UK signals a warning to businesses – Digital Journal

Fuel holding tanks are seen at Colonial Pipeline’s Dorsey Junction Station, which was shut down by a cyberattack that disrupted gas supply for the eastern US for days, highlighting the growing threat hackers pose to infrastructure – Copyright AFP/File Steven Saphore

A new report by the U.K. government warns that cyberattacks on critical infrastructure could endanger life. With the report, the government has updated how it identifies and evaluates risks and the type of data collated.

Looking into the significance of the report is Elliott Wilkes, CTO at Advanced Cyber Defence Systems (ACDS). Wilkes observes that the government see cybersecurity as a risk of major significance and just as disruptive as war. This is reflective of the current pace of pace of geopolitical change.

According to Wilkes: “What’s interesting about this is that it’s not pointing to some specific threat of imminent danger but registering the low but non-zero chance of a significant societal-level event that involves cybersecurity, on par with the impact of terrorism. That’s an important point as it shows the gravity an attack might have on daily life and the potential for disruption.”

In terms of when such an event might take place, Wilkes notes: “The likelihood range the U.K. government assigned to this is 5-25 percent, which they define as “highly unlikely”. In some respects, that’s a sign of progress—just a few years ago, the head of NCSC was warning about the growing likelihood of a “category 1” level attack against the U.K.”

There are cultural factors to consider too: “Cybersecurity awareness has grown, thanks to the work of the government to spread the word, but also the effectiveness of ransomware and cyberattacks starting to get coverage in mainstream media with some degree of frequency. That increased awareness is a net plus for society.”

Wilkes adds: “That said, this is a particularly high bar for the level of disruption. My more immediate concern is the much higher likelihood of cyberattacks that fall short of “catastrophic impact” or great loss of life but are nonetheless deeply disruptive to pockets of the UK, Europe, and the West.”

Wilkes looks at some recent incidents: “In the past few years we’ve already seen ransomware and other cyberattacks on banks, airlines, Royal Mail, airports, and others that all are vitally important to the UK economy. Russia and Russian-aligned actors are increasingly targeting governments and organisations that are critical of Putin and the war in Ukraine.”

With the Russia-Ukraine situation, Wilkes notes: “The spillover from that conflict into the West has already happened, and while these may appear to be isolated events, they represent a pattern of behaviour that constitutes an attack on Western countries (as well as global nations, as we saw in the recent attack on Kenyan government services).”

Wilkes’ other warning, based on the trajectory contained within the report is: “My worry is less about a single event that causes massive loss of life but rather the complacency we risk if we don’t recognise the impact of the increasingly frequent attacks on household brand names and critical elements of the UK economy.”