GCHQ director general for cyber security, Ciaran Martin, has said that current measures to protect the UK from cybercrime are "not yet good enough." He's also the man at the head of the UK's brand new National Cyber Security Center (NCSC), due to open next month.
Here’s the speech Ciaran Martin CEO of #UKNCSC gave at the @BillingtonCyber summit https://t.co/54euiRqRQX
— CESG HMG (@CESG_HMG) September 14, 2016
Speaking in Washington in his first public comments as the chief executive of the NCSC, Martin called for the creation of a flagship project of automated defenses to focus on protecting government sites and industries regarded as central to national security.
Hard data and hard credible evidence has been scarce in cybersecurity. UK Cyber Chief Martin plans to change that #BillingtonSummit
— Billington Cyber (@BillingtonCyber) September 13, 2016
"Far too many of these basic attacks are getting through. And they are doing far too much damage. They're damaging our major institutions. A British telco hit the headlines last year and the initial speculation was around a highly sophisticated attack but it is now believed to have been an SQL injection, a basic technique dating from the end of the last century.
"65 per cent of all large UK companies reported a breach in the last year. And our local media in the UK is full of painful stories of small businesses, lovingly built up, struggling to survive and maintain the confidence of their customers after a ransomware attack."
In 2015, there were around 200 "national-security-level cyber-incidents" detected a month, more than double the number in 2014.
If such attacks are not countered, the cost to UK businesses could be great. One-eighth of the UK's gross domestic product (GDP) is generated by the digital economy.
The Snowden leaks claimed that GCHQ monitored secret fibre-optic cables that carry the world's phone calls and internet traffic; spied on foreign allies' phones and computers at the G20 summit in 2009, and had unlimited access to customers' phone calls, email messages and Facebook entries stored by British telecoms companies, including BT and Vodafone.
However, with the threat of cybercrime increasing, many companies and customers may be tempted by the trade-off of strengthened security against hackers.
GCHQ director general for cyber security, Ciaran Martin, acknowledged that there are privacy concerns:
"The Government does not own or operate the Internet. Consumers have a choice. Any DNS filtering would have to be opt out based. So addressing privacy concerns and citizen choice is hard wired into our program."
GCHQ is expected to work with Internet service providers such as BT, Talk Talk and Virgin Media to filter websites set up by scammers, which download malware onto victims' computers. For the firewall to work, the spy agency wants to create a national domain name system (DNS) that can be used to block these suspect websites.
"We're exploring a flagship project on scaling up DNS filtering. What better way of providing automated defences at scale than by the major private providers effectively blocking their customers from coming into contact with known malware and bad addresses?"
The National Cyber Security Center will open in October, and is expected to take on existing responsibilities for protecting government and critical national infrastructure.
