“When, not if.”
Ciaran Martin, head of the U.K.’s National Cyber Security Centre (NCSC), used those words to say he is expecting a devastating cyberattack will hit the U.K. in the next two years. The attack, he believes, will bring disruption to British elections and critical infrastructure. These remarks were made in light of newly released figures detailing the number of cyberattacks on the U.K. in the last 15 months. Martin said the U.K. has been fortunate to avoid a so-called category one (C1) attack, broadly defined as an attack that might cripple infrastructure such as energy supplies and the financial services sector.
His prediction initially brings one thing to mind – WannaCry. A strain of the ransomware impacted 50 countries and infected more than 250,000 machines in just one day. Its exploits included a massive takedown of 16 U.K. NHS medical centers. WannaCry was rated by the NCSC as a C2 level of attack, milder than the C1 Martin says is still to come.
Organisations across the U.K. were unprepared when WannaCry hit last May, and there is no simple fix to protect everyone. Martin concedes total protection is impossible, stating “Some attacks will get through. What you need to do is cauterise the damage.” The NCSC has been gradually building defenses and is due to publish a 60-plus-page dossier outlining what has worked and what has not since it opened in October 2016. Defense is a responsibility that falls on all of our shoulders, and begins with a new mentality that attacks are inevitable, and preparedness vital for a “culture of security.”
There is a misconception that cybersecurity is an IT issue that affects systems, not ordinary people. The reality is that cybercrime hurts us all. A massive cyberattack impacts economies, governments, innovation, growth, even global state of mind. If we all accept the reality of a potential C1 attack, we also accept the challenge to bond together in a new pact to protect the assets and values we hold dear. We must to do this. It’s a matter of when, not if.