NCSC CEO Richard Horne delivers keynote speech to the annual government conference on cyber security.
Introduction
It’s August 2008, early storm season in Florida.
Where I am, driving on a narrow stretch of Alligator alleyway. Suddenly the heavens open with a deafening downpour. I can’t see beyond the tip of the bonnet, just able to make out the start of the white line in front of the car.
With no hard shoulder to pull onto, do I slow to a stop and risk being hit by a vehicle coming up behind? Or continue at a steady pace, ready to deal with whatever lies ahead? I instinctively focus on the fundamentals of driving – both hands on the steering wheel, foot ready to brake.
In preparing this speech, I asked my browser for tips on driving in zero visibility. It outlined fundamentals of driving you should focus on… And added that you should check your insurance.
Well – it was a bit late for that!
But in that car, I was not bearing the responsibility alone. In an instant everyone was driving – we all knew we were part of the effort to guide us safely through. Conversation stopped. All eyes intently scoured for signs of risk.
Why do I recall this story?
Because as we look to the next decade – it might sum up how we feel like we’re in a perfect storm.
With the two forces of rapid technological change and rising geopolitical tensions, creating what feels like tumultuous uncertainty, coupled with opportunity for us in cyber security on the road ahead.
Let me turn to the first of those forces – the technology revolution we are living through.
Technology revolution
Think back to the first CYBERUK ten years ago – A quick show of hands, how many of you were there? (As i thought, not many!)
Well, CyberUK and the people coming have evolved, but our world has radically changed.
Back then all cars had drivers. Today, driverless taxis roam the streets of San Francisco and come to the UK this year.
And artificial intelligence, Quantum computing and other technologies are set to disrupt our world even faster.
AI
We can’t know precisely what an AI-powered world will look like in 10 years’ time.
We do know there is an opportunity for it to be a net positive for cyber defence. To achieve that outcome we must embrace it, secure it and shape it.
We know our adversaries will increasingly apply AI tooling. As we have seen in the media in recent days, frontier AI is rapidly enabling discovery and exploitation of existing vulnerabilities at scale. Illustrating how quickly it will expose where fundamentals of cyber security are still to be addressed, such as code shipped by tech producers with significant vulnerabilities, organisations that are not patching with the completeness or urgency they should or that are failing to grasp the nettle of replacing old legacy systems.
And while we may not yet be seeing significant new attacks as a result of AI, we know that our success as defenders will rely on us embracing AI for defence, at least as quickly as adversaries embrace it to attack.
Then, we must ensure that the AI we rely on is secure. Using for example the newly-published international standard for AI security to enforce a much-needed global benchmark.
And, we need to shape the development and adoption of AI. For example, I’ve previously spoken about how we need to shape the new normal of AI-generated code to ensure it achieves the huge potential of supercharging the change we need in code quality.
Quantum
We don’t know when a quantum computer will be able to break the widely used cryptography that we rely on in everything we do. But we do know it is in our gift, to be ready for that point.
We’ve published guidance that sets out what organisations need to do over coming years to ensure successful migration to post-quantum cryptography and major technology companies are taking the first steps to underpin this.
So now let me turn to the second force creating this perfect storm for cyber security.
Global context: political shift
I was on a flight back from Australia in February. I bumped into the first officer and got talking about routing flights in today’s world.
He showed me the tablet they use for plotting routes – with all the areas of the world that the airline considered no-fly zones or where they expect some kind of GPS interference. It brought home starkly to me the rising tensions in our world.
We are living through the most seismic geopolitical shift in modern history.
As Blaise Metreweli, the chief of MI6, said in December our world is more dangerous and contested now than it has been for decades. We are operating in a space between peace and war.
And let’s be clear, cyberspace is part of that contest.
Threat
We can’t know for certain what sophisticated attackers will target in the future, or the techniques they will use against us.
I said in October that the NCSC is handling an average of four nationally significant incidents a week. Well, today those numbers remain fairly steady. But we see a change in where those attacks come from.
Criminal activity such as ransomware remains the most prevalent threat to the vast majority of organisations, but the majority of the nationally significant incidents that my teams are handling now originate directly or indirectly from nation states.
We know that China’s intelligence and military agencies now display an eye-watering level of sophistication in their cyber operations.
This, combined with their whole-of-state approach means we face more than just a capable cyber threat but a peer competitor in cyberspace.
We know that Iran is almost certainly using cyber activity to support the repression of British individuals on our streets who are seen as a threat to the regime.
And we know that Russia is taking the cyber lessons it has learnt in a theatre of war and is moving them beyond the battlefield. The tactics and techniques honed in conflict are now being directed at states it considers hostile.
Working with our partners, including the National Protective Security Authority, we are seeing sustained Russian hybrid activity targeting assets across the UK and Europe. So we know we have a unique window to learn how cyber operations have been used in conflict situations and shore up our resilience at home.
Conflict
We can’t know over the next ten years whether the UK will be in a state of conflict, but we do know we must prepare for that eventuality. The Strategic Defence Review told us.
And we do know from conflicts around the world this last year that cyber operations are now integral to conflict, as much a reality of modern warfare as drones and missiles.
And the scope of targeting is getting wider, the attacks on the Polish energy sector in December, are a stark reminder of that reality. That cyber security is the home front.
And in cyberspace, offence is a critical part of defence.
Every day, our partners in the National Cyber Force take decisive action delivering operations that protect our nation, countering those who would do us harm, as General Rob McGowan and my boss Anne Keast-Butler will talk about later.
And then we know that, were we to be in, or near, a conflict situation, the UK would likely face hacktivist attacks at scale. With similar effects and sophistication to the ransomware attacks we see today but …no option to pay a ransom to help recover.
Defending against that means every organisation embedding cyber security into their corporate mission, ensuring they understand the full extent of risk they face, build defence in depth so that initial footholds by an attacker don’t result in catastrophic impact.
And they can respond, to remain operational and rebuild following a successful attack. We should already be at the point where paying ransoms in the face of destructive attacks, simply – doesn’t – happen.
With every organisation ready for the day, when paying their way out just isn’t an option.
So what?
So, what does that mean for us here? Where will we be in 10 years’ time?
Technology will continue its disruptive journey.
Geopolitics will continue to shape the cyber threats we face.
Cyber security sits at the intersection of these forces, powering our growth, securing our society.
As the technology landscape develops the definition of cyber security expands with it.
Securing the operational technology that controls energy systems and production lines, robotics, space-based communications, autonomous systems and agents. Even…technology physically integrated with human bodies.
Continuing critical operations and rebuilding following a successful cyber attack: These are all way beyond the definition of cyber security as practised a decade ago and will require us to continually re-imagine our work.
We have an amazing community that supports and enables each other, and I want to thank you for the part you play in that.
We cannot manage the risk in isolation. Our job is now to catalyse the change we need in our organisations.
A cultural shift so that everyone, whether they sit on the Board or the IT help desk, knows that cyber security is part of their mission. That it is not just the responsibility of the few, but a shared mission – core to the purpose of every organisation.
Driving that cultural shift demands that we think differently with greater diversity of skills, minds and backgrounds.
For us as a community to be bold, to make the case for cyber security and resilience as a strategic investment, not a cost to be minimised.
And to build the understanding that organisations that do not focus on their technology base – new and old – as core to their prosperity and security, and that of their customers, suppliers and wider society who depend on them:
They are no longer just naïve, but failing to grasp the reality of today’s world.
Close
So, we can be certain that we do not know what the world will look like ten years into the future, we do know we can shape the coming years to our advantage.
Just as I knew what I needed to do driving that car through the Florida storm.
We know that focussing on fundamentals, boldly shaping our development, continually re-imagining cyber security at this time when technology disruption meets geopolitical uncertainty and engaging our whole organisations in driving the mission will be key to ensure our future is prosperous and secure. For our organisations and our nation.
Strengthened by the storm.
Thank you.
