CERT UK finally launches to counter cyber threats

The UK government finally launched its first national computer emergency response team, CERT-UK, in London today.

Home Office to spearhead £4 million awareness campaign
Home Office to spearhead £4 million awareness campaign

Initially announced as part of the government's £650 million cyber security strategy in December 2012, CERT-UK has been hindered by numerous delays (it was initially set to launch in late 2013).

But that wait came to an end in Chatham House, London on Monday however as the group – which is headed up by Chris Gibson, the former director of e-Crime at Citigroup and global chair of the International Forum of Incident Response and Security Teams (First) – was announced as expected.

The meeting was overseen by Gibson and Cabinet Office minister Francis Maude, and while the launch coincided with that of the group's website and Twitter account, it turns out that CERT-UK has been running for two months at an undisclosed location in central London.

CERT-UK will be tasked with liaising with UK businesses and other national CERTS – including those in financial services and education – on cyber security issues, particularly those relating to national infrastructure. The UK government's Cyber Security Information Sharing Partnership (CISP) has been integrated as part of the group, and will interact with businesses to improve their cyber awareness, while CERT-UK is already said to have collaborated with the National Cyber Crime Unit (NCCU) and Janet Computer Security Incident Response Team (JCSIRT).

Cyber awareness seems to be an important crux of what CERT-UK is trying to achieve, both in the public and private sectors, and this is something that Gibson was keen to promote at the briefing earlier today.

"Cyber situational awareness is at the heart of what we'll do,” he said, before later adding that the group's ambition for awareness is “greater than our remit for incident handling.” The group's website promotes links for cyber security awareness schemes like Cyber Streetwise and The Internet Watch foundation, as well as industry bodies like CPNI, ICO and CREST.

The group certainly demonstrated how big cyber security is at the event, claiming that there are 28 DDoS attacks every hour in the country, while also citing one example of a London-based company that lost $800 million due to a cyber attack.

The launch has been to a generally positive reception, with many observers saying that it could be crucial to guarding the country's critical infrastructure. 

"This is a smart move from the government, and comes at an important time as the threat of an attack on national infrastructure grows,” said Rob Cotton, CEO at NCC Group.

"The key to effective cyber incident management is good communication, co-ordination and technical ability. As the speed and scale of cyber attacks grow it is essential for countries to provide a central co-ordination point and a greater focus on collaboration of threat intelligence sources. Ideally, this should happen at geo-local and sector levels.” 

Phil Cracknell, head of security and privacy services at Company 85, said that he too hoped CERT-UK would address critical infrastructure defences. “I would be interested to see what proactive initiatives to get elements of the critical national infrastructure up to a reasonable standard are being planned.”

Martin McKeay, senior security advocate at Akamai Technologies, was at the event and is encouraged by the government participation.

“It was unsaid but what was significant to me was that this (CERT-UK) seems to be getting serious backing from the UK government,” he told SCMagazineUK.com. “It sounds like a large number of people are starting to see that this is important and needs to be done.”

Like other commentators, McKeay noted the importance of protecting critical infrastructure, but said that the challenge is going to be to create awareness and show value.

“The first step is talking about it in person, building a baseline knowledge that you exist. After that, it's word of mouth.

“Secondly, it needs to show that it can provide additional value and help spread knowledge across businesses. It's an uphill battle…the first step in a long road.”

Sign up to our newsletters