View from the Academy: Cyber resilience is a grand challenge

We need to ensure we understand the risks associated with increasingly complex cyber systems, writes Royal Academy of Engineering chief executive Hayaatun Sillem.

The integration of physical and digital systems creates many opportunities for improved performance and innovation, offering huge potential to generate economic value, as well as social and environment benefits across a broad range of sectors. This has been recognised in the government’s Industrial Strategy, with ‘artificial intelligence and the data-driven economy’ named as one of four ‘Grand Challenges’. Digital technologies, including data analytics, artificial intelligence, autonomous systems, advanced connectivity and the Internet of Things (IoT), will also be key enablers of success for many of the other Grand Challenges and sector priorities articulated in the strategy.

However, in pursuing these opportunities, there is a need to ensure that we understand the risks associated with the increasingly complex and interdependent ‘systems of systems’ being created. For example, the component systems may be under the control of different organisations, with differing objectives that may not be aligned. It is vital that these risks are identified and addressed so that serious incidents are avoided, trust in such systems is maintained and the potential benefits are realised. That’s why the Academy will be launching two reports addressing this topic next month.

Interdependencies between physical and digital systems can trigger an unexpected cascade of consequences. A recent incident of this kind started with a flood at an electricity substation in Lancaster in December 2015 during Storm Desmond. This caused a 24-hour blackout across the city, resulting in more than 100,000 people losing access to electricity, the internet, mobile phones, contactless payment, lifts and petrol pumps. A failure of the baggage-handling system at Heathrow last year was also initiated by a power outage, this time in a data centre. When the power was reinstated in an uncontrolled way it resulted in damage to equipment causing massive disruption to passengers and huge costs to British Airways. In addition, the Wannacry attack in May 2017 led to disruption in at least 34 per cent of hospital trusts in England (the full extent of disruption to the NHS is unknown). It also impacted on companies such as the automotive manufacturers Nissan and Renault, even though the malware was not targeted specifically at the industrial control systems in their factories.

Cyber safety refers to the ability of systems to maintain adequate levels of safety during operation, including in the event of a cyber attack or accidental event, in order to protect life and property. While safety is a desirable property of a system during normal operation, resilience describes the capacity of a system to handle operational disruptions. A key aspect of cyber resilience is the ability to prepare for, withstand, rapidly recover and learn from deliberate attacks or accidental events, which can be mediated via the internet or through other means such as radio transmitters or lasers.

It is impossible to design systems that are entirely secure or free from the risk of failure but we need to ensure that we design systems with appropriate levels of cyber resilience and safety, especially if they are part of critical national infrastructure or safety-critical systems. Many of the vulnerabilities in current systems result from poor quality software and hardware, with vulnerabilities residing in both individual components and in the systems that are created from these components. Cyber resilience requires broader issues such as supply chain risks to be addressed, so it is crucial to embed a resilience mindset into the way we design and develop these systems.

The reality is that the depth of expertise in safety engineering required to ensure a resilience mindset is not always available in the domains where technological innovations are occurring. However, there are clear opportunities for the UK to exploit and disseminate existing expertise and best practice on safety engineering across a broader range of sectors, and to adopt a leadership position in the use of digital technologies themselves as enablers of cyber safety and resilience. The forthcoming EU directive on security of network and information systems will be an important development but only applies to essential service providers – critical infrastructure – and digital service providers. The UK is in a strong position to lead internationally on developing regulatory and non-regulatory measures to improve the quality of software, hardware and systems, while promoting innovation and ensuring safety and resilience. The efforts of the National Cyber Security Centre, the Engineering Council and others in supporting the engineering community in embedding security thinking are very welcome in this regard.

Success in these endeavours could impact directly on the UK’s future competitiveness and global influence in this exciting area of technological development. Valuable research is being done on this by the PETRAS Internet of Things Research Hub. But perhaps more importantly, it could have a significant positive effect on the level of public confidence around ethics, privacy and trust. These are likely to be key factors in determining acceptability and adoption of these systems by industry and consumers.