Progress and research in cybersecurity Supporting a resilient and trustworthy system for the UK Progress and research in cybersecurity: Supporting a resilient and trustworthy system for the UK Issued: July 2016 DES3800 ISBN: 978-1-78252-215-7 The text of this work is licensed under the terms of the Creative Commons Attribution License which permits unrestricted use, provided the original author and source are credited. The license is available at: creativecommons.org/licenses/by/4.0 Images are not covered by this license. This report can be viewed online at royalsociety.org/cybersecurity Cover image © mustafahacalaki. Contents Executive summary 5 Headline recommendations 6 Detailed recommendations 7 Chapter one – Cybersecurity and the digital society 11 1.1 Digital technologies are transforming society and creating complexities in the process 12 1.2 Digital systems’ importance will continue to grow and to evolve in nature 13 1.3 The UK is in a strong position to continue to benefit from the digital society 13 1.4 Cybersecurity is central to the task, but faces a unique set of challenges 15 1.5 To capitalise on the UK’s strengths, we need a trustworthy, resilient and self-improving digital environment 16 1.6 This report 17 Chapter two – Trust 19 2.1 Trust and trustworthiness underpin growth and innovation 20 2.2 Competent behaviour underpins trustworthiness 22 2.3 Accessible information enables people to judge trustworthiness 29 2.4 Debates on ethics and governance are fragmented 31 Chapter three – Resilience 32 3.1 Organisations will need to be resilient in the face of change 33 3.2 Resilience will depend on trusted institutions to provide coordination and advice 34 3.3 Incentives for improvement should be aligned with wider incentives 37 3.4 Breach reporting can support adaptation to unpredicted threats 38 3.5 Sharing information about vulnerabilities and attacks should increase resilience 40 3.6 Improving third party vulnerability reporting should increase resilience 41 3.7 Cyber-physical systems must be a priority 41 PROGRESS AND RESEARCH IN CYBERSECURITY 5 Chapter four – Research 44 4.1 Cybersecurity research, policy and practice face distinctive challenges 45 4.2 Levelling the cybersecurity playing field is a grand challenge 47 4.3 Research and policy must bridge national, disciplinary and sectoral boundaries 50 4.4 The proposed changes will drive a more responsive cybersecurity research agenda 51 Chapter five – Translation 55 5.1 Innovative research-based cybersecurity requires diverse ideas and approaches 56 5.2 New approaches must be evaluated and demonstrated 56 5.3 Funders can do more to support diversity and innovation 57 Appendices 60 Appendix 1: About this report 61 Appendix 2: Steering Group, Project Team and Review Panel 62 Appendix 3: Evidence gathering 64 Appendix 4: Acknowledgements 65 6 PROGRESS AND RESEARCH IN CYBERSECURITY EXECUTIVE SUMMARY Executive summary Digital systems have transformed, and will Translation of innovative ideas and continue to transform, our world. Supportive approaches from research will create a government policy, a strong research base strong supply of reliable, proven solutions to and a history of industrial success make the difficult to predict cybersecurity risks. This is UK particularly well-placed to realise the best achieved by maximising the diversity and benefits of the emerging digital society. These number of innovations that see the light of benefits have already been substantial, but day as products. they remain at risk. Protecting the benefits and minimising the risks requires reliable and Policy, practice and research will all need to robust cybersecurity, underpinned by a strong adapt. The recommendations made in this research and translation system. report seek to set up a trustworthy, self- improving and resilient digital environment that Trust is essential for growing and maintaining can thrive in the face of unanticipated threats, participation in the digital society. Organisations and earn the trust people place in it. earn trust by acting in a trustworthy manner: building systems that are reliable and secure, Innovation and research will be particularly treating people, their privacy and their data important to the UK’s economy as it establishes with respect, and providing credible and a new relationship with the European Union. comprehensible information to help people Cybersecurity delivers important economic understand how secure they are. benefits, both by underpinning the digital foundations of UK business and trade and Resilience, the ability to function, adapt, also through innovation that feeds directly grow, learn and transform under stress or in into growth. The findings of this report will the face of shocks, will help organisations be relevant regardless of how the UK’s deliver systems that are reliable and secure. relationship to the EU changes. Resilient organisations can better protect their customers, provide more useful products and services, and earn people’s trust. Research and innovation in industry and academia will continue to make important contributions to creating this resilient and trusted digital environment. Research can illuminate how best to build, assess and improve digital systems, integrating insights from different disciplines, sectors and around the globe. It can also generate advances to help cybersecurity keep up with the continued evolution of cyber risks. PROGRESS AND RESEARCH IN CYBERSECURITY 7 RECOMMENDATIONS HEADLINE RECOMMENDATIONS • Trust Governments must commit to • Research A step change in cybersecurity preserving the robustness of encryption, research and practice should be pursued; including end-to-end encryption, and it will require a new approach to research, promoting its widespread use. Encryption focused on identifying ambitious high-level is a foundational security technology that goals and enabling excellent researchers to is needed to build user trust, improve pursue those ambitions. This would build on security standards and fully realise the the UK’s existing strengths in many aspects benefits of digital systems. of cybersecurity research and ultimately help build a resilient and trusted digital • Resilience Government should commission sector based on excellent research and an independent review of the UK’s future world-class expertise. cybersecurity needs, focused on the institutional structures needed to support • Translation The UK should promote a free resilient and trustworthy digital systems and unencumbered flow of cybersecurity in the medium and longer term. A self- ideas from research to practical use and improving, resilient digital environment support approaches that have public will need to be guided and governed by benefits beyond their short term financial institutions that are transparent, expert and return. The unanticipated nature of future have a clear and widely-understood remit. cyber threats means that a diverse set of cybersecurity ideas and approaches will be needed to build resilience and adaptivity. Many of the most valuable ideas will have broad security benefits for the public, beyond any direct financial returns. 8 PROGRESS AND RESEARCH IN CYBERSECURITY RECOMMENDATIONS Detailed recommendations CHAPTER TWO – TRUST RECOMMENDATION 1 RECOMMENDATION 2 Governments must commit to The Government should preserving the robustness of go further to establish and encryption, including end-to-end promote rigorous, evidence- encryption, and promoting its based guidance on state of widespread use. the art cybersecurity principles, standards and practices, accompanied by certification marks or benchmarks for digital products and services, focused on improving consumers’ protection and understanding. • The identification of rigorous, evidence- based benchmarking and evaluation standards for cybersecurity, how best to structure those standards, and how best to communicate them to users should be informed by existing and future research. • Review processes for evaluating privacy preservation methods should be established, including anonymisation techniques (for releasing or providing access to data) and anonymous communications. PROGRESS AND RESEARCH IN CYBERSECURITY 9 RECOMMENDATIONS CHAPTER THREE – RESILIENCE RECOMMENDATION 3 RECOMMENDATION 4 The Government should The incentives for organisations commission an independent to adhere to rigorous, evidence- review of the UK’s future based cybersecurity standards cybersecurity needs, focused should be strengthened. on the institutional structures needed to support resilient and • Publicly listed companies and public bodies, including Government departments, trustworthy digital systems in should benchmark their adherence against the medium and longer term. cybersecurity standards, and regularly report on this. • The Government has recently moved to consolidate a range of cybersecurity • Changes to legal liability for cybersecurity functions into a single new institution, the failures should be considered. National Cyber Security Centre (NCSC). The review should work with those establishing • Publicly listed companies and public the Centre and determining its programmes, bodies may in future be required to report to ensure that it has the capacity and cybersecurity breaches to an appropriate incentives to deliver the requirements coordinating body, under the EU General outlined in this report, and that there is Data Protection Regulation, if the regulation continuing informed and open discussion is implemented in the UK. The identity about