WIREDGOV

After CYBERUK this year, those of us on techUK's Cyber Resilience Committee were asked whether anything from the conference might be of particular interest to techUK members. For me it was Duncan M's session on the NCSC's new approach to cross domain, and so, with the help of techUK, we organised an afternoon session on 1 October. 

Most techUK members would either know nothing about cross domain or think of it as something exclusively for national security, and quite reasonably think that is something to leave to the specialists. The message of the afternoon was that it needs adopting far more widely, particularly across critical national infrastructure (CNI). I have borrowed the panel's three framing questions here. 

Just how relevant is it outside the 'High Threat Club'? 

Two things are pushing it up the agenda. One is the threat: the attacks on the Polish electricity grid last winter prompted an NCSC alert to UK utilities, and the NCSC's assessment of AI to 2027 expects the gap between a vulnerability being disclosed and exploited to shrink further still. The other is the convergence of operational and information technology. For example, a grid built around centralised generation had simple data flows, whereas one built on distributed generation (solar farms reporting into the systems that keep the lights on) has complex ones. The NCSC's guidance is written for any organisation whose threat model assumes targeted attack, which is a much bigger club. 

AI cuts both ways. It may find flaws in the systems that cross domain protects, and in cross domain technology itself, while some of the data flows needing protection will be AI queries in their own right. It will also help us build new security solutions faster. 

If it is relevant to wider CNI, how do we message it? 

Perhaps by not calling it cross domain at all. The room was encouraged to think of it as "data flow security" instead, and the old term does carry baggage. Its defence and intelligence heritage is reassuring (it has protected the highest-threat environments for years), but it also suggests something highly specialised and expensive. Integration seemed to be the bigger worry for CNI operators: people who can integrate specialist technology are hard to find, and making it easy to buy and easy to deliver is where the effort needs to be put in. 

I find the shift to architectural thinking encouraging, with its emphasis on making trade-offs to reduce risk (a question from the floor suggested "risk balance" might be the better phrase). We can't rely on a "magic security box". The same pattern might be implemented in the cloud, on premises, in physical devices or as individual components, so we shouldn't expect fixed answers. (All the talk of zones of trust kept bringing Robert De Niro's "circle of trust" from the "Meet the Parents" film franchise to mind, though I may have been alone in that.) 

Could 'UK PLC' benefit from nurturing a community? 

I think so, for two reasons. The first is advice. The NCSC is developing a Cross Domain Advice offering within its Assured Cyber Security Consultancy scheme, and helping clients model the threat (starting from how likely they are to be targeted) is the natural first step to deciding whether it is right for them. Many techUK members already count CNI operators among their clients. 

The second is products. What might have looked like a closed shop of a few niche suppliers could open up to companies who never thought of themselves as cross domain vendors. 

Plenty remains unsettled, from guidance on moving beyond the old assurance regime to mutual recognition between UK, US and NATO approaches. techUK is now planning a smaller technical follow-on, and I would encourage anyone with CNI clients, or potential innovations, to join it.