Philip Hammond invokes an active defence of UK hacking back the attackers

The British Government announces an active defence posture in response to nation-state cyber attacks, Chancellor warns UK will retaliate against attacks.

Hacking back, or “active defence” as security experts prefer to call it, is becoming a high debated argument.

While the number of cyber attacks continues to increase and attackers are using even more sophisticated techniques, many Governments are planning to hack back crooks and nation-state hackers that threaten their infrastructure.

Recently a china’s cybersecurity draft law plans to hit back foreign hackers that power.

The British government fears that “old legacy IT systems used by many organizations in the UK” are increasingly targeted by hackers who have no problem to compromise them.

Britain will strike back against nation-state actors that will launch cyber attacks on the national critical infrastructure.

Chancellor Philip Hammond promised retaliatory countermeasures in response to state-sponsored attacks, he also unveiled a £1.9bn package designed to boost Government defenses against cyber threats as part of a five-year national cyber security strategy.

The strategy of the UK Government has a five-year plan and aims to “work to reduce the impact of cyber attacks and to drive up security standards across public and private sectors.”

Philip Hammond he reiterated that the measures are a question of national security.

The most interesting part of the measures announced by Hammond, is the intention of the UK Government to adopt an active defence model which includes possible offensives against attackers. Hammond explained that hack back is the unique alternative to a conflict.

“Speaking before the launch, Hammond said Britain must “keep up with the scale and pace of the threats we face” and insisted that the new funding will “allow us to take even greater steps to defend ourselves in cyberspace and to strike back when we are attacked”.” reported The Guardian

“The money – which almost doubles the amount set out for a similar strategy in 2011 – will be used to improve automated defences to safeguard citizens and businesses, support the cybersecurity industry and deter attacks from criminals and “hostile actors”.”

Hammond announced a new posture of the UK against the cyber threats, with a specific focus on the protection of the nation’s critical national infrastructure and business.

“We will deter those who seek to steal from us, or harm our interests,” Hammond told at the Microsoft’s Future Decoded conference in London on Tuesday. “We will strengthen law enforcement to raise cost and reduce rewards,” he said of criminal attackers.

This is just first step ahead in cyber security matter, he promised the UK would “continue to invest in cyber defense capabilities,” in particular in the technology that could allow the British cyber army to trace and hack back the state-sponsored hackers.

“If we don’t have the ability to respond in cyberspace to attack that takes down power networks or air traffic control systems we would be left with the impossible choice of turning the other cheek or resorting to a military response – that’s a choice we don’t want to face.”

“No doubt the precursor to any state-on-state conflict would be a campaign of escalating cyber attack. We will not only defend ourselves in cyberspace but will strike back in kind when attacked.”

In the same day, Hammond, who chairs the Cabinet’s cross-department cyber-security committee, had listed high-profile cyber attacks against British critical infrastructure.

The active defence model implemented by the UK Government includes a new generation software to detect and repel cyber attacks and also the creation of dedicated cyber units.

Hammond pointed to the recent deployment of an application that was able to zero incidence of 50,000 fraudulent emails from crooks that pretend to be sent from Government offices.

Hammond also referenced the TalkTalk data breach that exposed details of 156,959 customers and that lead the Information Commissioner to fine the company £400,000.

“CEOs and boards must recognise they have responsibility to manage cybersecurity,” Hammond said.

Hammond stressed the adoption of a proper security posture also for private businesses that are a privileged target of hackers.

“Similarly, technology companies must take responsibility for incorporating the best possible security measures into the technology of their products. Getting this right will be crucial to keeping Britain at the forefront of digital security technology.” 

No doubts, the active defence is the new approach of many governments in response to the growing cyber threats.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Active Defence , UK)