Cyber Symposium 2015
Speech by Michael Fallon, Secretary of State for Defence.
I鈥檇 like to thank my French colleagues for arranging this symposium.
It鈥檚 an impressive gathering, as M Le Drian said, with strong international representation.
And what brings us all together is a growing interest in cyber and growing desire to keep several steps ahead of the threats we face.
I鈥檓 told this is the first of hopefully a series of events bringing together our militaries on cyber.
And, given the calibre of the individuals in this room, I鈥檝e no doubt you will make a valuable contribution to the cyber debate.
French Cyber relationship
It鈥檚 also always a pleasure to share a platform with my good friend M Le Drian.
In fact, this is our tenth meeting in just over a year.
Which reflects the closeness of a relationship that has gone from strength to strength since the signing of the historic Lancaster House Treaty 5 years ago.
As M Le Drian has already indicated鈥ur cyber relationship with France is amongst our most valued.
鈥ith our 2* Military Cyber Co-ordination Group that reflects that close working relationship on cyber,
鈥�.that helps us share threat information to help us both improve defence of our military IT networks.
鈥hat helps us share information and lessons on how to train cyber specialists.
鈥nd which will be galvanised by the creation of our Combined Joint Expeditionary Force 鈥hat has been we tested on exercises this year.
Threats
And underlying this joint activity is a real sense of urgency.
An awareness of the scale, the diversity, complexity of the challenges we face. 100 years ago, as the name of this ampitheatre reminds us, we stood together on the frontline of a Great War.
鈥oday we stand on the frontline of a virtual war.
And though the warheads launched are invisible鈥yber is far from a theoretical threat. Our adversaries, whether
鈥evanchist Russia or evil ISIL
鈥re becoming ever more adept and determined to use cyber to force their advantage.
We鈥檝e seen cyber attacks
鈥n TV5Monde and on Sony 鈥n government systems in Estonia 鈥n a Polish airline.
And cyber is not just used to gain military advantage, but to also, of course, radicalise individuals and spread misinformation as we are seeing with Da鈥檈sh.
Such dangers are only likely to grow.
One in seven people on earth are using Facebook.
鈥hich can get worldwide headlines simply by adding a dislike button to its pages.
Another reminder of how fundamentally connected we are.
Of how our societies
鈥n the words of M Le Drian, when introducing the 鈥楶acte Defense Cyber鈥�, last year
鈥� qui n鈥檕nt jamais 茅t茅 aussi d茅pendantes du num茅rique
(have never been so digitally dependent).
That makes us vulnerable.
Nor is it only our defence networks鈥�.already under daily attack鈥hat are at risk
鈥ut our civilian infrastructure.
Our transport networks.
Our energy networks.
Our banking systems.
Our economy as a whole.
The cost of cyber security breaches to the UK economy roughly tripled over just the last year.
Now in the order of 拢20 to 30 billion per year.
鈥ompared to 拢10.7 billion for drugs supply and 拢8.9 billion for organised fraud.
And what makes web attacks harder to stop鈥esides the anonymity of the attacker鈥s the proliferation of low-cost technology鈥hich can allow a minor hacktivist using a home computer to pose a threat.
Twenty years ago in an article appropriately entitled 鈥渁lerte dans le cyberspace鈥� Paul Virilio wrote that
鈥�.la bombe informatique n茅cessitera, au XXIe si猫cle, une nouvelle dissuasion, une dissuasion soci茅taire, pour parer aux d茅g芒ts de l鈥檈xplosion de l鈥檌nformation g茅n茅ralis茅e
((in the 21st century the information bomb will necessitate a new social deterrence to ward off the destructive effects of the explosion of generalised information)).
We鈥檝e heard how France is developing its response to this 鈥渋nformation bomb鈥�. Today I鈥檇 like to set out briefly the UK鈥檚 response. It revolves around 3 ideas.
Putting Cyber front and centre
First, it鈥檚 about putting cyber front and centre of our thinking.
Cyber is now hardwired into UK defence鈥檚 DNA.
If you attended the DSEI exhibition in London recently鈥ou鈥檒l have seen the cyber zone鈥�.the first time the exhibition has given cyber a dedicated slot of its own.
That reflects a wider trend. These days we鈥檙e fitting cyber capability as standard into our tanks, ships and planes.
Fifth generation tech such as the F35 Lightning II not only give pilots enhanced network connectivity 鈥llowing them to send real time information 鈥ntainted and unseen by others鈥rom the battlefield to the back office鈥p to ministers鈥nd back again.
Not only are we enhancing our kit鈥ut we鈥檙e upgrading our training鈥� testing out our cyber capabilities in a virtual environment.
And we鈥檙e supporting our future leaders in learning more about cyber.
Our 150th Cyber Masters student has just started their course this month at Cranfield University.
At the same time, we鈥檙e making sure defence鈥檚 supply of top talent is continually replenished by setting up a cyber reserve to attract the brightest brains from the private sector.
But cyber demands we adapt our tactics as well as our weapons and training.
So we鈥檝e got the Joint Forces Cyber Group 鈥ringing our service arms together to develop the novel techniques we need to confront high-end threats.
And all this activity critically, is underpinned by investment. We believe it鈥檚 better to invest in digital now than pay the penalty later on.
So, as the headline writers are fond of writing 鈥渨e鈥檙e putting our money where our mouse is鈥濃�hannelling more than 拢860 million into our National Cyber Security Programme.
However, the story doesn鈥檛 end here. Like the technology itself we must continually adapt.
What capabilities will we need to counter cyber adversaries in future? How can those tools be used to complement our response in other areas of defence?
That鈥檚 why cyber is pivotal to our Strategic Defence and Security Review now currently underway.
Creating resilience culture
Yet the response on cyber cannot simply involve government.
We have to create a culture of cyber resilience across society.
The UK government is sending out the right signals by committing to a basic level of cyber security.
鈥mproving the resilience of core government ICT networks to cyber attacks鈥hrough authentication and ID assurance.
鈥nd building a new Public Sector Network (PSN)鈥� and creating a new security model for the sharing of services.
鈥ut we鈥檙e also actively encouraging good cyber etiquette throughout our military and civilian services.
All our staff must complete mandatory information handling refresher training, annually, and take responsibility for their data.
鈥hile we have networks of information risk and asset owners鈥� embedded in our organisation to properly police data and deal with problems.
Since cyber blurs the lines between the public and private sector鈥� we鈥檙e also urging industry to take cyber safety seriously.
We鈥檙e running exercises with government and industry to test their capacity to withstand cyber attack.
We鈥檝e set up the UK鈥檚 national Computer Emergency Response Team CERT-UK 鈥ringing together industry, government and academia to enhance our cyber resilience.
And we鈥檝e launched a national 鈥済old standard鈥� for 鈥楥yber security, cyber essentials鈥�.
鈥o that companies handling sensitive and personal data can demonstrate they are secure and trustworthy.
That recommends business put in place critical controls鈥uch as firewalls, access controls and maleware protection鈥o protect business from common cyber threats.
To date, more than 1,000 British companies have been awarded a Cyber certificate.
Lastly, we鈥檙e encouraging organisations to share information on threats and vulnerabilities as they occur through the Cyber Information Sharing Partnership (CISP) 鈥omplemented in 鈥楧efence by a Cyber Protection Partnership鈥�.
That enables a 鈥渇usion cell鈥� made up of analysts from business and the law enforcement and intelligence communities 鈥� to draw together a single intelligence picture of cyber threats facing our country.
More than 1,000 members and over 400 businesses and organisations have already signed up.
So we are determined to lead the way on cyber security standards.
And not just because we鈥檙e interested in our self-preservation.
鈥ut because鈥y showing we鈥檙e one of most secure places in the world to do business in cyberspace鈥e can attract the investment that helps our economy grow.
The internet accounts for 8 per cent of the UK鈥檚 GDP advantage.
Over the last 10 years the ICT sector has grown three times as fast as the whole economy.
And that could be worth hundreds of billions of pounds to us in the years ahead.
Global responsibility
My third and very final point鈥o echo M Le Drian鈥s that tackling these online obstacles also requires an international effort.
Even strong multinational organisations like NATO
鈥re only as strong as their weakest link.
So the onus is on all of us鈥�
鈥specially as key players in international institutions鈥o get our house in order.
That requires investment to avoid systems obsolesce in an age of exponential technological advance.
It requires better education among all government and business internationally about the importance of being safe in cyber space.
And it requires us to work together across frontiers to establish the new rules of the game.
Cyber operates in areas of ambiguity where what is and what is not considered an act of aggression鈥� what should or should not be suitable response鈥re by no means clear cut.
So we need to adapt our doctrines accordingly鈥nderstand how best to respond in a range of different scenarios.
Conclusion
So there鈥檚 we鈥檝e a great deal to discuss at this conference today.
And I鈥檓 not expecting all the answers.
After all, much work is already going behind the scenes 鈥nd it鈥檚 better to keep our adversaries guessing.
But鈥aving this conference today is sending out a sharp signal to our adversaries.
That
鈥hatever their virtual schemes
鈥e鈥檙e on the case
鈥nd we鈥檙e determined to bring all our vast capabilities
鈥ll our enormous expertise to bear
鈥o thwart their plans in the real world.
Finally, I am delighted to announce that the UK will run the next of these Symposiums in London in late 2016. As I hope you agree, this is a valuable forum for exchanging information and ideas, and I am very pleased that we can build on the momentum that our French colleagues have started here today.