Is GCHQ Frighteningly Clueless or Fiendishly Cunning?

I'm very sceptical about the concept of “cyber attacks”. Not that I doubt that computer systems and infrastructure are attacked: it's just their packaging as some super-duper new “threat” that I find suspicious. It...


I'm very sceptical about the concept of "cyber attacks". Not that I doubt that computer systems and infrastructure are attacked: it's just their packaging as some super-duper new "threat" that I find suspicious. It smacks of bandwagon-jumping at best, and at worst looks like an attempt by greedy security companies to drum up yet more business.

So my heart sank when I read the following:

The UK's critical infrastructure – such as power grids and emergency services – faces a "real and credible" threat of cyber attack, the head of GCHQ says.

The intelligence agency's director Iain Lobban said the country's future economic prosperity rested on ensuring a defence against such assaults.

Well, yes and no. Obviously, malware is a threat to every company (and user), but that doesn't make it a particular threat to "the country's future economic prosperity". It's just one of the everyday challenges that we face in a wired-up world, and that people by now should have come to terms with and learned how to deal with.

The credibility of the GCHQ's analysis is not helped by statements like this (assuming the BBC managed to get them right – not something that can be taken for granted these days, alas):

The internet created opportunities for hostile states and criminals, he said.

Er, you mean GCHQ has only just noticed?

For example, 1,000 malicious e-mails a month are already being targeted at government computer networks, he said.

I don't know about you, but I get almost exactly that number every month, also targeted at me personally ("Moody Glyn you hav won...."). Again, this news is only about 10 years out of date.

Then we get to the nub of the problem:

He said that they had already seen "significant disruption" to government computer systems caused by internet "worms" - both those that had been deliberately targeted and others picked up accidentally.

In other words, we're talking about Windows again, and Microsoft's continuing inability to make its systems secure - even with "monster" Patch Tuesdays.

What's truly worrying is that despite the evidence to the contrary, GCHQ seems to think that religiously applying the ever-increasing mountain of patches will sort out a good chunk of these "cyber attack" problems:

While 80% of the threat to government systems could be dealt with through good information assurance practice – such as keeping security "patches" up to date – the remaining 20% was more complex and could not simply be solved by building "higher and higher" security walls.

Instead of this blind faith in ever-bigger Patch Tuesdays, have those boffins at GCHQ ever thought of turning to software like GNU/Linux that is rather less vulnerable to all those nasty, malicious emails in the first place?

The fact that GCHQ makes no mention of this option means one of two things. Either it is terminally clueless, and we can expect the country's computing infrastructure to be taken out on a regular basis in the future (hello Stuxnet 2.0), or else GCHQ is actually being dead cunning here - pretending to be terminally clueless by wittering on about Microsoft patches to mislead attackers, but secretly swapping out all those vulnerable Windows systems as fast as they can, so that the infrastructure is inherently more secure.

Now, which do you think is more likely?

Follow me @glynmoody on Twitter or

"Recommended For You"

GCHQ, BT and Lockheed go talent spotting as UK faces cyber skills shortage GCHQ launches clean-up services for victims of cyber-attacks