NCSC: Critical infrastructure security not keeping up with threats
The UK's National Cyber Security Centre (NCSC) has once again voiced concerns over the rising threat to the UK's critical national infrastructure (CNI) in a report published on Monday.
Cybersecurity and resilience of critical infrastructure are failing to "keep pace" with the rising threat levels, it said.
The report says: "We will continue to work with partners across government, industry, and regulators to accelerate this work and keep pace with the changing threat, including tracking their resilience in line with targets set out by the Deputy Prime Minister."
In a foreword, deputy PM Oliver Dowden says: "We live in a dangerous, volatile world. The events of the last year have demonstrated the extent to which geopolitical crises and technological change impact us all, threatening not just our traditional security but our economic security."
Russia, China, Iran and North Korea were identified by NCSC as key threats to the UK's security and interests. In addition, the ongoing war in Ukraine has sparked aggressive cyberthreats to UK CNI.
The latest warning to CNI operators of what the NCSC said is an enduring and significant threat comes after a year of serious assaults on critical services in the UK.
Royal Mail International was targeted by the LockBit group in January, shortly after a raid on software supplier Advanced forced parts of the NHS to revert to pen and paper for record keeping.
Apart from the UK, major attacks on CNI have also been carried out in other territories, including Ireland's Health Executive Service and The US's Colonial Pipeline, not to mention the myriad destructive attacks in Ukraine.
The UK and its intelligence partners have brought attention to other threats to CNI too, including alerts covering Russia's cyber-espionage-enabling Snake malware and China's information gathering from US organisations.
NCSC also dedicates a section to the treat from AI: "Our adversaries - hostile states and cybercriminals - will seek to exploit AI technology to enhance existing tradecraft.
"In the short term, AI technology is more likely to amplify existing cyberthreats than create wholly new ones, but it will almost certainly sharply increase the speed and scale of some attacks," it said,
Commenting on the report, Eduardo Azanza, CEO at Veridas, spoke about the threats of AI deep fakes as they become harder to identify.
"The need to address the situation is more urgent than ever. Deepfakes can affect every aspect of our society - from the integrity of elections to trust in politicians - leaving voters confused and questioning what is true," he said.
Due to the nature of the threat to CNI, the NCSC and UK government departments are working to ensure an adequate level of resilience is mandated across all CNI sectors.
By 2025, CNI organisations will have resilience targets to meet, with the idea that every operator can protect against the most prevalent threats.
Similar measures are being implemented elsewhere too.
The EU has rolled out NIS2, CER and DORA legislation - all three of which are expected to significantly raise cyber-resilience of CNI - while Japan and Mexico have also both introduced new policies for regulating the cybersecurity of CNI operators.