The UK's cyberspace initiative

The creation of the cyber security operations unit by the British government is a necessary and positive step in combating all forms of cyber threats. We work and live in a world in which our most personal information has gone digital, and this initiative points to the importance of a centralized approach to protection, spanning citizens, government and industry.

There are also economic considerations that this initiative addresses. In the UK, for example, more than £50 billion is spent online every year and 90% of high street purchases are made using electronic transactions.

There will be much debate as to the validity of the threats and the forms that they will take; however, as members of the security industry, we know that these threats always have the ability to be more devastating and widespread than even popular imagination can dictate.

By placing the protection of "digital Britain" in the hands of the government, we are showing a united front against cyber-criminals, cyber-terrorists and the run of the mill hackers who pose a threat to our information systems and personal data. As we commend the government for taking this bold and necessary step, we would like to remind them of a lesson that industry has learned over the past few years: threats come from internal and external sources. So, a "defend the perimeter" approach will leave valuable assets unprotected.

The government should look at the threat matrix holistically, starting from the databases that hold information, to the individuals that access it, through the networks that carry the data, to the perimeter. This "ground-up" approach will ensure that we are well protected at every turn.

Steve Moyle

Unhackable? Unsinkable! -- bold government claims

I am saddened to hear that the current crisis in the UK parliament over members' expenses has resulted in the demise of the Home Secretary. I enjoyed being interviewed last year on national radio to comment on her claims that the UK government's proposed ID card system would be "unhackable". A bold claim indeed, and I said as much at the time.

Anyone involved in IT security will recognize that there are no absolutes as strong as "unhackable" and that there are threats from more than outsiders. (Her claim was that as the ID card database would not be connected to the outside world it would be safe.)

When they pushed her off the docks in Belfast harbour they said that the Titanic was unsinkable. It is a shame the Home Secretary has found herself in need of a lifeboat.

Steve Moyle

Who can we trust?

I saw this today and sighed. Another embarrassing example of data loss from a government department; in the UK this time. Encryption of the data was provided at source, yet it is strange that encryption was not enforced throughout the complete data processing chain.

Management of sensitive data continues to be imperative. This sensitive data loss highlights the inappropriate attitude with regard to security and clearly shows that data security remains out of control. There is a distinct requirement for all government employees to protect the storage of data, including limiting the need for physical transportation, through the implementation of strict guidelines. Sensitive data should be held only where it can be kept most secure, and not downloaded to numerous portable devices or hard copy unless there is a well-justified need to do so – a need that is set out in, and enforced by, corporate guidelines.

If the government sector doesn't sort its house out, I fear we are going to see more high-profile breaches. Leaving us all with the uncomfortable question: if we can't trust the government with our information, who can we?

Steve Moyle