Cyber report urges Government to ban 'high risk' companies' services from critical functions

The warning comes in the latest National Cyber Risk Assessment. Stock picture

The Government should pass legislation for powers to ban “high-risk” companies from having their products and services used for critical State functions, according to the latest National Cyber Risk Assessment.

Such entities could be designated as high-risk if they have a “strong link” with the government of a country and there is the potential for “interference” from that country, such as where there are no democratic checks and balances in place.

This recommendation forms part of the assessment conducted by the National Cyber Security Centre (NCSC), which analysed the risks Ireland faces from threats such as espionage and destructive cyberattacks posed by nations, criminal organisations, and hacktivist groups.

Minister of State Ossian Smyth said the cyber risks facing an individual party, an economic sector and the country as a whole are “intertwined with each other”.

“A large-scale digital breakdown post-pandemic could cause more societal harm than it otherwise might have pre-pandemic, further underscoring the importance of robust cyber resilience across all sectors,” he said.

The NCSC said its recommendation is a follow-on from steps already taken by the Government that would allow it to ban companies from supplying technology to critical parts of the next generation of mobile networks where they are deemed to pose a “threat to national security”.

Some states excluding Huawei 

The provisions follow moves by a number of European countries — following the lead of the US and Australia — to exclude Chinese telecoms giant Huawei from supplying critical parts of 5G networks. 

It has been argued that Huawei poses a security risk based on fears that the Chinese state, through its various intelligence services, could force the company to provide it access to the infrastructure. Huawei has long disputed the claims.

The National Cyber Risk Assessment recommended that the communications minister should be able to assess the risk profile of all critical network and information systems and services and have the power to direct that specific entities should not be used in such services. The report suggests that the risks from cyberattacks and cybersecurity incidents are high, and Ireland has seen “first-hand the harm that can be caused”, a reference to the high-profile HSE hack of 2021.

“[However], more often threats in the cyber realm are chronic and pernicious in nature and mostly never make the headlines, while always having the potential to disrupt businesses, public confidence and public services,” it said.

It also highlights that geopolitical tensions across the world have manifested in “increasingly malign assertiveness in the cyber realm”.

The threat from criminals is also present, as “the frequency and the complexity of ransomware is on an upward trajectory” and threat actors are “constantly evolving their techniques”.

What's your view on this issue?

You can tell us here

The report concludes that organisations are being successfully attacked using simple methods and many incidents could have been prevented, or damage mitigated, if basic measures had been implemented by operators, service providers and technology vendors.

“Boosting resilience by raising the cybersecurity ‘bar’ across all elements of the technology ecosystem remains the most effective means of reducing risk to critical services,” it said.