IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Lax cyber security measures could cost UK infrastructure firms £17m

Government proposes tough fines to protect essential UK services from hackers

UK companies running essential services and critical infrastructure may face eye-watering fines if their systems' cyber security is found lacking.

Failure to implement effective cyber security measures could see organisations fined up to 17 million, or 4% of their global turnover, under a consultation launched by the Department for Digital, Culture, Media and Sport (DCMS), which is the same penalty facing firms who fail to protect people's personal data under the government's new Data Protection Bill.

The proposals come after the havoc wrought by May's WannaCry ransomware attack on critical targets like the NHS, which saw a swathe of its hospitals effectively grind to a halt as the ransomware shut out access to core IT systems.

DCMS has been deciding how to best implement the Network and Information Systems (NIS) directive due to come into effect in May 2018, in order to make Britain's essential infrastructure resilient against future cyber attacks.

"We want the UK to be the safest place in the world to live and be online, with our essential services and infrastructure prepared for the increasing risk of cyber attack and more resilient against other threats such as power failures and environmental hazards," explained Matt Hancock, minister for digital.

"The NIS Directive is an important part of this work and I encourage all public and private organisations in those sectors to take part in this consultation so together we can achieve this aim."

However, the fines will be used as a last resort and will not be applied to service operators who have put in appropriate cyber security defences but have still suffered a hack attack.

Under the proposals out for consultation, critical infrastructure organisations will need to develop a cyber security strategy and adopt policies that both understand and manage the potential cyber attack risks they could face.

This will require them to do more than just protect their IT systems, taking responsibility for ensuring staff are aware of the attacks they might face and how to monitor for signs of a breach and be ready to report them as they develop.

Cyber security experts have welcomed the government's proposal, believing it will prompt organisations to move away from systems that lack robust cyber security in the face of relentless hackers.

"This government proposal once again highlights the need for better security across the nation's most essential services," said Dan Sloshberg, cyber resilience expert at Mimecast.

"Studies consistently show that email is the number one attack method used to spread malware that holds critical services, such as energy and transport, to ransom. Despite this, many of these organisations still rely on outdated email security controls that were never designed to stop advanced attacks. It is vital organisations who manage critical services invest in a cyber resilience strategy that involves strong methods of protection, combined with a reliable archive and recovery strategy for data and operational systems, to get back on their feet if something does get through."

The proposed fines and the NIS all forms part of the UK government's 1.9 billion National Cyber Security Strategy, aimed at bolstering the UK's cyber defences and its cyber security industry in the face of significant cyber attacks that can cause economic and reputational damage, like WannaCry and the NotPetya malware spread.

Picture: Bigstock

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Recommended

CMO job description: What does a chief marketing officer do?
Business strategy

CMO job description: What does a chief marketing officer do?

9 Jun 2022
CFO job description: What does a chief financial officer do?
Business strategy

CFO job description: What does a chief financial officer do?

9 Jun 2022
What does a CISO do?
Careers & training

What does a CISO do?

12 May 2022
What is identity management?
identity and access management (IAM)

What is identity management?

29 Apr 2022

Most Popular

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks
Security

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks

27 Jun 2022
Open source giant Red Hat joins HPE GreenLake ecosystem
automation

Open source giant Red Hat joins HPE GreenLake ecosystem

28 Jun 2022
Carnival hit with $5 million fine over cyber security violations
cyber security

Carnival hit with $5 million fine over cyber security violations

27 Jun 2022