TESTIMONIALS

“Received the latest edition of Professional Security Magazine, once again a very enjoyable magazine to read, interesting content keeps me reading from front to back. Keep up the good work on such an informative magazine.”

Graham Penn
ALL TESTIMONIALS
FIND A BUSINESS

Would you like your business to be added to this list?

ADD LISTING
FEATURED COMPANY
Government

Call for Economic Security Minister

by Mark Rowe

The UK Government, facing an era of economic warfare, should appoint an Economic Security Minister, says a committee of MPs.

 

The Commons Business and Trade Committee warns that the UK’s economic security regime is “not fit for the future” and it risks becoming the “weak point in the West’s emerging system of economic security”. A case-by-case approach leaves industry uncertain, the MPs argued in a report. They noted that in August, a cyber-attack froze Jaguar Land Rover car production in the UK. The report points to ‘the potential public costs’, besides the disruptive impact, ‘of increasingly frequent cyber-attacks. Given this, it is essential the UK gets its approach right. From the evidence, we have identified three measures that would strengthen cyber resilience in the UK: introducing liability for software developers, incentivising business investment in cyber resilience, and mandatory reporting following a malicious cyber incident.’

 

Chair’s view

The Labour MP Liam Byrne, Chair of the Committee said:  “Britain is now hugely exposed to the risks of economic warfare and bluntly, our current defences are not fit for the future. As a mid-sized, open economy, we are uniquely exposed – ever more reliant on foreign capital, foreign technology and foreign ownership of critical assets. Yet the risks we face are set to get worse in the years to come as foreign investment grows, AI lowers the cost of cyber-aggression and hostile actors become more brazen.

“After World War One, we had to learn how to wield economic power to deter our enemies and keep the country safe in time of war, building what became known as ‘fourth fighting service.’ But those disciplines have been lost and must now be rebuilt.

“The Prime Minister is clear that national security rests on economic security but in reality while our allies have modernised, Britain is falling behind.

“Just as we modernised counter-terrorism doctrine after 7/7, so we now need a comprehensive new doctrine to guide our economic security.  We argue six principles sit at the heart of that new approach; detect, deter, diversify, develop, defend and dovetail — backed by an Office for Economic Security, a dedicated minister and statutory backing to provide long term clarity and certainty for industry. In an era of weaponised interdependence, economic security must stand alongside defence, diplomacy and development as the fourth pillar of Britain’s national strength.”

You can read the 117-page report on the UK Parliament website.

 

Comments

Simon Phillips, CTO of Engineering at CybaVerse, said: “This is a critical topic and it’s positive to see the NCSC and government calling for better security practices from software vendors. Every year, we hear about mass ransomware campaigns, where criminals are exploiting vulnerabilities in ubiquitous software, causing significant operational and financial disruption for organisations.

“But software vendors are never held liable. Why is this fair? If the software that organisations foundationally depend on to facilitate and secure their environments is inherently insecure, how can they ever be resilient? Software vendors must do better.
“Secure-by-design is not a new principle, and it is something that is often preached, but not necessarily practiced, by the biggest technology vendors. These vendors continue to appear in CISA’s top ten vulnerability list every year, with the same category of vulnerabilities, but always with no liabilities.
“Isn’t it time we asked for better? If cyber resilience is the goal, it’s completely unachievable with insecure foundations.
Developers must adopt secure-by-design principles, where security and DevOps work together in tandem to address flaws, not siloing departments, which causes friction and leaves security as an afterthought.
“But as a cybersecurity industry we need to re-evaluate how we measure security and vendors, looking deeper into trends and categorisation, i.e. vendors with recurring vulnerabilities in critical components, such as those found in edge-facing infrastructure.
“Why should the burden and the associated costs of incidents always be the responsibility of victims? To really drive defences, we have to look beyond the surface, beyond the ransomware payments, and into what is really enabling cybercrime to flourish.
“Clearly the poor security practices of software developers are playing a big part in this. If the security of their customers isn’t enough to drive them to make better products, perhaps regulation, with the threat of penalties, is the only solution.”

Related News