Every country’s government has its secrets. Whether it’s information on strategic military positions, to data on its citizens, there has long been a need for cyber-intelligence defences and the protection of High Assurance computer systems.
But, as everything from a country’s power grid to its national transportation network comes online, the lines between government, civil, and industrial systems are becoming increasingly blurred. In today’s digital world, an adversary taking banking systems offline, or causing mayhem on transport infrastructure, poses a threat to life that’s every bit as real as a physical attack or traditional industrial espionage.
Clearly, while many of these systems may be built and operated by commercial organisations, their importance to national defence can’t be underestimated. It’s vital therefore that, while the risks to data will vary from country to country, vital cyber-security measures are put in place to protect it.
Here we’ll take a look at the steps some of the world’s superpowers are taking to protect themselves.
UK:
A recent report published by the National Audit Office condemned the poor state of IT security across UK government departments, which may cast doubt on Britain’s readiness for cyber-attack. Central government however is much more prepared and recently announced the formation of the National Cyber Security Centre (NCSC), headed up by experienced security professionals, and with clearly laid out plans for its approach to improving the state of national cyber security.
Not only does the NCSC take a threat-based approach to the issue, involving active analysis of the types of attacks the government might realistically face, but it also eschews the scare tactics and reactive endpoint security tactics traditionally used by vendors of IT security solutions.
In addition, the NCSC has announced a policy of “active defence”, or “hacking back the hackers”. A controversial approach, particularly if used pre-emptively, active defence should be regarded as a necessary weapon in the fight against cyber-crime.
And finally, as networks and software increasingly become the lifeblood of our daily lives and our country’s critical infrastructure, the UK government has publicly acknowledged the importance of working closely with industry experts and more forward-looking companies to share the responsibility of keeping society safe.
US:
Taking its own significant steps to defend against cyber espionage, the US recently passed the Cybersecurity Act of 2015, the main aim of which is to “provide important tools necessary to strengthen the Nation’s cybersecurity”. One particular focus of the Act is on making it easier for private companies to share information on cyber-threats with the government and other organisations.
Early incarnations of the country’s cyber strategy were driven by the realisation that a range of businesses, from tech giants like Cisco to online banks and financial institutions, were at serious risk from cyber-attacks.
Financial interference and IP theft – even from private companies – are effective ways of degrading a country’s capabilities, assets, and operation capacity, and should therefore be considered as threats to national security. It no longer takes a physical war to disrupt a society when it’s possible to reach straight into its citizen’s living rooms and hold their digital lives to ransom.
The government clearly now recognises the importance of its citizens’ online data, and the role the public sector mist play in safeguarding this information. Indeed, the latest move in the Cybersecurity National Action Plan is for the government to work in partnership with commercial tech giants to help US citizens protect their online identities.
Europe:
Published by the European Commission in July 2016 as part of a series of measures to raise the continent’s preparedness to ward off cyber incidents, the NIS Directive is the first piece of Europe-wide legislation on cyber-security.
Until recently, the defences and response systems implemented by various member states have varied in subtle but inconvenient ways, such as differing definitions of security levels, and different models for security authorities and response bodies.
The Directive’s main aim is to enable an efficient, effective Europe-wide system of defence against cyber-attack by addressing many of these troublesome practical issues around harmonising the various different standards of the EU’s member states.
In addition, the Directive also requires each member state to operate a Computer Emergency Response Team (CERT), and seeks to take greater control over the protection of “essential industries” such as power, water, transportation and big finance as they undergo a process of digital transformation.
China:
The Chinese government recently gave its approval to a broad new cyber-security law designed to tighten and centralise state control over the country’s information flows and technology equipment.
To comply with the new legislation, agencies and enterprises are required to improve their ability to defend against network intrusions while carrying out reviews of security for equipment and data employed in different strategic sectors.
However, while this may appear to be a sensible approach, it has been criticised by many, and described by James Zimmerman, chairman of the American Chamber of Commerce in China, as “a step backwards for innovation.”
This new law doesn’t come into effect until June 2017, so it remains to be seen whether it proves to be as restrictive to businesses as some are predicting.
India:
“Digital India” is an ambitious and impressive programme designed to bring the whole country online, and “transform India into a digitally empowered society and knowledge economy.”
Whether casting a vote or accessing public services, all interactions with the Indian government are soon to be made available via an easy, fast and modern online system. It’s hoped that the system will also be used to address non-governmental aspects of modern digital living, such as creating “private spaces in public cloud” and a secure system of “electronic and cashless financial transactions.”
Of course, while the system represents tremendous possibilities for a more streamlined and contemporary democracy and digital economy, it also presents significant opportunities for hackers and fraudsters.
Indeed, helping to keep Digital India ahead of the latest cyber-threats is a key concern for those working on the initiative, whether they’re experts in policy, government services, or security technologies such as PKI.
Facing a world of changing threats
From these examples alone, it’s clear how approaches to cyber-security vary across the world. What is common, however, the threat that cyber-attackers pose to a government’s data, and that of its citizens.
Acknowledging this threat is the first step to defending against it. Only by deploying a bold strategy, which includes the most advanced and robust security techniques, combined with a strong understanding of the risks that they face, will governments ensure the safety and security of the information they hold.
The world in which we live is changing, and so are the threats that we face on a daily basis. Governments around the globe must now ensure they’re flexible and agile enough to recognise when the attackers are getting ahead, and act accordingly.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.