News + Resources

We welcome the Government’s latest iteration of UK’s National Cyber Security Strategy (National_Cyber_Strategy_-_FINAL_VERSION.pdf (publishing.service.gov.uk)) published on 15^th December 2021. 

It is worth a read, not least because it not only illustrates the scale of the challenge, but also because it articulates clearly where the state’s boundaries lie:  where it can do things and where it has to rely on industry and/or individuals to do the right things.

The agenda is long and complex – and the strategy seeks a balanced approach, ranging from skills development and awareness raising at all levels on the one hand to investments to support national strategic capability at both the government and industrial level, policy improvement and legal enforcement measures to mitigate criminal activity on the other. 

The strategy also reinforces the point that cyber security is a global issue requiring diplomatic and military capability development to ensure strategic national interests are promoted and protected. 

Most importantly, the strategy is also clear that individuals and private sector organisations need to get their act together and take more responsibility for the protection of their data (and their customers’).  While Government can help, guide and advise, it cannot take responsibility for corporate failures to address known weaknesses.  

Two key issues of relevance to our sector stand out. 

Ransomware

The Government is clearly antipathetic to the payment of ransom.  On Page 27 it states:

“Law enforcement do not encourage, endorse, nor condone the payment of ransom demands. If you do pay the ransom:

• there is no guarantee that you will get access to your data or computer

• your computer will still be infected

• you will be paying criminal groups

• you’re more likely to be targeted in the future”

Astaara agrees.  Ransomware will clearly remain a challenge to business and the insurance industry; while it remains an area of debate, customers still require cover.

Our objective in the insurance sector must be to work with our clients to help them not fall victim to ransomware in the first place, and when they do, to support them in their recovery in a way which minimises the need to pay a ransom.   This will include providing them with support and advice on preventive activities in the context of existing multi-lateral agreements (e.g. NISR, IMO2021 etc), access to training, education and awareness raising, as well as providing post-breach services, including managing claims and assisting them to recover service quickly.

 It should also be borne in mind that some jurisdictions, particularly the US, are particularly keen to remind industry that payment of ransoms could put companies in breach of OFAC rules and sanctions legislation. This could have very significant ramifications for companies if their ransom payments are deemed to have violated US law.

Engagement of the insurance industry

The strategy helpfully articulates an important role for the insurance industry as one of the influencers on corporate behaviour that will be required to achieve Objective 2 of the strategy:

“Objective 2: Prevent and resist cyber-attacks more effectively by improving management of cyber risk within UK organisations, and providing greater protection to citizens”

Specifically in paragraph 114, the strategy states:

“In support of these aims, we will increasingly work with market influencers (procurers, financial institutions, investors, auditors and insurers) to incentivise good cyber security practices across the economy. We will propose improvements to corporate reporting of resilience to risks, including cyber risks. This will give investors and shareholders better insight into how companies are managing and mitigating material risks to their business. And we will continue to promote take-up of accreditations and standards such as the Cyber Essentials certification scheme and promote board level engagement in cyber risk management.”

Astaara welcomes this development – we have long believed that increased transparency, better reporting and more complete inclusion of cyber risks in corporate risk management processes will help ensure better cyber hygiene, since investors and shareholders will require assurance from company directors that the cyber agenda is being actively managed, and that information assets are receiving comprehensive corporate attention.  We look forward to engaging further on this issue in due course.

In brief, this strategy is a helpful indication of current and future priorities.  Investment is increasing over the next 3 years, and the threat shows little sign of abating.  While Government intervention can help at the national level, and support the functioning of the Critical National Infrastructure, this has to be underpinned by appropriate risk management activity, including where relevant, risk transfer to insurers by individuals and organisations. Should companies require further ‘incentives’ to do so, whether by legislation or regulation, will depend on their behaviour: it is good that Government recognises this – and it is important that we all recognise that incentives can be both carrot and stick.

Article by Bill Egerton, Astaara’s chief cyber officer