If the reports are true the UK government is considering supplying resources to the private sector from its highly experienced pool of cyber and information security specialists. Dame Pauline Neville Jones said ministers were “thinking about” ways in which GCHQ could supply services to private firms. And the Chairman of the All Parties Parliamentary  Committee, Andrew Miller MP, has also pushed the Minister on this “radical” proposal.

There would clearly be benefits to this approach. However as anyone working in information security will know, where ever there are benefits there are also potential risks. Here are some limited observations:

Benefits

  • Driving the adoption of information security best practice helps support  the protection of the UK’s economic, social and national security interests.
  • Recognises the value of UK intellectual property, within our skills and experience, with regards to information security & assurance. For several years the UK has been providing access to such IP, to foreign states, free of charge at the tax payers expense.
  • Generating revenues to help fund the development and maintenance of national cyber security resources.
  • Skills and knowledge transfer from those you’d naturally assume are very well qualified in terms of experience.

Risks

  • How will this affect those in the private sector who advise corporate UK on information and cyber security?
  • How do you manage the risk that these public sector servants pass on too much or detailed information to the private sector?
  • Will this cause conflict between the need to serve the country and the need to generate income to cover their costs?
  • How will this impact on resource productivity for delivering projects at GCHQ?
  • GCHQ resources are tiny compared to the needs of the UK’s private sector when it comes to information security.
  • Will these resources focus on a limited element within corporate UK to the detriment of the majority of the UK’s private sector enterprises as with other initiatives?

If you have anything to add please make a comment and share with all visitors to the blog. If you find this interesting or suspect a friend or collegue may have something to add or an interest then pass on the link or tweet about the blog. If you find blogs like this of interest then subscribe to receive updates of my latest posts.