GCHQ: We Failed On Cybersecurity Despite £1bn Spend

UK spy agency GCHQ has admitted it is losing the cybersecurity battle on a national level, despite throwing money at the problem.

Alex Dewedney, director of cybersecurity at CESG – the information security arm of GCHQ – warned that it will take a lot more than cash to bring cybersecurity threats under control.

It hasn’t worked

He said: “I think the best way to sum up the challenge we face is that while we’ve done a lot over the past five years and spent quite a lot of money as a Government, particularly in those years of austerity we’ve been through, the bottom line is it hasn’t worked.”

The UK Government splashed £950m on cybersecurity over the past five years and George Osborne has promised a further spend of £1.9bn in the coming five years. Combined with the money being spent on protecting IT systems, a total of £3.2bn is expected to be spent over the next half decade.

“We can point to lots of achievements around understanding the threats much better, about taking steps to mitigate those threats, addressing the national skills base and so on but, nationally, we are not winning the fight on cybersecurity,” Dewedney said.

“I think we would be losing a lot more if we hadn’t done all the things we’ve done over the past five years. So, don’t get me wrong. All of that has been worthwhile but there’s been something of a mantra in the UK that the solution to all of our problems is information sharing and public/private partnerships – that if we keep doing that then somehow it will magically cause improvement to happen. That approach by itself is not sufficient.”

Dewedney has been in the job for just seven months, with the previous incumbent now heading up David Cameron’s campaign to keep the UK in the European Union. The approach to cybersecurity from the Government now needs to be more interventionist than it has been in previous years and more active in how it takes on cybersecurity challenges, while still working with industry, according to Dewedney. “We can’t just pass information on threats to businesses and tell them to go and deal with it themselves.”

Dewedney does, however, believe that GCHQ is in a fortunate position when it comes to planning to tackle the cybersecurity challenge.

He said: “We have something of a luxury in the UK Government in that we run five-year budget and planning cycles rather than the annual process that tends to happen in many other countries, such as the USA. We’re just completing the final year of one of those and we’re about to embark on a new five year plan.”

Last year 90 percent of large companies in the UK suffered a cybersecurity breach. “That tells you we’ve got some way to go,” Dewedney said. “So we’ll need to do a set of things quite differently in the next five year cycle.”

The UK Government has not even been getting the basics right, though, says Dewedney, and has all kinds of problems stemming from legacy IT.

For example, the Government paid Microsoft £5.5m to extend Windows XP support in 2014.

All Government departments had been given seven years warning that Microsoft would be ending its standard support for the operating system but migration away from XP had not been completed on time.

Then, in April 2015, the Government chose to not extend support from Microsoft for Windows XP, despite some departments still running the outdated software.

Dewedney said: “We’ve not been spending money on fixing legacy IT issues, and that is just killing us. I’ve tried to make this argument to my bosses that surely you have to start there before you try to do anything more sophisticated.

“But the response has always been ‘I’m not spending cybersecurity program money to subsidise other departments’ IT budgets’. Come on, it’s the aim that you have in mind that justifies it, but I haven’t won that battle yet.”

Another big problem GCHQ faces is a dire lack of resources, Dewedney explained. “It’s not so much a money issue as it is a human resources issue. There are layers to this problem.

“There’s the issue of availability of relevant skills nationally. It’s about the extent to which an organisation like mine, which is trying provide cybersecurity services and carry out cybcersecurtiy operations, can actually recruit and retain staff in public service.

“What’s the right model for how long you expect to keep people in public service? How often should you be looking to rotate people in an out, and so forth? But it’s also about technical leadership in Government because, on the whole, our Government is still led by people like me who have liberal arts degrees.

“Usually we have a CTO who travels around with us in case any difficult questions are asked. That doesn’t really reflect what the top of technology companies look like and we’re desperately trying to fix that but it’s a work in progress for all sorts of reasons. So when we talk about resources, we always run out of people before we run out of resources.

“It’s a battle for the skills pipeline. I think there is something Government can do around working with academia, so that demand is actually met by the skills pipeline.”

One of the initiatives that Dewedney feels has worked is Cyber Essentials – a program helping companies achieve market differentiation by demonstrating they meet a certain set of cybersecurity standards. “If companies demonstrate they meet a basic set of cyber hygiene standards they get a stamp they can use in all of their publicity,” explained Dewedney.

“If we can couple that with work to increase public awareness, it will generate more public demand for strong cybersecurity within the companies people deal with. If customer bases increasingly actually care about the cybersecurity of these companies then we start to get the virtuous cycle going. To a certain extent, that’s already working.”

But Dewedney believes that Internet of Things is only going to make GCHQ’s job more challenging in the coming years. “We used to call cybersecurity ‘information assurance’. That term seems less appropriate than ever because there’s been a trend of increasing risk to operating systems, not just to information risk. It’s the Internet Of Things risk, which I think is increasingly going to take more of our attention. It’s no longer just financial information that hackers are interested in.”

How much do you know about the world’s greatest tech leaders? Take our quiz to find out!

Duncan Macrae

Duncan MacRae is former editor and now a contributor to TechWeekEurope. He previously edited Computer Business Review's print/digital magazines and CBR Online, as well as Arabian Computer News in the UAE.

View Comments

  • 90% of companies are not getting the message about security. They don't care if they lose clients private data because they are not made to care. Its easy to go after the hackers but they behave like a shop that's left its stock on the street rather than behind locked doors. I dont see why my taxes need to support lazy incompetence companies that are not exercising even a minimum level of diligence regarding securing data. There needs to be a mandatory standard. Companies that do not behave responsibly should not be able to hold personal data.

Recent Posts

AWS re:Invent Conference Welcomes Back Crowds

Over 27,000 attendees and members of the press (including Silicon) attend Amazon Web Services worldwide…

5 hours ago

Head Of Car Giant Stellantis Issues Electric Vehicle Cost Warning

The car manufacturing industry cannot sustain the costs from government demands to shift to electric…

6 hours ago

SpaceX’s Elon Musk Warns Of Bankruptcy Risk Over Engine Issue

SpaceX CEO Elon Musk warns of “disaster” concerning production of Starship Raptor engine that puts…

8 hours ago

Twitter To Remove Photos Tweeted Without Permission

Privacy overstep? Personal photos and videos of private individuals tweeted without the consent of the…

9 hours ago

Facebook Cryptocurrency Executive David Marcus To Leave

Executive in charge of Meta's cryptocurrency efforts, confirms he is leaving after seven years at…

11 hours ago

NY AG Seeks Overseer For Amazon Worker Safety

New York's attorney general asks US judge to appoint someone who will oversee worker safety…

12 hours ago