Lax cyber security measures could cost UK infrastructure firms £17m

UK companies running essential services and critical infrastructure may face eye-watering fines if their systems' cyber security is found lacking.

Failure to implement effective cyber security measures could see organisations fined up to 17 million, or 4% of their global turnover, under a consultation launched by the Department for Digital, Culture, Media and Sport (DCMS), which is the same penalty facing firms who fail to protect people's personal data under the government's new Data Protection Bill.

The proposals come after the havoc wrought by May's WannaCry ransomware attack on critical targets like the NHS, which saw a swathe of its hospitals effectively grind to a halt as the ransomware shut out access to core IT systems.

DCMS has been deciding how to best implement the Network and Information Systems (NIS) directive due to come into effect in May 2018, in order to make Britain's essential infrastructure resilient against future cyber attacks.

"We want the UK to be the safest place in the world to live and be online, with our essential services and infrastructure prepared for the increasing risk of cyber attack and more resilient against other threats such as power failures and environmental hazards," explained Matt Hancock, minister for digital.

"The NIS Directive is an important part of this work and I encourage all public and private organisations in those sectors to take part in this consultation so together we can achieve this aim."

However, the fines will be used as a last resort and will not be applied to service operators who have put in appropriate cyber security defences but have still suffered a hack attack.

Under the proposals out for consultation, critical infrastructure organisations will need to develop a cyber security strategy and adopt policies that both understand and manage the potential cyber attack risks they could face.

This will require them to do more than just protect their IT systems, taking responsibility for ensuring staff are aware of the attacks they might face and how to monitor for signs of a breach and be ready to report them as they develop.

Cyber security experts have welcomed the government's proposal, believing it will prompt organisations to move away from systems that lack robust cyber security in the face of relentless hackers.

"This government proposal once again highlights the need for better security across the nation's most essential services," said Dan Sloshberg, cyber resilience expert at Mimecast.

"Studies consistently show that email is the number one attack method used to spread malware that holds critical services, such as energy and transport, to ransom. Despite this, many of these organisations still rely on outdated email security controls that were never designed to stop advanced attacks. It is vital organisations who manage critical services invest in a cyber resilience strategy that involves strong methods of protection, combined with a reliable archive and recovery strategy for data and operational systems, to get back on their feet if something does get through."

The proposed fines and the NIS all forms part of the UK government's 1.9 billion National Cyber Security Strategy, aimed at bolstering the UK's cyber defences and its cyber security industry in the face of significant cyber attacks that can cause economic and reputational damage, like WannaCry and the NotPetya malware spread.

Picture: Bigstock