Original URL: http://www.theregister.co.uk/2011/11/28/cyber_security_strategy_analysis/

Spooks take the wheel in UK's £650m cyber-war operations

GCHQ to lead info sharing with govt and biz

By John Leyden

Posted in Security, 28th November 2011 12:17 GMT

Analysis The British government's Cyber Security Strategy is giving the intelligence agencies a greater role than ever in defending business and the public against internet threats.

The policy, released by the Cabinet Office on Friday, sketches a detailed framework on how the government aims to organise law enforcement efforts and improve the education of netizens on information security risks. At the same time the policy aims to support online businesses, estimated to account for six per cent of the UK economy.

Information security firms broadly back the policy even though some questioned the central role of GCHQ, the signals intelligence agency, and a depiction of the threat landscape that seems to paint cyberwar-style threats (think Stuxnet and cyber-espionage) as more a pressing concern than everyday cybercrime risks, at least if budget allocations are any guide.

Show me the money

The government budgeted £650m over the next four years on improved cyber-security, after ranking cyberspace attacks as a tier-one priority for national security, on the same par as terrorist attacks, in last year's Strategic Defence and Security Review.

The lion's share of the cyber-security budget - £383m or 59 per cent - goes to the "Single Intelligence Account". The account will fund the cyber-security activities of Britain's intelligence community: MI5, MI6 and GCHQ. The majority of this huge investment will help the UK detect and counter cyber-attacks, and most will go to GCHQ in Cheltenham, but the details of how this will work remain classified.

One of the most controversial aspects of the strategy calls for private sector firms to work more closely with specialists at GCHQ, establishing an information sharing hub at Cheltenham.

Fifteen key firms, including Barclays, BT, Vodafone and Centrica, have been working to develop a pilot information sharing scheme with GCHQ, which will begin in earnest in December. GCHQ will act as a clearing house for information, sharing it with other private sector organisations.

Spooks eye up the private sector

There are also plans for GCHQ to offer some of the technologies that it has developed in-house to private sector firms. The establishment of a venture capital arm to the signal's intelligence agency, along the same lines as the CIA's In-Q-Tel, to stimulate the creation of cyber-security startups in the UK is also under consideration. GCHQ will not however become a commercial business, the government stresses.

"GCHQ is home to world-class expertise in cyber security," a government statement explains. "The government will explore ways in which that expertise can more directly benefit economic growth and support the development of the UK cyber-security sector without compromising the agency's core security and intelligence mission."

David Harley, senior research fellow at ESET, expressed disquiet at the central role occupied by GCHQ in the strategy.

“I’m slightly concerned that if the view of the threat landscape is too cyberwarfare/GCHQ-dominated, it may not always work to the best advantage of the private sector and home users, whose priorities and assumptions may be very different," Harley said.

"However, there have to be benefits from the involvement of security agencies with undoubted expertise in specialist contexts.”

Frank Coggrave, general manager of EMEA at computer forensics software firm Guidance Software, questioned whether firms would be keen to share commercially sensitive security information for the common good, even with GCHQ, whose core business involves keeping secrets.

"The sensitive commercial implications of knowledge sharing need to be carefully thought out," Coggrave said. "Many organisations simply do not want to share their secrets, so as not to compromise competitive advantage."

The Home Office was allocated 10 per cent of this budget (or £65m), while the Ministry of Defence gets 14 per cent (£91m) and the government keeps 10 per cent to build secure online services. However the Department of Business gets just 2 per cent (£13m), earmarked on working with the private sector to improve resilience, a lot less than the five per cent (£32.5m) allocated to the Cabinet Office to co-ordinate internet security initiatives.

Share and enjoy

The strategy outlined on Friday has several aims including bolstering co-operation with the private sector in the fight against cybercrime, improving the organisation of computer crime-fighting authorities and investing in improved cyber-security defences as well as educating the public about internet security risks.

Minister for cyber-security Francis Maude said: "This strategy sets out how we will realise the full benefits of a networked world by building a more trusted and resilient digital environment, from protecting the public from online fraud to securing critical infrastructure against cyber attacks.

“The government cannot do this alone. Closer partnership between the public and private sector is crucial. The strategy heralds a new era of unprecedented cooperation between the government and industry on cyber-security, working hand in hand to make the UK one of the most secure places in the world to do business.”

Sharing of threat intelligence is central to the greater collaboration between public and private sector that the government would like to see. But, as net security firm Sophos notes, private sector businesses would be keen to see this become more of a two-process where government shares information with them as well as the other way around.

"Co-operation needs to be more than annual conferences, and suited executives sitting around large tables talking about the issues. It needs to be a real-time, meaningful exchange of data which can help businesses and organisations defend against emerging threats," Graham Cluley, a senior technology consultant at Sophos, writes.

Cyber-weapons to defend the nation

The government is also investing in not just defence but "proactive measures to disrupt threats to information security". The strategy appears to call for the development of offensive as well as defensive capability without outlining the circumstances in which these offensive capabilities might be used or what form they might take.

A new Cyber Defence Operations Group at the Ministry of Defence, overseen by Air Marshall Sir Stuart Peach, head of the new Joint Forces Command, will develop "new tactics, techniques and plans to develop military cyber capabilities", including offensive as well as defensive capabilities, from April 2012.

The MoD's new Defence Cyber Operations Group - which will include a joint cyber unit hosted by GCHQ - will "develop new tactics, techniques and plans to deliver military cyber capabilities".

Flying a secure kite

Improving consumer awareness about internet threats is seen as a key area by ministers. The government wants to establish kitemarks for cyber-security software to help punters and bosses understand the capabilities of products and allow them to make more informed choices. The idea is that kitemarks will help consumers distinguish between genuine and fake anti-virus products, for example. Several security firms have questioned whether this tactic will prove effective.

"It's easy to predict that scammers will simply put bogus kitemarks on their sites and fake anti-virus products to fool products into believing that they are legitimate. After all, they already use the names of legitimate anti-virus products and award logos," Cluley notes.

The government also wants to boost the Get Safe Online website: "Get Safe Online is a terrific website with superb material, but without more money being sent promoting the site to a wider audience, it will continue to suffer from a lack of awareness and most people will simply not know that it exists," Cluley adds.

Rik Ferguson, director of security research and communication at Trend Micro, was more upbeat about the efforts to bolster Get Safe Online. He was also positive about proposals for ISPs to become more pro-active about warning consumers if their PCs are infected with malware.

"Security companies have been saying for some time now that Internet Service Providers have a greater role to play in informing and assisting their customers who have fallen victim to cybercrime and this report promises to explore that capability although without a concrete timeline,” Ferguson said.

Cybercrime re-organisation and iPlods

Over the next two years the government plans to create new cybercrime unit within the new National Crime Agency that will take the lead in dealing with the "most serious national-level cybercrime and to be part of the response to major national incidents". Scotland Yard's Police Central eCrime Unit will be subsumed into this task force in a move that recalls what happened with the National Hi-Tech Crime Unit was swallowed up by the Serious and Organised Crime Agency back in 2006.

Ferguson welcomed the move: "The report finally promises a unified body at the heart of British law enforcement as well as extensive lobbying and support for cross border cooperation on prosecuting cybercrime, something which is key to successfully closing down criminal operations, as was seen in the Esthosts takedown this month."

However he warned that after several changes over recent years in the structure of policing cybercrime the government needs to stick by its latest re-organisation. "There have been too many changes in the recent past," Ferguson said. "We need stability or else confidence will be lost."

"There needs to be strong links between existing and proposed agencies," he added.

Police forces will be encouraged to recruit more so-called cyber-specialists, part-time officers who are experts in computing, already named iPlods by some wags.

The government hopes to make it easier to report financially motivated cybercrime by establishing a single reporting system for businesses and the public, Action Fraud. Meanwhile courts will be given powers to impose internet restriction orders, a type of cyber-ASBO discussed in an earlier story here.

On the diplomatic front, the government wants to push for wider adoption of the Budapest convention on cybercrime, as a move designed to ensure that their a fewer territories where internet fraudsters can operate with impunity.

Second edition

The overall strategy - which succeeds policies developed by the Brown government and published in 2009 - follows extensive consultation with industry, law enforcement and internet bodies that began while the Conservatives were in opposition. Ferguson commented: "If the UK manages to deliver on all the promises of this report it will put us in a leading position in Europe and globally to prevent online crime in the first instance and take action where it does arise.”

ESET's Harley said that while the Brown government's strategy focused on protecting critical infrastructure firms - banks, utilities and telecommunication carriers - the Coalition's strategy focused on helping a wider range of public and private sector organisations, something he described as a positive development.

“I welcome the fact that the government seems to be aware that the nation’s security is not restricted to those organisations formally recognised as part of the critical national infrastructure. It’s a good thing, on the whole, that more generalised cybercrime will be getting some attention as well as the more glamorous but very fluffy topic of cyber-warfare, as in practice it’s not always easy to separate the two.

"My gut feeling is that the proportion of targeted attacks to run-of-the-mill non-targeted attacks is probably overestimated."

The UK's Cyber Security Strategy can be downloaded from the Cabinet Office website here. ®