GCHQ lines up BAE and pals for 'Cyber Incident Response'
When only a huge, bloated military contractor can help
Eavesdropping spook base GCHQ is drawing up a list of companies that can help power stations, banks and other crucial UK organisations fend off and recover from hacking attacks.
The "Cyber Incident Response" scheme - launched today by CESG, the data security arm of GCHQ, and the Centre for the Protection of National Infrastructure (CPNI) - is targeted at the public sector and firms supporting the UK’s key systems and businesses. A roll out to the wider private sector may follow as the programme matures.
The project, in its pilot phase, recommends four companies selected for their expertise in computer forensics and their ability to respond to digital attacks on electronic systems. The four firms, which will assist the nation's critical organisations, are BAE Systems Detica, Cassidian (the defence and security unit of EADS), Context Information Security and US-based Mandiant.
The concept is modelled on the well-established CHECK scheme that firms can use to find CESG-approved penetration-testing outfits. So-called cyber-incident response services are necessary because, even with a well thought out corporate security policy, malware outbreaks and hacker attacks are inevitable. The trick is to detect attacks early and thwart them before any real damage is done, which is where response services come into play.
Chloë Smith, minister for safeguarding Blighty's computers, said: “The growing cyber threat makes it inevitable that some attacks will get through, either where basic security is not implemented, or when an organisation is targeted by a highly capable attacker. ‘Cyber Incident Response’ services provide access to organisations certified by CESG/CPNI to respond effectively to cyber incidents." ®
Re: I Struggle
Very fair points.
You might also have chosen to mention the Nimrod crash inquiry (Haddon Cave inquiry) which lambasted BAe (and Qinetiq, and the MoD) for their technical and commercial incompetence (and worse) which they had hidden behind a culture of Powerpoint and "tick the box, regardless".
Re: I Struggle
"I Struggle.. to work out what's actually wrong with this initiative."
What's wrong is that the starting point is wrong, in an assumption by government that all (or a lot of) our critical infrastructure is cobbled on to the internet with no more security than a password of "password", and a user ID of "admin". I'm sure there's more than a few instances of dodgy security, but the implied threat is largely fictitious, like most of the things government work bravely and tirelessly to save us from.
However, to appoint BAe (involved in every major defence overspend and procurement failure in the past forty years) to give advice on this is not going to end well. The consultants will undoubtedly come up with a series of recommendations with a high cost, to be paid by you through your utility bills, but in reality offering no material advantage to your security.
All of this "cyber security" claptrap is being parroted by a government that has virtually no IT or science expertise amongst its MPs (or civil servants, if we judge by results), and you can be sure that BIS or whoever will have drawn a narrow remit that precludes any bigger picture application of common sense. So you might feel happy that the electricity companies are going to be paying for BAe's expertise, but what do you think National Grid's IT bods have been doing all these years? Even then, the physical threat remains, so that you could for example bring down the power grid to the entire south east of England with a handful of well placed devices, and in a manner that would take weeks to resolve.
We certainly do need to keep in mind the threat of systems intrusion and electronic attack, but the limited success of Stuxnet with the backing of the largest and smartest world technology power, and the delivery by the world's most effective spying, intelligence and sabotage power (Israel) shows that the whole cyber warfare risk is over-rated.
Re: About time, I suppose
"Stuxnet DID have limited success."
If its goal had been to affect only the Windows-centric parts of the installation, it would have succeeded massively, by anybody's definition.
Its apparent goal was more complicated (much more complicated, technically) than that, involving hiding its payload in a hard-to-spot way inside the programs on the automation devices, so that it could disrupt for an extended period, rather than destroy (and provoke retaliation?).
It did that too, for a while.
The success of Stuxnet in penetrating places where penetration should ideally have been very very difficult should have been a warning to IT departments around the world, especially to Windows-dependent IT departments (and automation builders, etc).
It wasn't taken as a warning.
That's very sad. And quite frightening.