Experts praise UK's cyber defences but say more international co-operation needed to fight attacks

Security & Defence Agenda report gives UK four stars out of five for 'cyber preparedness'

A new report has ranked the UK among the top nations for its ability to protect itself from cyber attack, but warned that greater international co-operation is needed.

The report, by the Brussels-based Security & Defence Agenda (SDA), which was commissioned by security firm McAfee, surveyed 250 "leading authorities" and 80 cyber security experts in the public and private sectors.

Countries such as the UK, Germany and the US were ranked top, with four stars out of five for their cyber preparedness.

While praise was given to the UK for its new cyber security strategy and the activities of the Office of Cyber Security and Information Assurance (OSCIA), it was criticised for its perceived over-reliance on the private sector.

"The OSCIA has gone out of its way to consult widely, but there are problems that need to be addressed," said security expert Peter Sommer.

"How will the [UK cyber security strategy] be put into action? There are no plans for a UK cyber tsar. Then, a great deal depends on co-operation from the private sector, which controls about 80 per cent of the critical national infrastructure.

Demosthenes Ikonomou, head of secure services and project support activities for the European Network Information Security Agency, agreed that public/private partnerships (PPP) were not always the best way to encourage effective cyber governance.

"We are not dealing with a national problem, it is a pan-European problem," said Ikonomou.

"Many who come to these PPP meetings do not come with an idea of collaboration in mind – they come wanting to see what the governments are saying."

Jamie Shea, deputy assistant secretary general for emerging security challenges at NATO, stated in the report that there is a further problem of a lack of internationally recognised security standards.

"The problem is that in cyberspace we have not identified the minimum standards – too much of it is voluntary and self-certification rarely stands up to stress tests."