Ross Parsell, Director of Cyber Security at Thales UK, outlines for MOD DCB the Ministry of Defence’s innovations in the realm of national cyber security.
The Ministry of Defence has a greater need than most organisations for innovating in cyber security. A successful attack on a private business can result in financial harm, loss of IP or reputational damage whereas a successful cyber attack against the UK can put critical national infrastructure, vital communications, defence forces and even the lives of UK citizens at risk.
This can no longer be construed as hyperbole. There are now numerous instances of cyber attacks causing real damage to the well-being of nation states. Consider the 2007 cyber attacks on Estonia in which the websites of prominent Estonian organisations such as ministries, the media and banks were suspended or defaced by extended denial-of-service attacks via ping floods and botnets; the attacks on US government or private business websites, attributed by the US government to foreign powers under the ‘Titian Rain’ label; or the attacks during the South Ossetia war of 2008 that disabled a number of Georgian, Russian, Ossetian and Azeri websites.
Fortunately, the MOD is investing in cyber security innovation to make the UK more resilient to the sorts of attacks outlined above through both defensive and offensive measures. The MOD must also be lauded for its collaboration with industry to combat the growing cyber threat.
Combating the cyber skills shortage
To be at the forefront of cyber security, the MOD needs to recruit and maintain an elite cyber workforce. However, the need for cyber security experts in the UK far exceeds the pool of qualified personnel. While the public sector in general cannot compete with the top private sector firms on salaries, organisations such as the MOD and GCHQ are correctly positioning their cyber security employment opportunities as giving potential applicants more interesting work to do than the private sector. Cyber employees at the MOD really are at the forefront of cyber warfare: protecting the UK from malicious attacks from criminal gangs and other nations.
The MOD has also committed to investing heavily in its recruitment process. Under the UK National Cyber Strategy, central government has earmarked £650 million for hiring ‘cyber warriors’, of which the MOD received £90 million. The MOD will supplement this sum with a further £30 million from its own coffers.
Investing in cyber security technology
The MOD has invested in cutting-edge information security technology to ensure that its employees operate in one of the most secure working environments in the world. For example, assurance encryption hardware protects the MOD’s VoIP, email services, networks and storage to the level of IL5, which the nature of the MOD’s work demands. The MOD makes use of surveillance devices that can detect and alert IT departments as to when cyber attacks have occurred. It may seem like the world of James Bond, but some parts of the MOD even employ monitoring systems which can ascertain the stress levels of employees.
Collaborating with industry for cyber excellence
The MOD works with a number of suppliers, such as Thales, to ensure both it and the UK are cyber secure. National security cannot remain in the hands of the public sector alone but requires collaboration with industry. The MOD relies upon these third-party suppliers for everything from encryption hardware and identity management infrastructures to code signing solutions and time stamping.
However, effective cyber security relies upon more than just products. For instance, while at Thales we supply hardware and software to the MOD, we also supply expertise and training. With the UK under threat from an increasingly complex array of attacks from cyber space, suppliers that can offer the MOD value-add consultancy as well as the provision of equipment will be successful. Through collaboration with industry, the MOD’s workforce can develop their cyber skills and constantly improve their cyber maturity.