Operator cyber security obligations 101. Part One; it all begins in 1834…

In the same depressing vein, our friends at Vodafone Business recently claimed that small and medium-sized UK enterprises are being hit with annual losses totalling £3.4bn due to inadequate security measures (“Cyber-attacks against SMEs have surged in recent years, with studies revealing that more than a third (35%) experienced a cyber incident in 2024 alone.

More than a quarter (28%) suffered between one and five attempted attacks, while (6%) were targeted up to 10 times in a year”). If you want one bad number to top them all, how about a February analysis that says the world lost $9.5 trillion last year from these kinds of problems.

It’s easy to let one’s eyes glaze over at the extent of all this; there are a lot of numbers here, and nothing ever seems to change—since the advent of the first known cyber-attack, which rather amusingly (but, as I think we’ll see, is also rather pertinent) was the 1834 manipulation of a telecommunications system for malicious gain in the shape of the theft of financial market information from the French telegraph system by two thieves.

Cyber responsibility is now a network, not a node, problem

It could be argued that all those big, medium, small and charitable concerns—and, of course, all the national governmental or NHS or healthcare organisations who are equally in the firing line when it comes to their cyber security obligations—that they have to be manning the barricades themselves; they know there are bad actors out there beyond the walls sniffing out their weaknesses and looking to steal their or their customers’ data.

But here’s the thing. Yes, they should be doing that, and many don’t do anything like half of what they owe themselves and their shareholders…but as our 1834 example shows, when you live in a connected world, cyber starts to be more than just my responsibility. If I, as an enterprise, am connected to your network, Mr & Mrs Operator, then you are now part of my overall problem. 

The fact is that cyber is a two-way street. Yes, enterprises need to pay much more attention to the risks to their own business from all this pernicious criminal or hostile state activity, but operators also need to protect the clients that pay for what we sell to them as mission-critical, reliable and safe infrastructure.

That must start with intense work cleaning our own house to close out vulnerabilities that could impact their networks. Think IoT devices and so on: these need to be safeguarded and you must always be able to prove that the smart meter you installed on my behalf isn’t any kind of a back door to the customer database or that my new field sensor does not offer a way in to find names to social engineer attacks against.

Enter, as ever, Brussels (but also Whitehall)

That is a basic commercial and we would argue ethical responsibility. But recent moves by the EU have made this much more of a compliance issue, too. Things like NIS 2, DORA, the UK’s planned Cyber Security and Resilience (CSR) bill and the Cyber Resilience Act (CRA) set out stringent requirements for enterprises as well as providers of critical national infrastructure, and it’s time you stepped up to help—if for no other reason, as is often the way with raising protection for consumers, that you could face punitive fines if you fall short.

The reality is that the cyber problem impacts everyone, and operators need to be aware of their responsibility here. In the next part of this discussion, we’ll dive down into exactly what the new landscape is looking like when it comes to you avoiding you or your client ever being in these grim headlines and statistics.

Part 2 of this conversation starts here...