Last week Barack Obama and David Cameron announced that the US and UK would implement a rolling program of “war game” cyber attacks on each other, which will be conducted by the FBI, GCHQ and MI5. Targeting critical national infrastructure, a key element of the program will be the sharing of information, with the first test seeing a staged attack on the financial sector later on in the year. During this exercise, the Bank of England and commercial banks in the City of London and Wall Street will be targeted in a bid to ensure adequate security measures are in place.
Following hot on the heels of one of the worst years for data breaches, the US and UK are clearly upping the ante when it comes to enforcing stricter security measures—and rightly so. With the majority of their critical national infrastructure running on connected networks, these industries cannot afford to take any liberties. The last couple of years have shown it really is a case of when, not if, they will be targeted, and by using the most sophisticated techniques, the US and UK crime agencies will, without doubt, be able to expose any existing weaknesses. Businesses will no longer be able to cross their fingers and hope that their ill thought-out or inadequate security strategies will be sufficient.
The sharing of intelligence between MI5, GCHQ and the FBI will be key in this program’s success. While, in the UK, we have seen the Waking Shark exercise and the Bank of England employee ethical hackers to test its infrastructure in recent years, it is only worthwhile if the lessons learned are acted upon and shared with a wider audience. It doesn’t matter which industry you are in, or which country you live, it’s still us against the bad guys.
The problem that we are still seeing in many industries is that far too many are still failing to take a proactive approach to cyber security. This is simply not good enough at a time when major breaches are hitting our headlines on a daily basis. Businesses need to be constantly prepared for an attack and any of those in this program who aren’t doing this should expect to be exposed. The only way to ensure they have the best possible chance of keeping today’s sophisticated threats out is through 24/7 monitoring of all network activity, which needs to begin now, not as a mere afterthought. Any industry that underestimates the importance of continuous monitoring will ultimately regret that decision—and by then, it may be too late.