British military at risk of 'fatal' cyber-attack, MPs warn
Defence select committee says there are worrying gaps in MoD's cyber-strategy and calls for urgent ministerial intervention
Britain's armed forces are at risk of being "fatally compromised" by a sustained cyber-attack because the military is dependent on technology that has no proven back-up, MPs have warned .
The potential vulnerability must be addressed urgently, according to the Commons defence select committee, as part of a broader effort across government to face up to the threats posed from cyberspace.
In a withering critique of the government's cyber-strategy, the committee concludes: "The government needs to put in place – as it has not yet done – mechanisms, people, education, skills, thinking and policies which take into account both the opportunities and the vulnerabilities that cyber presents. It is time the government approached this subject with vigour."
In the 2010 strategic defence and security review (SDSR) the coalition made cybersecurity a tier one priority, setting aside £650m to boost the UK's defences, support online safety campaigns, and provide extra investment at GCHQ, the government's electronic eavesdropping centre. All government departments were told to put cyber-defence at the top of their agendas.
The committee's report acknowledges much has been done since 2010 and praises the work of the Ministry of Defence's new top-secret Global Operations Security Control Centre, run by Air Commodore Tim Bishop. The centre has a mix of military, civilian and private contractors, including staff seconded from Fujitsu, BT and the defence firms EADS and Babcock.
But MPs say their inquiry highlighted worrying gaps in strategy and thinking and said it was unclear to them who would be in charge if the UK came under sustained cyber-attack. They also said the MoD was now totally reliant on cyber-systems.
"The evidence we received leaves us concerned that with the armed forces now so dependent on information and communications technology, should such systems suffer a sustained cyber-attack, their ability to operate could be fatally compromised," the report says.
"It is not enough for the armed forces to do their best to prevent an attack … the government should set out details of the contingency plans it has in place should such an attack occur. If it has none, it should say so – and urgently create some."
MPs said more money should be spent to help the military develop offensive cyber-weapons, and "rules of engagement" for cyber-operations should be worked up as "an urgent priority". The report calls on the government to redouble its efforts and put more ministerial focus on the problem.
"It is our view that cyber-security is a sufficiently urgent, significant and complex activity to warrant increased ministerial attention. The relevant minister should have the authority to direct government departments to take action if they are not performing as required."
The report calls on the National Security Council to make clear who takes charge if the UK is targeted in a massive cyber-attack because "location of executive authority … is not clear."
Though MPs said the MoD had done a lot to secure its own systems, they worried that other organisations and suppliers who work with the military were vulnerable to cyber-attacks, and that enemies might potentially find a 'backdoor' route into the MoD.
"The witnesses gave the impression that they believed an admission of the problem took them close to resolving the problem," the report said. "It does not."
The government has been reluctant to blame the countries most likely to be responsible for cyber-attacks, but the MPs drew on evidence to the intelligence and security committee provided by GCHQ.
Their officials admitted: "The greatest threat of electronic attack continues to be posed by state actors and of those, Russia and China, are [suspected of carrying out] the majority of attacks. Their targets are in government as well as in industry."
The shadow defence secretary, Jim Murphy, said the report was worrying. "Policy progress is falling behind the pace of the threat our armed forces face. Vulnerabilities must be tackled urgently and ministers must respond in detail to the demands in this report."
The minister for international security strategy at the MoD, Dr Andrew Murrison, said: "Far from being complacent, the MoD takes the protection of our systems extremely seriously and has a range of contingency plans in place to defend against increasingly sophisticated attacks although, for reasons of national security, we would not discuss these in detail. Government funding to tackle this threat underlines the important we attach to these issues."
The potential vulnerability must be addressed urgently, according to the Commons defence select committee, as part of a broader effort across government to face up to the threats posed from cyberspace.
In a withering critique of the government's cyber-strategy, the committee concludes: "The government needs to put in place – as it has not yet done – mechanisms, people, education, skills, thinking and policies which take into account both the opportunities and the vulnerabilities that cyber presents. It is time the government approached this subject with vigour."
In the 2010 strategic defence and security review (SDSR) the coalition made cybersecurity a tier one priority, setting aside £650m to boost the UK's defences, support online safety campaigns, and provide extra investment at GCHQ, the government's electronic eavesdropping centre. All government departments were told to put cyber-defence at the top of their agendas.
The committee's report acknowledges much has been done since 2010 and praises the work of the Ministry of Defence's new top-secret Global Operations Security Control Centre, run by Air Commodore Tim Bishop. The centre has a mix of military, civilian and private contractors, including staff seconded from Fujitsu, BT and the defence firms EADS and Babcock.
But MPs say their inquiry highlighted worrying gaps in strategy and thinking and said it was unclear to them who would be in charge if the UK came under sustained cyber-attack. They also said the MoD was now totally reliant on cyber-systems.
"The evidence we received leaves us concerned that with the armed forces now so dependent on information and communications technology, should such systems suffer a sustained cyber-attack, their ability to operate could be fatally compromised," the report says.
"It is not enough for the armed forces to do their best to prevent an attack … the government should set out details of the contingency plans it has in place should such an attack occur. If it has none, it should say so – and urgently create some."
MPs said more money should be spent to help the military develop offensive cyber-weapons, and "rules of engagement" for cyber-operations should be worked up as "an urgent priority". The report calls on the government to redouble its efforts and put more ministerial focus on the problem.
"It is our view that cyber-security is a sufficiently urgent, significant and complex activity to warrant increased ministerial attention. The relevant minister should have the authority to direct government departments to take action if they are not performing as required."
The report calls on the National Security Council to make clear who takes charge if the UK is targeted in a massive cyber-attack because "location of executive authority … is not clear."
Though MPs said the MoD had done a lot to secure its own systems, they worried that other organisations and suppliers who work with the military were vulnerable to cyber-attacks, and that enemies might potentially find a 'backdoor' route into the MoD.
"The witnesses gave the impression that they believed an admission of the problem took them close to resolving the problem," the report said. "It does not."
The government has been reluctant to blame the countries most likely to be responsible for cyber-attacks, but the MPs drew on evidence to the intelligence and security committee provided by GCHQ.
Their officials admitted: "The greatest threat of electronic attack continues to be posed by state actors and of those, Russia and China, are [suspected of carrying out] the majority of attacks. Their targets are in government as well as in industry."
The shadow defence secretary, Jim Murphy, said the report was worrying. "Policy progress is falling behind the pace of the threat our armed forces face. Vulnerabilities must be tackled urgently and ministers must respond in detail to the demands in this report."
The minister for international security strategy at the MoD, Dr Andrew Murrison, said: "Far from being complacent, the MoD takes the protection of our systems extremely seriously and has a range of contingency plans in place to defend against increasingly sophisticated attacks although, for reasons of national security, we would not discuss these in detail. Government funding to tackle this threat underlines the important we attach to these issues."
No comments:
Post a Comment