Spooks take the wheel in UK's £650m cyber-war operations
GCHQ to lead info sharing with govt and biz
Customer Success Testimonial: Recovery is Everything
Analysis The British government's Cyber Security Strategy is giving the intelligence agencies a greater role than ever in defending business and the public against internet threats.
The policy, released by the Cabinet Office on Friday, sketches a detailed framework on how the government aims to organise law enforcement efforts and improve the education of netizens on information security risks. At the same time the policy aims to support online businesses, estimated to account for six per cent of the UK economy.
Information security firms broadly back the policy even though some questioned the central role of GCHQ, the signals intelligence agency, and a depiction of the threat landscape that seems to paint cyberwar-style threats (think Stuxnet and cyber-espionage) as more a pressing concern than everyday cybercrime risks, at least if budget allocations are any guide.
Show me the money
The government budgeted £650m over the next four years on improved cyber-security, after ranking cyberspace attacks as a tier-one priority for national security, on the same par as terrorist attacks, in last year's Strategic Defence and Security Review.
The lion's share of the cyber-security budget - £383m or 59 per cent - goes to the "Single Intelligence Account". The account will fund the cyber-security activities of Britain's intelligence community: MI5, MI6 and GCHQ. The majority of this huge investment will help the UK detect and counter cyber-attacks, and most will go to GCHQ in Cheltenham, but the details of how this will work remain classified.
One of the most controversial aspects of the strategy calls for private sector firms to work more closely with specialists at GCHQ, establishing an information sharing hub at Cheltenham.
Fifteen key firms, including Barclays, BT, Vodafone and Centrica, have been working to develop a pilot information sharing scheme with GCHQ, which will begin in earnest in December. GCHQ will act as a clearing house for information, sharing it with other private sector organisations.
Spooks eye up the private sector
There are also plans for GCHQ to offer some of the technologies that it has developed in-house to private sector firms. The establishment of a venture capital arm to the signal's intelligence agency, along the same lines as the CIA's In-Q-Tel, to stimulate the creation of cyber-security startups in the UK is also under consideration. GCHQ will not however become a commercial business, the government stresses.
"GCHQ is home to world-class expertise in cyber security," a government statement explains. "The government will explore ways in which that expertise can more directly benefit economic growth and support the development of the UK cyber-security sector without compromising the agency's core security and intelligence mission."
David Harley, senior research fellow at ESET, expressed disquiet at the central role occupied by GCHQ in the strategy.
“I’m slightly concerned that if the view of the threat landscape is too cyberwarfare/GCHQ-dominated, it may not always work to the best advantage of the private sector and home users, whose priorities and assumptions may be very different," Harley said.
"However, there have to be benefits from the involvement of security agencies with undoubted expertise in specialist contexts.”
Frank Coggrave, general manager of EMEA at computer forensics software firm Guidance Software, questioned whether firms would be keen to share commercially sensitive security information for the common good, even with GCHQ, whose core business involves keeping secrets.
"The sensitive commercial implications of knowledge sharing need to be carefully thought out," Coggrave said. "Many organisations simply do not want to share their secrets, so as not to compromise competitive advantage."
The Home Office was allocated 10 per cent of this budget (or £65m), while the Ministry of Defence gets 14 per cent (£91m) and the government keeps 10 per cent to build secure online services. However the Department of Business gets just 2 per cent (£13m), earmarked on working with the private sector to improve resilience, a lot less than the five per cent (£32.5m) allocated to the Cabinet Office to co-ordinate internet security initiatives.
Share and enjoy
The strategy outlined on Friday has several aims including bolstering co-operation with the private sector in the fight against cybercrime, improving the organisation of computer crime-fighting authorities and investing in improved cyber-security defences as well as educating the public about internet security risks.
Minister for cyber-security Francis Maude said: "This strategy sets out how we will realise the full benefits of a networked world by building a more trusted and resilient digital environment, from protecting the public from online fraud to securing critical infrastructure against cyber attacks.
“The government cannot do this alone. Closer partnership between the public and private sector is crucial. The strategy heralds a new era of unprecedented cooperation between the government and industry on cyber-security, working hand in hand to make the UK one of the most secure places in the world to do business.”
Sharing of threat intelligence is central to the greater collaboration between public and private sector that the government would like to see. But, as net security firm Sophos notes, private sector businesses would be keen to see this become more of a two-process where government shares information with them as well as the other way around.
"Co-operation needs to be more than annual conferences, and suited executives sitting around large tables talking about the issues. It needs to be a real-time, meaningful exchange of data which can help businesses and organisations defend against emerging threats," Graham Cluley, a senior technology consultant at Sophos, writes.
Next page: Cyber-weapons to defend the nation
COMMENTS
The real industry security concern is
“I’m slightly concerned that if the view of the threat landscape is too cyberwarfare/GCHQ-dominated, it may not always work to the best advantage of the private sector and home users, whose priorities and assumptions may be very different," Harley said.
This will be no help in selling 1/2 price security bloatware in PC World to Joe public and selling the anti-virus, vulnerability scanner, port locking, disk encryption, firewalls and rules analysers, IDS, IPS, HID, HIP, VPN setup tools, DLP, User provisioning, UAM tools, password vaults etc. to industry, all of which fail to stop even the simplest of DDOS attacks and do little to counter cyber warfare. They do allow industry to pass audits and comply with the law, and home users to say 'how did I get infected, I have anti-virus installed.'
Cyber attacks have been talked about for years, STUXNET seems to be the first to emerge to the public at large. The guys at GCHQ could and probably do write similar code, so currently are the best placed to advise how to defend against these types of attack.
The security industry will no doubt catch up with their fully featured latest security tool that will also secure your uranium enriching centrifuge or water pump, and is selling for 1/2 price at a PC World nearby.
We need a consistent and up-to-date WHOIS database where an ISP's connection to the net depends on them having an abuse reporting address, and honouring notifications of abusive/destructive behaviour, whether from users themselves or the malware on their machines.
Such activity should be characterized as spamming, hacking, ddos, port scanning, etc, which is detrimental to the Net as a whole.
The vast majority of worldwide ISPs are delinquent, in that they simply ignore or reject complaints, assuming they even have an abuse address.
If there was a more robust system in place to marginalize those ISPs and restrict the services they can provide to their users, which will affect their bottom lines, then they might start to take notice, instead of continuing to abuse the whole net.
However, there is a dichotomy - most sites want users, hits, page views for ad revenue.
They are reluctant to ban rogue ISPs users, unless they are a consistent source of DDOS, but that is what may be required now to get some improvement done.
If more web providers could ban users based on their ISPs reputation, something would change. If the core providers on the net such as youtube, gmail, yahoo, hotmail and news sites suddenly started seriously blackholing routes (or diverting to warning pages explaining why, in native languages and what to do), from known rogue ISPs then they would surely start to clean up their acts and ensure their flocks behave.
Thanks to spamhaus and spamcop, spam from zombies is 99% blocked by those that use them. The rest is caught by spamassassin, SPF and DKIM. Spam that has any chance of getting through now originates from compromised gmail, hotmail or yahoo accounts. One hopes that the big email providers are dealing with these robustly, as simply banning their mail servers is not an option.
It is scandalous that many phishing subjects such as hmcg.gov.uk, natwest.co.uk etc still have no SPF record, let alone one with a "-all" option to at least try to protect the authenticity of mail from their domain names.
So this is how he keeps the whizzes!
They're turning GCHQ into a private company to get revenue to keep the Internet guy, who are leaving hand over fist.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Customer Success Testimonial: Recovery is Everything
