Cyber Security and Resilience Bill: Security experts question practicality, scope of new legislation
Legislation aimed at shoring up the UK’s national cybersecurity capabilities is set to be introduced in parliament today – but some security experts have questioned the scope and practicality of new rules.
The Cyber Security and Resilience Bill comes in direct response to growing cyber threats faced by private and public sector organizations, targeting stronger defenses in areas such as healthcare, energy, and transport networks.
The bill also comes at a critical time, with figures from the Office for Budget Responsibility (OBR) showing attacks on critical infrastructure could have a massive impact on the economy.
Analysis from the OBR found a major attack could result in a temporary increase in borrowing by over £30 billion, or equivalent to around 1.1% of GDP.
Elsewhere, the financial impact of attacks across both the public and private sectors has been growing. Research published this week shows the average cost of a “significant cyber attack” on the UK now stands at over £190,000.
“Cybersecurity is national security,” said technology secretary Liz Kendall. “This legislation will enable us to confront those who would disrupt our way of life. I’m sending them a clear message: the UK is no easy target.”
So what can we expect from the bill?
What’s covered under the bill?
Under the legislation, digital and essential services such as IT management for critical sectors will be regulated for the first time and subject to robust minimum security standards.
“Because they hold trusted access across government, critical national infrastructure, and business networks, they will need to meet clear security duties,” the government said in a statement.
“This includes reporting significant or potentially significant cyber incidents promptly to government and their customers, as well as having robust plans in place to deal with the consequences.”
Elsewhere, regulators and government ministers will be given sweeping new powers to ensure organizations meet these base requirements.
“The technology secretary gets new powers to instruct regulators and the organizations they oversee, like NHS trusts and Thames Water, to take specific, proportionate steps to prevent cyber attacks where there is a threat to UK national security,” the government added.
Does the bill go far enough?
The introduction of the bill has, by and large, been welcomed by security industry stakeholders as a positive step toward limiting the impact of cyber attacks on critical infrastructure.
In particular, new rules around incident reporting will play a vital role in bolstering collective defense against growing threats, according to Trevor Dearing, director of critical infrastructure at Illumio.
“The shift from reporting only successful breaches to reporting all cyber incidents is long overdue and will drive rapid improvements in how organizations protect their most critical assets and respond to attacks,” he said.
“Granting the technology secretary new powers to ensure that regulators and organizations monitor or isolate high-risk systems is a smart move,” Dearing added.
However, some industry stakeholders have questioned the scope of the legislation, arguing that it fails to address lingering issues in some key areas.
Chris Dimitriadis, chief global strategy officer at ISACA, suggested the sharpened focus on critical infrastructure fails to address the reality of the modern digital economy.
Moreover, omitting particular sectors, such as retail, is an oversight on the part of the government given the spate of attacks waged against high street brands this year.
“The era when cyber regulation could focus solely on critical national infrastructure is over,” he said. “Today, every major employer is part of the digital economy – and therefore part of the threat landscape.”
“Yet many remain outside the scope of meaningful legislative protections. Recent attacks on major retailers such as M&S and Co-op are perfect examples of how vulnerable our digital ecosystem is and the urgent need to take action.”
Matt Houlihan, VP of government affairs at Cisco, also questioned the practicality of compliance for organizations that fall under the scope of the legislation.
“The success of this bill will rely on clarity and practical timelines to help organizations implement necessary measures effectively,” he said.
“We’d also urge the government not to miss an important opportunity to tackle the growing risks from unsupported, end-of-life equipment – a persistent weak point in UK infrastructure that too often leaves organizations exposed.”
Dearing echoed Houlihan’s comments on reporting, again noting that support for organizations will be crucial.
“Whilst it is understandable that the government is introducing tougher penalties for poor security practices, it is equally important that sufficient support is provided to help organizations achieve compliance,” he said.
“The government must ensure that investment is made in supporting organizations, particularly those with limited budgets.”
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
link
