UK Leaders Called to Action: Strengthening Defenses in the Cyber Battlefield

The British government has called upon leaders of major corporations to “strengthen” their defenses against cyberattacks, treating this threat as a critical business risk on par with financial and legal challenges.

This appeal followed a study revealing a lack of engagement from directors in their organization’s cybersecurity efforts. Only 30% of surveyed companies have board members explicitly responsible for information protection as part of their official duties.

On Tuesday, a draft Code of Practice was published, offering guidance for top managers and directors to bolster cyber resilience. The government seeks feedback on these proposed practices by March 19.

Image Courtesy

Despite years of efforts, cyberattacks in the UK have reached an unprecedented level. According to the latest data from the Information Commissioner’s Office, British organizations faced 874 ransomware attacks in the first three quarters of 2023—a sharp increase from 739 incidents in all of 2022.

However, data breach statistics do not fully capture the extent of cyberattack consequences, including business losses and psychological harm to staff.

The rise in incidents is partly attributed to the development of the ransomware-as-a-service model, which facilitates entry for aspiring criminals.

A key point of the Code is the requirement for detailed plans for cyberattack response and system recovery. British officials have repeatedly emphasized the importance of not only defending against attacks but also quickly mitigating their effects.

Recovery plans should be developed in addition to reliable defense measures, enabling companies to effectively counter cyber threats.

On Tuesday, the government stated that the Guidance would be advisory and not legally binding, though it supports several existing regulatory standards. The business community has previously expressed concerns to authorities about the complexity and confusion of current regulations in this area.

Key cybersecurity laws, such as GDPR and NIS, continue to evolve. Specifically, the UK GDPR is slated for reform under the new Data Protection Act. The nature of these amendments is currently being debated in Parliament.

A promised amendment to the NIS, which would have tightened the law, was omitted from the government’s latest legislative program. It is unlikely that changes will be made before the next election.