Cyber Strategy

Joseph Jarnecki, a research fellow at RUSI, said: “There are some promising points, looking at some of the results the government is seeing from organizations that are Cyber Essentials certified, but given the fact that take-up remains so low, it’s hard to know whether or not the scheme is value for money. Given the take-up and the scope of the potential take-up, it has not met what its potential could have been and could still be."

The biggest problem with pen and paper systems is that they don’t scale well, says Gareth Mott, from the Royal United Services Institute. It’s slower than using a computer for many tasks ,and it’s hard or perhaps impossible to coordinate thousands of employees using such methods across multiple office locations. But practising workarounds really can help, adds Dr Mott. He and colleagues have researched how “war-gaming” and IT failure roleplay exercises can impact employees’ responses to real-life cyber-attacks. “We found that the companies that had done that, sometimes a few weeks before they had a live incident, really benefitted,” he says. It’s not just pen and paper that could come in handy. Dr Mott is aware of one firm that bought “crates worth of Chromebooks” for staff in the wake of a cyber-incident, so that they could work without needing access to the company network.