The UK’s National Security Strategy (published 18 Oct 2010) identifies that, for the next five years, the four highest priorty risks faced by the UK are those arising from
- International terrorism;
- cyber attack;
- international military crises; and
- major accidents or natural hazards.
The reality, of course, is that international terrorists have an identifiable cyber capability, and any international military crisis is also likely to have an important element of cyber threat. And, as the information on which we depend to respond to almost any major national accident is stored in electronic information systems, you might argue that cyber risk is the most important risk facing the UK today.
Cybersecurity standards
Cybersecurity standards are an important element in building a strong, resilient information and communications infrastructure. ISO27001 is the most significant international best practice standard available to any organisation that wants an intelligently organized and structured framework for tackling its own cyber risks. ISO27001, as a specification for an ISMS, is clear and precise; it also lists 133 key security controls that should be at the heart of any organisation’s approach to securing its information assets.
Many organisations, though, think it makes sense to implement ISO27001 without ever seeking external certification. The increased focus, at a national level, on responding appropriately to cyber risks undermines this approach – increasingly, organisations will want to know that their supply chain is resilient against cyber attack. Supplier audits can consume a lot of time, and an accredited ISO27001 certificate is clear evidence that an organisation has taken proper security steps and has obtained independent verification that these steps are in line with recognised international best practice.
