How Can US and UK Cybersecurity Partners Cooperate?

TL;DR

Cybersecurity must be addressed through international partnerships because threats cross borders and no country or organization can manage them alone. The US and UK strategy combines stronger defenses, disruption of malicious actors, resilient incident response, critical infrastructure protection, threat information sharing, educational exchanges, and collaboration among governments, businesses, universities, civil society, and individuals.

Transcript

Good morning, everyone. My name is Michael Daniel, and I am the Special Assistant to the President and Cybersecurity Coordinator at the White House. Um, and if you don't understand the structure of the US government, you can just think of me as the chief cat herder, uh, for cybersecurity- -uh, in the US government. Um, I feel a little bit like we s... Read More

Key Insights

• Cyberspace is both a strategic asset and a potential strategic liability because developed societies depend heavily on connected digital systems. Without progress on difficult security challenges, asymmetric threats could undermine the economic, political, and social benefits that internet connectivity has produced.
• International cyber institutions are still being built, much like major security institutions were developed after World War II. The US expects the creation of essential relationships, connections, and cooperative mechanisms to remain a central task over the next five to ten years.
• The US cyber strategy has three overarching goals: improve cybersecurity throughout society, disrupt malicious actors, and build strong incident response and recovery capabilities. Resilience remains necessary because even effective defenses and disruption efforts cannot prevent every attacker from succeeding.
• Cyber threats are global and do not respect national borders, so purely domestic approaches are insufficient. Effective responses require collaboration among states, businesses, civil society organizations, individuals, allies, and technology companies facing similar challenges across interconnected systems.
• US and UK cooperation is focused on protecting critical infrastructure, improving threat information sharing, strengthening intelligence cooperation, and supporting educational exchanges between cybersecurity scholars. These priorities were reinforced during bilateral meetings between President Obama and Prime Minister Cameron.
• UK corporate cybersecurity awareness is increasing, with 92 percent of surveyed FTSE 350 boards reporting a clear or acceptable understanding of critical information and data assets. The same survey found that 88 percent included cyber issues in their risk registers.
• The UK national cybersecurity program received 1.3 billion dollars over five years and is coordinated by the Office of Cybersecurity and Information Assurance on behalf of the National Security Council. Its priorities include secure online business, resilience, open cyberspace, and skills development.
• Cybersecurity capacity depends on education, practical information sharing, and coordinated operational action. UK examples include cyber training at every academic level, the CyberFirst university sponsorship program, a sharing partnership with 1,000 member organizations, and cooperation with US colleagues on the Gameover Zeus takedown.

Questions & Answers

Q: Why are there no purely domestic cybersecurity issues?

There are no purely domestic cybersecurity issues because cyber threats cross borders and affect interconnected systems, organizations, and societies. Governments, businesses, civil society organizations, and individuals face similar evolving risks. No single participant can secure cyberspace alone, so countries must share information, coordinate responses, learn from one another, and build practical partnerships that address threats internationally.

Q: What are the three main goals of the US cybersecurity strategy?

The three overarching goals are to raise the overall level of cybersecurity, develop capabilities that disrupt or interrupt malicious actors, and strengthen incident response, recovery, and resilience. The first goal addresses immediate defenses and long-term security by design. The other goals recognize that malicious activity must be challenged directly and that some attacks will still succeed despite strong prevention.

Q: Why could cyberspace become a strategic liability?

Cyberspace could become a strategic liability because modern societies are highly dependent on connected digital systems while facing asymmetric threats. The internet has enabled economic growth, democratic participation, human rights, and major social benefits. If difficult security problems remain unresolved, that same dependence and connectivity can expose governments, economies, organizations, and individuals to damaging malicious activity.

Q: How are the US and UK strengthening cybersecurity cooperation?

The US and UK are strengthening cooperation by improving the cybersecurity of critical infrastructure, expanding threat information sharing, deepening intelligence cooperation on cyber issues, and supporting educational exchanges between American and British cybersecurity scholars. Their partnership also includes operational collaboration against cybercrime, capacity-building initiatives, and efforts to establish stronger international institutions and connections for managing shared threats.

Q: What are the main priorities of the UK cybersecurity strategy?

The UK aims to become one of the most secure places to conduct business online, improve national resilience against cyberattacks, protect its interests in cyberspace, and help shape an open, vibrant, stable internet that supports open societies. It also prioritizes cyber skills, knowledge, and capability through academic training, university sponsorship, information sharing, and coordinated government investment.

Q: How does the UK share cybersecurity information with organizations?

The Cyber Information Sharing Partnership is the UK's main vehicle for sharing cybersecurity information domestically. It has 1,000 member organizations representing a wide range of sectors. The partnership supports collective awareness and resilience by connecting organizations that face related threats, reflecting the broader principle that governments and industries need close, practical cooperation to protect interconnected digital systems.

Q: What evidence shows that UK companies take cyber risk seriously?

A survey of FTSE 350 companies found that 92 percent of boards had a clear or acceptable understanding of their companies' critical information and data assets. It also found that 88 percent included cyber issues in their risk registers. The survey was conducted before the attacks on Sony, indicating that board-level attention was already increasing before that prominent incident.

Q: How is the UK developing cybersecurity skills and expertise?

The UK government supports cyber training at every level of academic study and introduced CyberFirst to sponsor promising students through university. Participants can later work in industry or academia. The UK also supports the Global Cybersecurity Capacity Center at Oxford University and educational exchanges with US scholars, linking national skills development with broader international capacity-building and cooperation.

Summary & Key Takeaways

• The internet has supported economic growth, human rights, democracy, and broad social benefits, but increasing digital dependence creates serious asymmetric risks. US leaders describe cybersecurity as a strategic inflection point that requires new international institutions and connections over the coming five to ten years to keep cyberspace from becoming a liability.

• The US cybersecurity framework has three overarching goals: raise security across society, develop capabilities that disrupt malicious activity, and strengthen incident response, recovery, and resilience. These goals cannot be pursued solely within national borders because cyber threats are global and successful attacks can affect governments, businesses, civil society organizations, and individuals.

• US and UK cooperation includes critical infrastructure protection, threat and intelligence sharing, academic exchanges, capacity building, and joint action against cybercrime. The UK also emphasizes secure online business, domestic information sharing, resilient systems, an open and stable cyberspace, university sponsorship, and coordinated investment through its national cybersecurity program.