Lax cyber security measures could cost UK infrastructure firms £17m

Government proposes tough fines to protect essential UK services from hackers

UK companies running essential services and critical infrastructure may face eye-watering fines if their systems' cyber security is found lacking.

Failure to implement effective cyber security measures could see organisations fined up to 17 million, or 4% of their global turnover, under a consultation launched by the Department for Digital, Culture, Media and Sport (DCMS), which is the same penalty facing firms who fail to protect people's personal data under the government's new Data Protection Bill.

The proposals come after the havoc wrought by May's WannaCry ransomware attack on critical targets like the NHS, which saw a swathe of its hospitals effectively grind to a halt as the ransomware shut out access to core IT systems.

DCMS has been deciding how to best implement the Network and Information Systems (NIS) directive due to come into effect in May 2018, in order to make Britain's essential infrastructure resilient against future cyber attacks.

"We want the UK to be the safest place in the world to live and be online, with our essential services and infrastructure prepared for the increasing risk of cyber attack and more resilient against other threats such as power failures and environmental hazards," explained Matt Hancock, minister for digital.

"The NIS Directive is an important part of this work and I encourage all public and private organisations in those sectors to take part in this consultation so together we can achieve this aim."

However, the fines will be used as a last resort and will not be applied to service operators who have put in appropriate cyber security defences but have still suffered a hack attack.

Under the proposals out for consultation, critical infrastructure organisations will need to develop a cyber security strategy and adopt policies that both understand and manage the potential cyber attack risks they could face.

This will require them to do more than just protect their IT systems, taking responsibility for ensuring staff are aware of the attacks they might face and how to monitor for signs of a breach and be ready to report them as they develop.

Cyber security experts have welcomed the government's proposal, believing it will prompt organisations to move away from systems that lack robust cyber security in the face of relentless hackers.

"This government proposal once again highlights the need for better security across the nation's most essential services," said Dan Sloshberg, cyber resilience expert at Mimecast.

"Studies consistently show that email is the number one attack method used to spread malware that holds critical services, such as energy and transport, to ransom. Despite this, many of these organisations still rely on outdated email security controls that were never designed to stop advanced attacks. It is vital organisations who manage critical services invest in a cyber resilience strategy that involves strong methods of protection, combined with a reliable archive and recovery strategy for data and operational systems, to get back on their feet if something does get through."

The proposed fines and the NIS all forms part of the UK government's 1.9 billion National Cyber Security Strategy, aimed at bolstering the UK's cyber defences and its cyber security industry in the face of significant cyber attacks that can cause economic and reputational damage, like WannaCry and the NotPetya malware spread.

Picture: Bigstock

Featured Resources

Digital document processes in 2020: A spotlight on Western Europe

The shift from best practice to business necessity

Download now

Four security considerations for cloud migration

The good, the bad, and the ugly of cloud computing

Download now

VR leads the way in manufacturing

How VR is digitally transforming our world

Download now

Deeper than digital

Top-performing modern enterprises show why more perfect software is fundamental to success

Download now

Recommended

What is hacktivism?
hacking

What is hacktivism?

13 Oct 2020
What is an MSSP?
Security

What is an MSSP?

13 Oct 2020
Microsoft: Iranian hackers are exploiting ZeroLogon flaw
Security

Microsoft: Iranian hackers are exploiting ZeroLogon flaw

6 Oct 2020
IT Pro Live: Trust through conversations in the 'suddenly virtual' enterprise
Business

IT Pro Live: Trust through conversations in the 'suddenly virtual' enterprise

1 Sep 2020

Most Popular

The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

5 Oct 2020
The enemy of security is complexity
Sponsored

The enemy of security is complexity

9 Oct 2020
What is a 502 bad gateway and how do you fix it?
web hosting

What is a 502 bad gateway and how do you fix it?

5 Oct 2020