Secure by design 2023

John Connolly, AtkinsRéalis Technical Director for Cyber Resilience, UK and Europe introduces the 2023 Secure by Design magazine

In this year’s Secure by Design magazine we aim to highlight a variety of cyber resilience issues, with a sharp focus on the implementation of secure by design.

Secure by design, as a concept, is not new. It has been used in the security sector for some years, both physical and cyber, and it means different things to different people. For designers, it’s about baking-in security-enforcing functions to the design, avoiding practices that introduce vulnerabilities, and testing that these controls work.

For those managing risk, it’s about ensuring risks are identified as soon as possible in the lifecycle and reviewed throughout a system’s life. And, for information asset owners and decision-makers, it’s about being confident that systems are safeguarding information appropriately and they’re functioning as designed.

In truth it’s all the above: organisations need to ensure their cyber risk considerations and risk awareness ‘shift left’ in the development lifecycle, while addressing risk throughout the life of an asset.

We see cyber attacks becoming an everyday threat to business and society, and there are no signs of this levelling off or receding. Adversaries are exploiting vulnerabilities in our digital infrastructure, the systems that provide critical services to society such as power generation, water treatment, gas pipelines. This means organisations are turning to their Chief Information Security Officers (CISOs) and IT teams for answers to what, in some businesses, is an existential threat: a top three board risk. In this issue, Senior Cyber Security Consultant David Greeney’s article proposes that what’s needed is a collaborative approach between the technical and business space.

With this increase in threat and more severe impact as we move to digitise our processes comes the need to grow the skills to adequately address them. Both Senior OT Cyber Security Consultant, Della-Maria Marinova, and Cyber Security Consultant Kate Blackie’s articles discuss the opportunities and challenges in closing the ‘cyber skills gap’.

Cyber resilience can’t sit in isolation though, and its mitigations have real-world consequences to our planet. Not only in terms of protecting the environment from harmful incidents, but also in ensuring that we design solutions with a low carbon footprint. Senior Cyber Security Consultant, Natalie Forrestill, and Cyber Security Consultant Jonathan Bewley’s article on embodied carbon highlights some of the thinking designers need to do when developing systems.

I hope you enjoy reading the magazine. If you would like to talk about any of the subjects raised or our work in cyber resilience, please do reach out to me. At the back of the magazine there are also regional points of contact who will be more than happy to help.