Protecting the UK’s critical national infrastructure for a resilient and secure future

Phil Siveter, CEO | Thales UK

The government has made its intentions clear on the ambition to improve the UK’s infrastructure to unlock the economic benefits that could bring. The expansion of Heathrow airport is a totemic example of where CNI uplift is going to have a direct impact on the economic prosperity of the UK. 

CNI underpins modern society, covering essential sectors like energy, transport, healthcare, and finance, and these sectors have become prime targets for hostile actors seeking to disrupt or cripple vital services.

We have seen that in practice during Russia’s illegal invasion of Ukraine, with significant cyber-attacks on Ukrainian energy networks – and in other state and non-state-sponsored activity worldwide. Combined with extensive Russian missile and drone attacks on the gas infrastructure in the country as recently as February this year, the warning for the UK should be clear.

As global tensions rise, protecting CNI is urgent, and we see two key pillars to that: digital and physical. 

In the digital space, this means understanding what we must do to protect devices, data and applications in Operational Technology (OT) and Information Technology (IT) networks against cyber-attacks. If an attacker wants to tell the smart grid to switch power to an area, where could an unmatched load cause overloads and outages and what can be done to prevent it?

For Thales, the answer is clear: every device must have a secure identity, everything should be authenticated, and data must be encrypted at move and at rest so applications are protected from attack. 

This is exactly what we are working on at our Cyber Resilience Lab in Ebbw Vale, South Wales, which provides a dedicated space for industry collaboration and research. CNI operators can install and test equipment, train cyber teams, and run cyber exercises to enhance incident response. Our lab combines a physical smart energy grid and gas network test facility, as well as digitally simulated environments, allowing operators to stress-test their systems against realistic cyber threats.

Investment relief measures would help CNI operators meet the National Cyber Security Centre’s Cyber Assessment Framework standards by easing financial constraints, and incentivise them to maximise their spending on cyber security. This is something that we have seen utilised in the telecoms industry, and the government should consider expanding that model to CNI. 

Infrastructure security is the responsibility of the whole of government, and the physical protection of CNI requires coordination across multiple stakeholders. At present, there is no specific funding and distributed decision-making. Everything is fragmented, and as a result, we are vulnerable.

To rectify this, government should have a dedicated, ring-fenced budget for CNI protection, supported by additional regulation to increase resilience such as backup control rooms at key CNI plants. A clear monitoring strategy that incorporates the most modern and cost-effective technologies – particularly drones and AI for sensing and predictive maintenance – would bring additional benefit along with looking at the addition of appropriate effectors (for example, Radio Frequency Directed Energy Weapons) at the most critical sites.

Building on the lessons from Ukraine, we must think about a whole-of-society approach to defence. When it comes to CNI, this means government must incentivise CNI operators to be using innovative cyber security and make an investment in the physical defence infrastructure around key national sites.

When the Prime Minister publishes the single new national security strategy before the NATO Summit in June, protection of our CNI must form a significant part of that; anything less would be to overlook what could become the next defining homeland security threat.

Related

UK Would Struggle To Protect Itself From Attack, Say Defence Figures

By Matilda Martin

15 Mar