The National Cyber Security Centre (NCSC) was formed in 2016 to help protect the UK’s critical services from cyber attacks and help providers of those services manage major cyber incidents. NCSC has repeatedly warned that a major attack on critical national infrastructure is a matter of when, not if.

Despite this, a recent cyber security report¹ by the Joint Committee on the National Security Strategy (JCNSS), which monitors the implementation and development of the UK’s national security strategy, highlighted the following: “The 2016 National Cyber Security Strategy states that ensuring the resilience of the UK’s critical national infrastructure to cyber attack is a priority for the Government. But the Strategy does not set out (a) what specifically the Government wants to achieve; (b) over what timeframe; or (c) how it intends to measure progress.”

The report committee evaluated the threats and readiness of the UK in light of ongoing and future cyber attacks against the nation’s critical national infrastructure. And while the committee concedes that the formation of the NCSC was an important step and the agency has provided some important initiatives, it points out that the more significant ones are inherited from EU laws such as the Network and Information Systems (NIS) Directive.² With Brexit looming on the horizon, the UK Government is also busy identifying how international data protection treaties, currently aligned with the EU, will need to be renegotiated once the country leaves the European Union.

In its own 2018 annual review, the NCSC stated it handled 557 events over the prior 12 months.³ This is not an insignificant number by any means but there were many more incidents to which the NCSC was not able to respond due to under-staffing. Speaking of the support NHS Digital received from the NCSC during the 2017 WannaCry attack, Deputy Chief Executive Rob Shaw is quoted in the report saying, “I expected an army of NCSC staff to appear on the hillside and come in to help us out, but it said, ‘Where do you want either of our staff?’ It does not have a lot of people with the expertise to do things on the ground.”

Skills gap is an issue for both the NCSC as well as the critical national infrastructure operators, such as those involved in energy, finance, transport and water, communications, and health, to name a few. Oral evidence taken from such operators cited lack of skills as the biggest challenge they faced. In a separate JCNSS report about cyber security skills in relation to the UK’s critical infrastructure,⁴ the committee concluded that “there are not enough people in the UK who both possess [the required] specialisms and are also willing and able to work in the critical national infrastructure sector.” This raises the obvious question; is it a simple matter of lack of skilled security workers across the UK, or is there a lack of reasonable pay in the public and critical national infrastructure sectors? It’s reasonable to assume that people are taking their skills to private sector organisations who can afford to pay more.

The NCSC expands upon its skills and resources under Industry 100, an initiative designed to bring in industry professionals and their experience to augment those in house.⁵ But while this external resource is a useful way to bolster everything from project management to deep vendor knowledge, it does not provide the army of resources so desperately needed in times of serious and sustained attack against critical national infrastructure. That challenge has yet to be addressed.

Critical national infrastructure is also unique in that it relies on both traditional IT systems as well as operational technology (OT) such as industrial control systems (ICS). These are often legacy systems and not designed with security in mind. Despite this fact, they are increasingly connected to the Internet with the view of increasing automation and productivity. F5 Labs’ own research on cellular connected devices showed that both old and new IoT/OT systems are as vulnerable as ever. And, as they are progressively incorporated into our physical world, they are beginning to pose a real threat to human life.

As a final layer of complication, many of Europe’s critical national infrastructure organisations, particularly in the UK, are privately owned. Mandating that government institutions implement specific cyber security policies is already complex. Attempting to impose similar requirements on private firms is a delicate, if not impossible, ask.

Who’s Really Driving Regulation, Anyway?

Before the EU’s NIS Directive, regulation of critical national infrastructure was fragmented, inconsistent, and divided among sectors. Cyber security regulation was provided by bodies that were originally set up with the primary intention of protecting consumer rights and auditing financial spend. The NIS Directive brings consistent network security requirements across critical national infrastructure organisations throughout the EU.

So, between the General Data Protection Regulation (GDPR), the NIS Directive, and the Payment Services Directive 2 (PSD2), it seems that the driving force of tighter regulation is coming from Europe and not originating within the UK. Although the UK has adopted all EU laws in its local legislation, time will tell how progressive the UK will be with its data privacy, cyber security strategies, and legal frameworks post Brexit. Will the national laws be updated to match the European equivalents when they are inevitably updated? While the UK government has made clear its intention is to continue participating in European cyber security incident response teams (CSIRTs) post-Brexit, it remains to be seen how effective the relationship will be when legislation becomes out of sync.

The NIS Directive is not a silver bullet, however, as some critical national infrastructure sectors (such as water, chemical, nuclear, healthcare services?) are still without regulatory and enforcement oversight.

What’s Next for Protecting Critical Services?

The UK defines some thirteen sectors as critical national infrastructure⁶ while others, such as the US, includes up to sixteen.⁷,⁸ Some have said that the UK’s definition is so broad that it reduces the ability to focus its security efforts on the most important issues. The larger the scope, the more difficult it is to know where to concentrate the limited amount of resources. Where does critical national infrastructure end and the wider infrastructure begin? The swelling interconnectedness of systems and explosive growth of IoT continue to blur the lines between critical national infrastructure, our cities, and humans themselves.