Researchers warn governments on cyber security approach

Governments hoping to secure their online infrastructure may need to take a new approach to cyber security, say experts.

A recent report from the London School of Economics and Oxford University found that governments may take the wrong approach in viewing an online attack as they would a real-world military action.

"We don't help ourselves using 'cyber war' to describe espionage or hacktivist blockading or defacing of web sites, as recently seen in reaction to WikiLeaks," said London School of Economics professor Peter Sommer.

"Nor is it helpful to group trivially avoidable incidents like routine viruses and frauds with determined attempts to disrupt critical national infrastructure."

Attacks on government sites and IT infrastructure have become more common in recent years, and the US and EU have run drills to simulate the response to a large-scale cyber attack.

Sommer told V3.co.uk that rather than look to trace down and react to incidents, governments should work with private companies to secure systems and prepare plans for possible scenarios.

"Most of the time you will lack certainty about who is attacking you because large numbers of attack methods involve hijacking innocent machines as the vector, making tracing difficult," he said.

"As a result you need to concentrate on making vulnerable systems resilient. That means both protective measures but also fully worked out contingency plans so that you know how to recover quickly."

Graeme Matthews, cyber security partner at global consultancy Deloitte, argued that for critical national infrastructure organisations, there can be a tension between the wishes of the shareholders and the needs of wider society when it comes to shelling out for cyber defences.

"In the current climate of austerity, there could be challenges in agreement about who is going to fund many of the necessary preventative measures," he added.

"Organisations need to be prepared and to have specific contingency plans in place to deal with systems and internet service disruption. Today, not many do and we would urge more positive action in this area."