IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

We're still waiting for UK government to get strategic about cybersecurity

Government investment in cybersecurity is great, but what matters is where the money goes

Open padlock on circuit board

The Queen has opened the new British National Cyber Security Centre (NCSC), and chief executive Ciaran Martin insisted it's the "perfect place to coordinate our cybersecurity and manage incidents across the UK".

He also said that "initiatives will disappoint" and "things will go wrong" which pretty much sums up the UK government's cybersecurity strategy thus far. Which you may think is an odd statement, given that Chancellor of the Exchequer, Philip Hammond MP, stated at the NCSC opening that it will cement our position as a "world leader in cybersecurity". This, frankly, is an odd statement.

Show us the money

Hammond also insisted that "Britain is transforming its capabilities in cyber defence and deterrence", which is good to know. Unfortunately, the government has been saying this for years but not actually doing much to any great effect.

Hammond's predecessor, George Osborne, was also good at talking about cybersecurity. In a 2015 speech announcing 1.9 billion of cybersecurity spending over five years, Osborne mentioned the word 'cyber' 134 times in 45 minutes. Given that there are only three years left of Osborne's original spending timeline, and the current government has made little by way of firm strategic commitments, it's worrying to say the least.

Show us the strategy

Forget 'world leader'; Parliament's Public Accounts Committee chair, Meg Hillier, said that Britain is ranked below Brazil, China and South Africa when it comes to securing smartphones and laptops. This is hardly surprising when the committee report says the government has "little oversight of the costs and performance of government information assurance projects and processes".

The big picture, the strategic problem, is that the government effectively does not have a consistent approach to security breaches and so is unable to make informed decisions when it comes to prioritising resources both financial and hands-on.

Addressing the skills shortage is a start

All that said, there are some promising moves coming from the government. These include initiatives such as GCHQ's CyberFirst programme, which offers the best graduates financial support through bursaries and employment placements which can help them get the hands-on experience needed to properly skill the UK cybersecurity sector.

Beyond that and the opening of the NCSC, the National Cyber Security Strategy (NCSS) seems to be treading water somewhat. It's asked security companies, two years on, to put forward ideas as to how the UK can become cyber secure. It's asking for submissions on such things as what threats we face (yes, seriously) and how the government can combat them (ditto).

Looking for leadership

Should we be that surprised at this apparent discordant response to the cybersecurity threat? If you look to the average enterprise and how cybersecurity is rarely a strategic, business process-led, boardroom level discussion, then the answer is: well no, not really.

That so many C-suite directors do not understand the threats they face when it comes to cyber attack, let alone how to approach defending the organisation, now is the time for the government to grasp the nettle and show some leadership. There are three years of the five-year strategy left, and time is fast running out for the UK government to finally decide what that strategy actually is...

Picture: Bigstock

Featured Resources

Activation playbook: Deliver data that powers impactful, game-changing campaigns

Bringing together data and technology to drive better business outcomes

Free Download

In unpredictable times, a data strategy is key

Data processes are crucial to guide decisions and drive business growth

Free Download

Achieving resiliency with Everything-as-a-Service (XAAS)

Transforming the enterprise IT landscape

Free Download

What is contextual analytics?

Creating more customer value in HR software applications

Free Download

Recommended

What does a CISO do?
Careers & training

What does a CISO do?

12 May 2022
What is identity management?
identity and access management (IAM)

What is identity management?

29 Apr 2022
Podcast Transcript: What’s so hard about public sector IT?
public sector

Podcast Transcript: What’s so hard about public sector IT?

3 Dec 2021
The IT Pro Podcast: What’s so hard about public sector IT?
public sector

The IT Pro Podcast: What’s so hard about public sector IT?

3 Dec 2021

Most Popular

Linux-based Cheerscrypt ransomware found targeting VMware ESXi servers
ransomware

Linux-based Cheerscrypt ransomware found targeting VMware ESXi servers

26 May 2022
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

13 May 2022
Open source packages with millions of installs hacked to harvest AWS credentials
hacking

Open source packages with millions of installs hacked to harvest AWS credentials

24 May 2022