George Osborne's understanding of cybersecurity is worrying

Chancellor's new cyber measures get an awful lot wrong

George Osborne said the word 'cyber' 134 times in his 45-minute speech to GCHQ earlier this week.

They say that talk is cheap, but in this case it could turn out to be quite expensive. Not only does Osborne plan to double cybersecurity spending to 1.9 billion over the next five years, but the proposals he set out in his speech will be expensive in terms of protecting our data and our critical national infrastructure.

If you include the Snooper's Charter in all this, the government's measures could ultimately cost us our freedom.

Why such a negative reaction to the words of Mr Austerity? Well, reading through the transcript of his speech, it's clear that while Osborne gets some things right, he also gets an awful lot wrong.

I'm not going to argue with Osborne when he says that "citizens need to follow basic rules of keeping themselves safe: installing security software, downloading software updates, using strong passwords".

Nor when he states that "companies need to protect their own networks, and harden themselves against cyber attack": all of this makes perfect sense.

Where things go a little pear-shaped, however, is when Osborne claims that "only government can defend against the most sophisticated threats". 

This is patently nonsense. Governments the world over have proven time after time that they are incapable of defending against the least sophisticated threats, and data breach after data breach is proof of that.

If you want more proof, then Osborne went on to praise GCHQ, saying that "it has an unmatched understanding of the internet and of how to keep information safe", which again I would take some issue with.

 This is the organisation whose recent advice includes that "complex passwords do not usually frustrate attackers" and "by simplifying your organisation's approach, you can reduce the workload on users, lessen the support burden on IT department, and combat the false sense of security that unnecessarily complex passwords can encourage. 

Ciaran Martin is Director General of Cyber Security at GCHQ, and the man who gave that advice, along with the ripe old chestnut that is "regular password changing harms rather than improves security, so avoid placing this burden on users". 

Of course, this kind of advice isn't for 'high value individuals' like Martin, but for the rest of us plebs. Then there was the occasion a couple of years back when GCHQ was found to be sending passwords by email in plaintext to would-be spies.

As part of his five-step plan to protect the UK from cyber attack, Osborne will introduce a single National Cyber Centre, reporting to the GCHQ, to replace the "alphabet soup of agencies involved in protecting Britain in cyberspace".

Apparently this will make it easier for government and industry to share information on cyber threats, though I'm not exactly sure how this new organisation is that much different to when "a unified and integrated response to the threat of cyber attack" was established in 2011 in the shape of the Defence Cyber Security Programme, or the Joint Cyber Reserve in 2013, which promised "a dedicated capability to counter-attack in cyberspace". 

It's these inconsistencies in what he is saying now, and what has been said and done in the recent past, that annoy and worry me in equal measure.

But it doesn't stop there - Osborne went on to claim that the government has built cybersecurity into "every stage of the education process", and that its cyber apprentices will ensure we have enough talent to fill cyber vacancies. 

Erm, excuse me? Isn't there a well-acknowledged skills gap when it comes to cybersecurity? 

Even Osborne himself admits that the cyber workforce gap could hit 1.5 million by 2020. So to claim that efforts over the last five years have led to Britain being regarded as "top or near top in the world" when it comes to cyber defence capability is, frankly, laughable. 

Osborne then backtracked a little, within a few breaths, to add "we are not winning as often as we need to against those who would hurt us in cyberspace". Indeed, anyone who reads the news knows that data breaches are on the up. Many who work within the IT security industry will tell you we are not only losing lots of battles, but the war as well. 

Just throwing money at cybersecurity is not enough, and has never been enough. That the government can find a spare 1.9 billion over the next five years for cybersecurity investment, at a time of austerity measures almost everywhere else, is one thing.

Ensuring the money is well spent is quite another thing. Regular readers will know that I have something of a mantra which goes 'it ain't what you spend, it's the way that you spend it, that's what gets results'.

It remains to be seen just how ambitious, and just how successful, the programme to train young people with cyber talent will be. 

The announcement that things are kicking off with a competitive bidding process to open a new Institute of Coding is a start. But without the education of end users in security smarts, as well as skilling up potential IT security graduates, I fear we will not move on from the situation we find ourselves, in where we are chasing our tails as the bad guys get access to increasingly dumbed down tools to launch increasingly advanced attacks.

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Leading the data race

The trends driving the future of data science

Download now

How to create 1:1 customer experiences at scale

Meet the technology capable of delivering the personalisation your customers crave

Download now

How to achieve daily SAP releases

Accelerate the pace of SAP change to support your digital strategy

Download now

Recommended

Third-party apps are tracking your WhatsApp activity
social media

Third-party apps are tracking your WhatsApp activity

21 Sep 2020
Ransomwiz lets you test your security with simulated ransomware
ransomware

Ransomwiz lets you test your security with simulated ransomware

21 Sep 2020
Best free malware removal tools 2020
Security

Best free malware removal tools 2020

21 Sep 2020
Windows Server flaw sparks emergency US gov warning
vulnerability

Windows Server flaw sparks emergency US gov warning

21 Sep 2020

Most Popular

Google Pixel 4a review: A picture-perfect package
Google Android

Google Pixel 4a review: A picture-perfect package

18 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020