The Brexit Shaped Gap In UK Cyber Security

Leaving the EU could mean a new cyber security regime for the UK, firms need to understand how the changes might affect them. There has long been a strong partnership between the UK and Europe in cyber security.  With the outcome of Brexit still uncertain, there is much debate about how these links will be maintained in the future. 

There will clearly be changes, not least that the UK is set to lose its seat on Europol’s management board and will no longer be able to shape European Union (EU) cyber security policy and regulation. However, there are many areas where it is still unclear what will change, so organisations will need to make sure they are aware of new developments, understand the implications for their business and respond quickly.

Cyber Security Standards
One area in doubt is the level to which EU cyber-related standards will continue to apply in the UK. 
For example, while the Network and Information Systems Regulations (NIS), which is based on an EU directive, has now been put into law in the UK, some aspects of it require cross-EU cooperation, such as the participation in a Computer Security Incident Response (CSIR) team network. The nature of this co-operation will depend on the final deal between the UK and the EU.

The E-Privacy Regulation, which replaces the Privacy and Electronic Communications Regulations (PECR), has yet to come into force, but may do so later this year and will have a one-year implementation period. Whether it will be implemented is likely to depend on a Brexit deal.

The EU has also proposed a new Cyber Security Act, but it is unlikely to be implemented before any transition period, although not being part of it could affect future information sharing between the UK and the EU. The real challenge is that if there is no deal, the UK may become a so-called third country, and this could raise concerns about UK standards which could have implications for UK organisations holding EU-related data.

Flow of Personal Data
The UK government has taken some action to address these uncertainties, including the recent ratification of Convention 108+, an agreement on robust data protection principles and rules signed by 25 other countries – 19 from Europe and six from the rest of the world. This convention lets the signatory states share data, providing they implement its principles, which are aligned to the General Data Protection Regulation (GDPR). Although this does not remove the Brexit uncertainty, it will lessen the impact of a no-deal scenario and help to enable the continued flow of personal data.

Despite this move, organisations, especially those that trade in information between the UK and the EU, will need to take action to minimise any cyber security issues when trading with the EU and other countries.

That should include continued monitoring of new cyber-related laws and regulations in other countries and a process for assessing whether there is a business need to meet these new requirements, rather than just the local UK-based ones, such as Cyber Essentials.

This should be supplemented by a review of the organisation’s cyber security standards to ensure that it is not locked out of important markets. This may well mean adopting even more stringent or different controls relating to cyber security than we have today or in the future to ensure the business can continue to trade.

Good cyber security practice should remain a priority, including deploying an adequate proactive threat intelligence service to monitor the potential for increased cyber-attacks. It is possible that malicious actors could look to exploit a disorderly exit and look for loopholes in current systems or use uncertainty and inconsistency in the cyber security laws between the UK and Europe to find new ways to attack systems.

International Rules
Good relationships with regulators and government bodies, such as the National Cyber Security Centre (NCSC), will also be more important than ever. It will be vital for all those involved to work together to understand how UK-based regulations can be aligned and recognised under other international cyber security standards.
Finally, there are some practical steps that organisations need to take in relation to data transfers. They should review which third-country data transfer safeguard mechanisms can be used for personal data transfers to the EU, such as standard contractual clauses and binding corporate rules.

They also need to review their privacy notices, information and internal documentation to identify any details that will need updating when the UK leaves the EU. In addition, they should liaise with data protection authorities in all the EU countries of operation to ensure they comply with their local specifications.

Of course, all of this is no guarantee that the rest of the world will be happy to continue to share information with UK organisations, but careful monitoring and proactive adoption of cyber security standards is the best way to navigate through the uncertainties of the post-Brexit world.

Computer Weekly:

You Might Also Read:

UK Deal With EU On Post-Brexit Data Sharing:

UK And EU Will Connect With Cybersecurity After Brexit:

 

 

« British Politicians Need To Better Understand Cyber Security
Financial Apps Are Vulnerable »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 8,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Cybsecurity Foundation (CSF)

Cybsecurity Foundation (CSF)

Cybsecurity is a non-profit NGO, which aims to work on improvement of security levels in the Polish cyberspace.

Hewlett Packard Enterprise (HPE)

Hewlett Packard Enterprise (HPE)

HPE is an information technology company focused on Enterprise networking, Services and Support.

BetterCloud

BetterCloud

BetterCloud puts IT in control of the modern workplace through user lifecycle management, data discovery, and IT and security automation purpose-built for SaaS.

Pathway Forensics

Pathway Forensics

Pathway Forensics is a leading provider of computer forensics, e-discovery services and digital investigations.

Cyberteq

Cyberteq

Cyberteq is an innovative Information and Communication Technology Consulting Company, enabling it’s customers to take full advantage of the latest technologies in a secure manner.

Cyber Forensic & Investigation (CFI)

Cyber Forensic & Investigation (CFI)

Cyber Forensic & Investigation (CFI) is recognized as Thailand’s leader in cyber investigations and digital forensics.

Glilot Capital Partners

Glilot Capital Partners

Glilot Capital Partners is an Israeli seed and early-stage VC. We specialize in businesses which disrupt enterprise technology, mainly in the fields of AI, big data and cybersecurity.

CyGlass

CyGlass

CyGlass simply and effectively identifies, detects, and responds to threats to your network without requiring any additional hardware, software, or people.

Scarlett Cybersecurity

Scarlett Cybersecurity

Scarlett Cybersecurity provide cybersecurity services to US private and public organizations with specific emphasis on compliance and cybersecurity incident prevention, detection, and response.

Larsen & Toubro Infotech (LTI)

Larsen & Toubro Infotech (LTI)

LTI is a global technology consulting and digital solutions company with operations in 33 countries.

Ward Solutions

Ward Solutions

Ward Solutions are an information security consultancy and managed services company. We help organisations protect their brand, people, assets, intellectual property and profits.

Commonwealth Scientific & Industrial Research Organisation (CSIRO)

Commonwealth Scientific & Industrial Research Organisation (CSIRO)

CSIRO is Australia's national science agency. We solve the greatest challenges through innovative science and technology.

Vertek

Vertek

Vertek is a leading provider of operations consulting, end-to-end business process outsourcing, business intelligence, software applications and managed cybersecurity solutions.

CIS Secure

CIS Secure

CIS Secure is an innovator, integrator and expert advisor supporting the broadest portfolio of powerful, mission-specific C5ISR communications and cybersecurity solutions.

Datagroup

Datagroup

Datagroup makes IT easy. Our IT experts ensure that your technology is always up to date with perfectly customized solutions.

Quantum Knight

Quantum Knight

Quantum Knight is the most performant commercial-grade embeddable cryptography. Lock down any resource from any location or device. Take control of your data now.