Chatham House says government must provide clearer advice to firms on how to protect themselves from the 'vast' cyber-threat
Widespread confusion over the scale and nature of cyber-criminality is undermining efforts to tackle a menace that may be costing the economy billions of pounds a year, a report has warned.
The study says the government must take a firmer lead and provide people with clearer advice about what they should be doing to protect themselves from online fraud and theft.
Businesses have been at fault, too, it says, with company bosses delegating responsibility to IT specialists within their firms in a deliberate effort to keep a problem they may not understand "at arm's length".
The report, from the Chatham House thinktank, sets out how concern over a "vast" number of cyber-threats has led to a clamour for government and big business "to do something".
But this has proved difficult because, it says, "there is, in short, no agreement on the nature and gravity of the problem" and "little sense of governmental vision or leadership" either.
"The issue of cyber-risks needs to be made accessible for those who are neither familiar with technology nor highly IT-literate," the study warns.
It focuses on the potential vulnerability of those things deemed part of the "critical national infrastructure" (CNI). Among these are the emergency and health services and those businesses that provide energy, food transport and water.
This report argues that the CNI could now include Google and Amazon because both have become integral to "the functioning of a complex modern economy".
Its authors approached 100 of the UK's top businesses and banks. They found many staff believed cyber-threats were already out of control, with one bank claiming criminals were trying to "groom" members of staff to "compromise their corporate loyalty."
The report says: "One financial institution reported that the volume and sophistication of threats are now outstripping the organisation's capacity to respond.
"An interviewee at one major high street bank was distinctly lacking in optimism, noting that there seemed to be 'no natural predator to the bad guys' and predicting gloomily that 'we have crossed the Rubicon; we are not going to keep ahead of this.'"
But while there seems to be a consensus that the problem is growing, many companies appear to be taking it less than seriously, the report states.
"In most cases, they declared themselves to be aware of cyber-security threats. Yet these same organisations were willing … to accept an unexpectedly high level of risk. In several cases it was even decided that cyber-risk should be managed at arm's length from … the board and senior management. Paradoxically … a heightened perception of cyber- security risk is being met with diminished resources and interest."
The thinktank says some executives were guilty of having "deliberately pushed [the cyber problem] below the boardroom level in order to remove a complex and baffling problem from sight". Other senior managers seemed completely unaware of the danger to their firms.
The reports concludes that ministers must play "an integral role in informing wider society and raising levels of awareness" because there is no coherent picture of what is being targeted, and by whom; nor is their any clarity over which systems and services are potentially vulnerable to cyber-attack.
Last year's Strategic Defence and Security Review ringfenced an additional £650m to bolster the UK's cyber-defences, describing the issue as being of "tier-one" importance – the highest priority.
Earlier this year, a Cabinet Office-commissioned report put the annual cost of cyber-crime at £27bn, but some experts questioned the findings. They were concerned that the study involved Detica, a security firm that is part of the arms manufacturer BAE Systems. Detica funded the Chatham House report but the company was not involved either in researching or writing the study.
No comments:
Post a Comment