Late last year, the German Federal Office for Information Security revealed in a report that an unnamed German steel mill had suffered “massive damage” following a cyber-attack.



Hackers had infiltrated the company’s corporate network using an email that tricked employees into opening a malicious attachment known generally as malware. Once the malware was installed, the attackers were able to leap around the steel mill’s IT systems, eventually damaging the production network to the extent that a blast furnace could not shut down, causing significant material damage.

Alex Dewdney, director, cyber security and resilience, GCHQ

A digital expert said at the time: “We do not expect a steel plant to be connected to the internet and to be hackable – that is quite unexpected.”

But is that still the case? Although the attack in Germany was rare, the convergence of IT, enterprise technology and operational technology – the hardware and software that controls an organisation’s physical equipment – has gathered pace over the past few years, making such attacks easier than ever before and the threat greater.

Will this increased connectivity expose more operational systems to dangers? Will critical national infrastructure (CNI), such as power networks, utilities and other systems, be exposed? And what can be done to lessen the risks? These were the key questions at a recent Guardian roundtable that asked cybersecurity experts to discuss how best to protect the UK’s critical networks and businesses from cyber-attack. The roundtable was sponsored by Atkins, a design, engineering and project management consultancy, and was conducted under the Chatham House rule, which allows comments to be made without attribution, encouraging a free debate.

Raising the profile of cybersecurity in the boardroom

The discussion got underway with most panellists agreeing that in boardrooms – where the key investment decisions are made – the threat of cyber-attacks hasn’t received the attention it deserves. As one attendee said: “I think cybersecurity is beginning to get on to the board’s agenda, but boards aren’t really accepting the need to invest and are happy to push it out to the chief information security officer for them to deal with. Security should be on the chief executive’s agenda.”

If you want to destabilise a country, take their intellectual property and make it cheaper

To exacerbate the problem, the roundtable heard that many board members were unaware how much IT had permeated every aspect of their business over the past 20-30 years. “One of the real dangers is that many leaders don’t realise their organisations have become digital,” said one attendee. “Many leaders probably started their careers when their business was paper-based, and in their minds that’s how the business still works. They don’t realise how IT has transformed their business.”

Therefore, when chief executives make decisions on whether to invest in cybersecurity, they have no instinct for it, the roundtable heard. Even high-profile cyber-attacks, such as those against Sony and Ashley Madison, have failed to focus minds.

This lack of awareness was of particular concern in relation to larger organisations, including some CNI bodies, said an attendee, as many of them rely on outdated, unsupported software. “I’m not sure there is an understanding of how old the systems are that run our infrastructure – they are very vulnerable.”

Business runs on profit, and security is still seen as a cost, said another participant, so fixing security vulnerabilities often takes a back seat. Cybersecurity is “still seen as protecting against things that may or may not happen … Other people on the board are talking about increasing sales. They don’t want to decrease profits by putting in this extra security.”

Emma Philpott, chief executive, The IASME Consortium

So how can an organisation’s leadership team be encouraged to act on cybersecurity? A number of participants suggested the best way to make corporate boards care about cybersecurity was to make customers care. “There is a case for doing more in terms of general public awareness,” said one attendee.

For others, the way in which safety is now taken so seriously by board members offered an example of what could be done to focus attention on cybersecurity.

“If you have a major safety incident, somebody sat at the board level goes to prison,” said one participant, referring to the Health and Safety Offences Act. “If a cyber-incident became an imprisonable offence, how quickly would the chief information security officer find himself sat on the board?”

Cyber-risks caused by employees

Along with a lack of awareness at board level, participants agreed that employees were often the greatest cybersecurity threat facing an organisation, either by accident – for instance by opening malware from an email (as was the case in the Germany steel mill), or using weak passwords – or by intentionally stealing sensitive information.

“In the old days it was the external hackers people used to be worried about, whereas now the internal threat is greater than the external threat,” said an attendee.

“It’s bizarre as you have the Edward Snowdens and the Chelsea Mannings of this world – they’re more of a threat than external people, and they’re the people who have legitimate access.”

But what about those who don’t have legitimate access? Should the UK be worried about attacks from nation states?

Andrew Rogoyski, vice-president cybersecurity services, CGI

“If foreign countries have access to critical networks, that might be fine now, but in a different geopolitical context, five years from now, that’s something we should worry about,” said one participant.

The harm that could be done doesn’t have to be physical, either, the roundtable heard. “Information is what now makes countries more valuable than other countries,” said one attendee. “If you want to destabilise a country, take their intellectual property, make it cheaper and push it in other markets.”

However, other participants said that worries over attacks from nation states were misplaced, as this led people to believe hackers had to be highly skilled and therefore almost impossible to repel. “It’s often kids in the bedroom that download [hacking] software,” the roundtable was told. “If you haven’t got the [cybersecurity] basics right, then you can be massively compromised by a little-skilled individual,” said another participant.

How to get cybersecurity right

So how can an organisation get basic security right? A number of resources were mentioned at the roundtable, including: 10 Steps, GCHQ’s guidance on what organisations can do to improve the security of their networks; and Cyber Essentials, a government-backed, industry-supported scheme to help organisations protect themselves against internet-based threats.

Nigel Harrison, Non-executive director, Cyber Security Challenge UK

Companies should also be asking for more secure systems from their tech suppliers, the roundtable heard. But organisations shouldn’t “try to make everything perfect”, said an attendee, referring to the procurement of IT systems. “If you can’t specify a really detailed security problem, don’t bother, just say: ‘We’d like it secure.’ Take small steps to make yourself better than you were yesterday.”

“Big names don’t deliver security,” said one participant, sounding a note of caution, and other participants agreed there is a market failure. “That’s my product: take it or not,” is the attitude of the big IT firms, said another attendee. One participant shared a story they knew of a US government department requesting a global tech giant to make one of their products more secure, but the tech firm said no. “If the US government hasn’t got the clout to do this, then who has?”

For many of the delegates, therefore, the most viable option for reducing the risk of a cyber-attack relied upon communication and education. “Don’t just make this about nation states trying to break in and destroy the control network,” said one participant. “It’s not really relevant to a lot of people.” Instead, it was suggested organisations should educate their employees so they know how to protect their personal data and devices, “so when they come to work, they’re used to being secure at home”.

Another attendee agreed: “It’s a lot cheaper to spend money on user training than it is to buy a new firewall.”

Combating cyber security tips

While the threat of cyber-attacks is growing, many organisations struggle to even get the basic safeguards in place to protect their infrastructure and data. Practical security measures that emerged from the roundtable included:

regularly patching firewalls



updating firmware



setting strong passwords



changing the password your Wi-Fi router came with



asking employees who use their own devices at work to install anti-virus software and to switch on firewalls.

There are a number of free security options online, which makes these tips easy to implement.



At a higher level, senior IT professionals should also be encouraged to share information among their peers and competitors, as one participant pointed out: “Security transcends competition.”

Safeguarding networks from cyber-attack debate: at the table

Jane Dudman (Chair) Editor, Guardian Public Leaders, the Guardian



Editor, Guardian Public Leaders, the Guardian Guy Bunker Senior vice-president, products, Clearswift



Senior vice-president, products, Clearswift Alex Dewdney Director, cyber security and resilience, GCHQ



Director, cyber security and resilience, GCHQ Nigel Harrison Non-executive director, Cyber Security Challenge UK



Non-executive director, Cyber Security Challenge UK Emma Philpott Chief executive, The IASME Consortium



Chief executive, The IASME Consortium Geraint Price Lecturer in information security, Royal Holloway University



Lecturer in information security, Royal Holloway University Paul Simmonds Chief executive, Global Identity Foundation



Chief executive, Global Identity Foundation Martin Sloan Group head of security, Drax



Group head of security, Drax Andrew Cooke Client director, Infrastructure, Atkins



Client director, Infrastructure, Atkins Steve Trippier Head of cyber security, Anglian Water



Head of cyber security, Anglian Water Andrew Rogoyski Vice-president cybersecurity services, CGI



Vice-president cybersecurity services, CGI Mark Neate Chief security officer, Sellafield



Chief security officer, Sellafield Paul Lindsell Managing director, Mind Metre Research





