Confidence in the government’s ability to protect Britain from high-level cyber-attacks is being undermined by a skills shortage, parliament’s spending watchdog has said.
Ministers have taken too long to consolidate the “alphabet soup” of agencies tasked with safeguarding the UK from cyber-attacks and there appears to be no coordination across the public sector, the public accounts committee (PAC) said.
The warning comes as concerns grow over Russian cyber-attacks. Moscow is denying alleged interference in the US presidential election in Donald Trump’s favour.
PAC said that despite cyber-attacks being ranked as a top four risk to UK national security since 2010, the role of the Cabinet Office, which is responsible for coordinating information protection across government, remains unclear.
Meg Hillier, the committee chair, said: “Government has a vital role to play in cyber security across society but it needs to raise its game. Its approach to handling personal data breaches has been chaotic and does not inspire confidence in its ability to take swift, coordinated and effective action in the face of higher threat attacks.
“The threat of cybercrime is ever-growing, yet evidence shows Britain ranks below Brazil, South Africa and China in keeping phones and laptops secure. In this context it should concern us all that the government is struggling to ensure its security profession has the skills it needs.”
The report said the Cabinet Office’s ability to make informed decisions about security is “undermined by inconsistent and chaotic processes for recording personal data breaches”.
Reporting across Whitehall departments varies widely, with some highlighting thousands of data breaches while others recorded none at all.
The Cabinet Office does not collect or analyse departments’ performance in protecting information on a routine or timely basis and was not aware of the variability in reporting until the National Audit Office highlighted the issue last year, the MPs said.
“Without a consistent approach across Whitehall to identifying, recording and reporting security incidents, the Cabinet Office is unable to make informed decisions about where to direct and prioritise its attention,” the committee said.
The government is also struggling to ensure its security profession is suitably skilled, with the Cabinet Office unwilling to bring in a minimum standard for departments. “It remains unclear as to what skills gaps exist and how to fill these in the face of UK-wide skills shortages in this field,” the report said.
MPs said new initiatives to share information securely and classify information consistently across government are failing to deliver as planned.
The government ignored its own advice by failing to carry out a business case for government security classifications system, which was meant to deliver £110- to £150m-a-year in benefits, MPs said.
A National Cyber Security Centre spokesman said: “The government has been clear that the newly formed NCSC is the UK’s definitive authority on cyber security. In the four months since becoming operational, the NCSC has transformed how the UK deals with cyber security by offering incident management capabilities, fostering technical innovation to help prevent attacks and providing real-time cyber threat information to 3,000 organisations from over 20 different industries.
“The UK faces a growing threat of cyber-attacks and we share the committee’s determination to make the UK as safe a place as possible to live and do business online.”
