The UK Government National Cyber Strategy (NCS), released on 15 December, is the country's first ‘whole of cyber’ strategy. It lays out a positive vision and broad opportunity to strengthen the cyber ecosystem; build a resilient and prosperous digital UK; take the lead in the technologies vital to cyber power; advance UK global leadership and influence; and detect, disrupt and deter adversaries. And it makes the point that it will take much greater collaboration to meet growing cyber threats and seize new opportunities.
We welcome this bold vision. No single government department or security agency can affect the required societal change alone. If we can get the whole country pulling together to deliver against the NCS, we’ll be able to build a positive human future: keeping people safe; boosting national prosperity in a fairer way; and raising the bar on critical skills across the nation.
To maintain momentum, we need to capture the energy of the strategy launch and bring the spirit of three cross-cutting ideas from the NCS into all current and future cyber initiatives.
Positioning the UK as a digital pioneer through a cross-government mindset shift
The UK is a world leader in cyber technology and services. The sector is growing fast, with over 1,400 businesses supporting 46,700 skilled jobs and generating revenues of £8.9bn, including £4.2bn of export sales, according to the NCS. And the government is offering significant support for incubators and accelerators to drive future growth in the sector.
Now, the NCS aims to take this success even further by bringing themes from the Integrated Review of Security, Defence, Development and Foreign Policy (IR) to cyber.
The NCS pulls together several cross-cutting initiatives, such as the 5G Telecoms Supply Chain Diversification Strategy and the plans to establish the UK Telecoms Lab. This means responsibility for the leadership and delivery of the strategy will be spread across multiple government departments and devolved administrations, so clear prioritisation and light-touch alignment will be key.
Also critical is the development of an agile mindset that can respond at the speed of relevance in cyber space. International conflicts, for example, are no longer solely physical. They’re increasingly taking place in cyber space and sub-threshold. The pace of technology change, and the ease with which adversaries are adopting digital technology, has created a state of constant uncertainty. Meanwhile, in the commercial world, digitisation hasn’t just increased the pace of value creation, it’s also established a new attack surface across our economy and society.
The successful delivery of the NCS requires government, industry and individuals to work together across markets to proactively share risk and opportunity, moving beyond passing risk across contractual boundaries towards collaboration.
Mobilising a whole of the UK approach by energising regional change
The NCS is clear that regional action will be essential to achieving its ambition. The coronavirus pandemic has made it even more apparent that in a digital age, physical location is often less important to effective work.
However, that conceals the bigger picture. The UK regions contain a rich diversity of communities, academic specialisms and untapped potential, which can enable a cyber response at scale. Not tapping into that would be a strategic failure.
Central government shouldn’t assume an organic approach to regional development will be enough. It should actively seek to accelerate the potential value of flagship announcements, such as the positioning of the National Cyber Force in Samlesbury, GCHQ’s investment in Manchester, and the new applied research hub in the North.
Just as the National Cyber Security Centre has done with skills, these organisations need to drive economic and talent development, ensuring they’re true anchor institutions in their regional communities. It would be too easy to pay lip service to this, having a nominal presence while investment in people and the supply chain continues to flow towards London.
What this needs to look like in practice is new approaches to regional delivery, shaped and governed jointly by empowered cyber agencies and local government, as well as industry hubs and academia through networks such as the cyber clusters.
This would show people they don’t need to leave their hometowns to play their part in a sector of critical national importance, and that cyber is a place for all with ‘people like me’ within the regions.
Inspiring a whole of society response through a celebration of difference
As a ‘whole of cyber’ strategy, the NCS makes clear that no one organisation has all the levers required, or the necessary expertise, to enact whole system change. What is needed is a response that can connect a revolving cast of respondents who are collaborating and adapting together in new ways. This brings diversity of organisations, individuals, experience and thought.
Achieving this requires government to rebuild its role as both an integrator and an inspirer, energising and exciting people and teams to play their part in capturing the cyber opportunity. For that to happen, government departments need to orchestrate partnerships through a wider range of collaboration models that engender initiative-taking and pace in response to a fast-changing world. The UK Cyber Cluster Collaboration is a good example of this, taking a prominent role at the launch.
Industry also plays a vital part in fostering collaboration. Cyber is about much more than technology in isolation. Sustaining strategic advantage in cyber requires innovative join-up across multiple areas of expertise, from psychology to economics and education.
None of this is possible without a world class cyber workforce. Government must identify and engage people who wouldn’t normally consider a security career. This includes more women, broader race representation, wider neuro-diversity and improving access across wider socio-economic and geographic boundaries.
A strengths-based approach to identifying and retaining talent, where attitude and aptitude count for as much as experience or learning, will open up potentially surprising sources of latent cyber capability. And focus on investment in broadening the pool of potential cyber talent can link directly to regional prosperity and development goals.
The UK can build its reputation as a digital pioneer and bring society together to grasp the opportunities of the digital world. Building skills, particularly regionally, will also seize the zeitgeist of remote working as hybrid working becomes the norm. There is a clear role for government in creating the links and relationships that will make this a truly whole-of-UK endeavour, and to establish the UK as a leader on the international stage.