and Belarus.
While the NCSC is not aware of any specific cyber threats to UK organisations in relation to the Russian invasion, there is a heightened risk of hostile cyber activity. In the last year, two in five UK businesses were subject to some form of cyber-attack or attempted breach.
If the UK is to be protected, Government and business must act as one.
That is why today, as lead Minister for Cyber Security and as head of the UK’s biggest business organisation, we are jointly calling on businesses to work together and treat cyber security as a core boardroom responsibility; an equal threat to financial and other risks.
Strengthening collaboration and resilience forms a core part of the Government’s National Cyber Security Strategy, backed with £2.6 billion of funding. This includes record investment to the National Cyber Security Centre (NCSC), part of GCHQ, to provide resources and bringing together businesses. Like the meeting today of directors of critical national infrastructure operators, such as airports, powerplants and major banks, to examine, challenge and support preparations against cyber threats.
However, it isn’t just critical national infrastructure that need to take action. Government is also appointing senior business expertise to our new National Cyber Advisory Board, bringing the lessons learned by all businesses to challenge and guide the UK’s approach and encourage lessons learnt and greater collaboration.
A cyber-attack recognises no physical or geographical boundary, and cyber criminals thrive on the unwillingness of companies to share their experiences.
Companies must stress test their whole supply chains’ cyber security, right down to the smallest partner, because any weakness can be exploited. This isn’t hypothetical. The attack on the Colonial Pipeline, which disrupted the lives of millions due to supply shortages, a fuel price spike, petrol stations running dry, was down to the theft of a single password.
The reluctance to share when something goes wrong is completely understandable, but cyber security is one area where healthy rivalry of business will not help, and where cooperation and sharing lessons-learned, within and between our organisations, will make us all safer, along with the customers and the public that we serve.
By reporting cyber-attacks to the NCSC Incident Management team, businesses will be supported and their evidence will contribute to a greater understanding to combat attacks more effectively in the future, and by following their Cyber Essentials guidance at all levels of the business, you’ll be better protected. The public can also help - reporting suspicious activity like phishing emails to the NCSC has already helped identify and remove 76,000 scams from the internet.
The greatest weakness in cyber defences is often human error, just look at the Colonial Pipeline experience. While businesses have long recognised the importance of cyber security, the urgency is now much clearer. Russia’s invasion has increased the risk and, as the Russian economy retracts under the weight of sanctions, more cyber criminals will look to the West and the UK.
That means UK plc and Government acting as one, prioritising cyber security so the country can defend itself as one.