Fix the basics first, then worry about AI, advise experts

West’s internet ‘under pressure’

In terms of general cyber threats, Eleanor, head of assessment at NCSC, said that the Western model of the internet is increasingly coming under pressure.

“We feel that the internet is becoming ‘less free’ with authoritarian states clamping down on free speech online, monitoring their citizens daily lives online, and using their cyber abilities to control and monitor what their citizens are doing, thereby restricting and censoring the internet,” she said.

At the same time, these authoritarian states are meddling in the free sections of the internet in the West, she said, and turning online freedoms against themselves by spreading disinformation, using troll factories and exploiting free speech for malicious purposes.

“There also seems to be a disconnect between the alarm in the media and regulatory regimes about the theft of data, and the threat that data breaches represent and the targeting of data, whereas the average citizen is more blasé than the coverage suggests they ought to be,” she said.

However, the NCSC expects the gap to close in the coming months and years as people get a better understanding of why their data is important and what malicious actors can do with it.

“Our key hostile state adversaries like China, Russia, Iran and North Korea will continue to launch malicious cyber activity against the UK and its allies, and we will continue to engage in that arms race and defensive activity that we will have to do because it is not likely to stop any time soon,” said Eleanor.

However, she said that state-sponsored malicious cyber activity is not limited to just four states. “We are seeing other states coming out of the woodwork, with other nation states learning from the big four and copying each other, such as some states in the Gulf area and South America.

“This means the [cyber] arms race won’t be exclusively dominated by the big four in perpetuity, so we do need to keep an eye out for some smaller players coming to the fore.”

Attackers move up value chain

Speaking more generally about future cyber threats, PwC’s McConkey said one of the key trends already in evidence is the fact that attackers are moving up the value chain and will continue to do so.

“If you look at financial services, we are going from commodity banking malware to nation states that are effectively in central banks and others, and being potentially able to target data feeds that financial services rely on, enabling [threat actors] to manipulate market activity,” he added.

In aggregate, he said, this means that, either intentionally or unintentionally, threat actors are targeting the trust mechanisms that the digital ecosystem is built on.

“We have seen in the supply chain from a process perspective with MSPs [managed service providers] being targeted. We have other China-based actors running rampant in over a dozen global telcos from a telecommunications perspective, and we have possible targeting of hardware and software supply chains,” he said.

“So across the entire ecosystem of stuff that we rely on for process outsourcing, communications, software and hardware, we have got a growing number of very good and persistent attackers focusing on getting into those at some sort of level.

“As a result, we have to learn to figure out how to deal with that at a much bigger scale than we are currently dealing with, but it will be interesting to see what the objective are within the next five years, because I think they will change.”

Industrialisation of cyber crime

Providing a law enforcement perspective, Andrea S, cyber threat intelligence lead at the National Crime Agency (NCA), said that the proliferation of data in society is providing criminals with increasing opportunity to tap into that data and monetise it.

“The key threats are whatever is hitting us right now, but what is persistent is the individuals behind it, and our ability to tackle those [cyber criminals] collaboratively with partners [is what is important]. The gap between our capabilities and theirs is what is really going to describe the threat going forward,” said Andrea.

The persistent criminals that have been around for a long time have built complex networks and have the capabilities they need in-house. “Over the past few years, we have seen that become a marketplace, opening up through forums to provide cyber criminal services,” said Andrea.

“More recently, we have seen in the dark web space that become more prevalent. So what we are talking about is an industrialisation of cyber crime, right from low-level actors right up to the very hard-to-catch criminals. They are entrepreneurs and they will drive the criminality and the threats because they are very adaptive and forward-looking.”

Because attacks are likely to be a mix of targeted, opportunistic and even unintended – as some have argued in the case of WannaCry, which is widely believed to have been unleashed by mistake or without understanding of what the effect would be – Matt of the NCSC said defences need to focus on key underlying systems.

“We need to ensure that the defences we have in place are good enough to protect those basic systems, not only critically important systems inside critically important networks, but also the basic systems we rely on daily so they are resilient enough to protect us against any wayward attack that may not be directed at us as well as specifically targeted attacks,” said Matt.

In closing, UCL’s Watson said organisations should be thinking about attack surfaces. “There are many attack surfaces beyond the traditional ones like industrial control systems, autonomous vehicles and building management systems. It behoves us to do a careful analysis with partners across those attack surfaces and take precautions that are appropriate to the severity of the outcome.”

McConkey urged more attention to be paid to issues such as orphan kit rather than focusing on rewarding innovation. “I have lost count of the breaches we see because something literally got forgotten about, nobody was looking after it, the person responsible left the organisation and as a result it wasn’t maintained, so it became the root cause of the breach,” he said.

Another key goal, he said, that organisations should be aiming for is implementing all the good security guidance that is available. “All of that has an impact if it is done, and focusing on making small incremental improvements has a disproportionate impact in deflecting a lot of bad stuff,” said McConkey, underlining the importance of getting the security basics done properly.