My generation’s ‘where were you when…?’ moment unquestionably occurred on the 11^th of September 2001 when the twin towers of the World Trade Center were destroyed by terrorists. The death toll, and the unimaginable suffering of those that perished, are shocking in their own right, but the impact reached far beyond Manhattan. The lives we all live have been to some extent influenced by 9/11.

A week or so before I had arrived in Oman to take part in the largest British military exercise in living memory. I was part of a force of 20,000 troops in holding areas in the southern desert near the border with Yemen. Each unit was allocated a square kilometre of desert to assemble. My Troop had just collected our vehicles and were spending a few days preparing for the exercise ahead. This was a world before smartphones or reliable internet connectivity; this was remote and we felt it. There were welfare portacabins dotted around the desert that provided some access to painfully slow internet, but the nearest to us was a half hour trek across the sand.

I first heard the news by word of mouth. Some of those returning from a mid-afternoon break in one of the portacabins mentioned, almost in passing, an accident in the US involving a light aircraft crashing in to one of the towers of the World Trade Center. Only when I heard the BBC World Service on a shortwave radio a few hours later did I begin to understand the reality was on an altogether different scale.

In the isolation of the desert it was difficult to grasp the full magnitude of what had happened. Nobody had seen any video, nor would we for several weeks, so all we had was the radio reports and some grainy still images. I had visited the World Trade Center several times, so I had a better idea than most what the collapse of those huge buildings could mean, but by evening there was little doubt amongst everyone that something enormous had happened. The talk in the mess tent was of nothing else.

Rumours and speculation spread very quickly. I recall there was an early suggestion that Saudi Arabia and Yemen were somehow involved. Given that we were not much more than 100 miles from the borders of both those countries, their potential involvement was a sobering prospect. I also recall a conspiracy theory that seeped through from the UK questioning why the UK just happened to have its largest deployed exercising force in 20 years camped on the border of those countries in advance of the attacks. On the ground we certainly didn’t see it that way, especially as we didn’t have a single round of live ammunition between us. If anything we felt suddenly very exposed.

The exercise did continue, and my communications Troop deployed onto the training area. Shortly afterwards we received a detachment from 30 Signal Regiment of a satellite ground terminal that connected our command network back the UK. It is incredible by modern standards, but that connection was one of only two providing reachback communications from the deployed Division and its headquarters to the UK. There was clearly going to be some kind of Western military response so communications between the UK and the British force deployed in the Middle East were essential. By holding that link my Troop became strategically critical for a time. In reality this was quite welcome as we were directly ordered not to move or indeed do anything else that might put the satellite link at risk. For around two weeks my Troop of 30 soldiers played volleyball and generally amused ourselves in the desert whilst babysitting a satellite dish and willing it to keep working.

As the exercise drew to a close it became clear that we would not have an immediate role in any military response, and that the focus was likely to be in Afghanistan rather than on the Arabian Peninsula. The fledging conflict in Afghanistan that would define all our careers for the next 15 years was already close to home though, as each night we watched aircraft fly across the clear sky en-route to missions in Afghanistan. By the time we got back to Thumrait to fly home, the airport had been converted from a sleepy airfield to a bustling military operating base. The difference between exercise and live operations was stark.

A couple of years ago I visited the 9/11 memorial and museum in New York. It is spectacular in scale and the tone is well judged. It is the perfect memorial for a tragic event that touched so many lives. Everyone knows the story of how events unfolded that day, but it was clear from the faces and the hushed conversations of those at the memorial that every single person had their own story, and knew exactly where they were on the 11^th of September 2001.

Twenty-five years ago I joined a bewildered gaggle of officer cadets from universities across the UK as we assembled at the headquarters of the Royal Signals for the two week UOTC Basic Signals course. For a fortnight we lived like kings; the luxury of the officers’ mess was a stark contrast to the draughty transit camps we were used to and the food and drink, (which were taken copiously) were several notches better than student Pot Noodles. 

I may have a learnt a little about military communications, but even back then that didn’t seem terribly important. What really mattered was being treated like ‘proper officers’ and members of the club. In the evenings when we gathered under the famous beams in the mess bar, we started a ritual of toasting our good fortune with a rowdy ‘God bless the Royal Signals!’ The phrase stuck – it featured on our end of course T-shirts and for years afterwards whenever I met someone who had been on that course we used it to greet each other.

It is little surprise then that when I arrived at Sandhurst a few years later, I was determined that I was going to commission into the Royal Signals. I was so certain that when I had to submit my mandatory reserve option I was at a loss who to choose. I eventually picked the Royal Artillery as a back-up, but it wasn’t much of a safety net. The first question the senior Gunner officer asked me in the selection interview was ‘why do you want to join the Royal Artillery?’ Slightly taken aback, I replied ‘I don’t, I want to join the Royal Signals’. The interview didn’t last much longer – apparently the Gunners don’t value that kind of honesty!

In December 1999 I did commission into the Royal Signals and I never looked back. I had the best part of 20 incredible years in the Corps during which I travelled the world, commanded soldiers on operations and achieved a Masters degree. In one memorable two-year period I was the operations officer in a Regiment that deployed soldiers on 30 global operations in 24 months. All the while I was fortunate to serve alongside a great bunch of people, born of that same open and welcoming culture I first experienced as a university cadet at Blandford.

Today the Royal Signals celebrates its 100^th birthday. Over the last century it has evolved from playing an enabling, almost peripheral role to now being at the very epicentre of modern military operations. With the advent of cyber warfare the Corps doesn’t simply enable anymore, it delivers real effects. The Royal Signals has never been more relevant.

Looking back from my sandbag, I’m incredibly proud to have been part of this tremendous organisation for nearly 20 years. Here’s to the next 100 years.

God bless the Royal Signals!

Last autumn I ran our SOC’s annual business continuity exercise. This involved decanting our entire operation to an alternate site at a facility provided by a dedicated business continuity supplier. Our contract guarantees short notice and sole occupier access to a large vanilla operations room filled with rows of desks and terminals. Within minutes of activating our gold disk, the machines were transformed from bland blank canvasses to exact working replicas of the machines in our SOC. At the flick of a switch analysts had immediate access to the full range of toolsets, data and intelligence that they have in our primary site. Less than 40 minutes after simulating denial of our SOC, we were 100% operational in a new location with the ability to deliver all of our services.

Even though the exercise went as expected, I still found it an impressive achievement. When things go well it is usually the result of a great deal of work, and this is no exception. Our successful exercise was only possible as a result of years of designing, fine tuning and maintaining a resilient architecture drawing on multiple datacentres and cloud solutions. The business continuity plan is planned in detail, and that plan is reviewed every 6 months to ensure every element continues to be fit for purpose.

The business continuity facility that we use is routinely manned by a solitary manager; for the most part it must be a terribly lonely job and he was clearly glad of the flurry of activity created by our exercise. Out of interest I asked him how frequently the facility is used for real in response to a genuine crisis. I didn’t expect it to be often, but the answer still surprised me. In the 5 years he had been working there, none of his hundreds of customers had ever activated their alternate site for a genuine crisis. Apparently, the vast majority of customers never even test activation, so for the most part he watches over an empty room, waiting for a crisis that, for the most part, never comes. 

But this year a crisis did come, and it was a big one. The global coronavirus pandemic and the subsequent closure of offices meant that business continuity was suddenly front and centre in the minds of organisations of all shapes and sizes. Like everyone else we reached for our process documentation, dusted it down and set about putting our well-rehearsed plan into action. Except it didn’t work. Like virtually all business continuity plans it started with the assumption that our primary office space had suddenly become unavailable to us. It most certainly did not consider the possibility that all office spaces would be denied to us; our alternate site was unavailable for exactly the same reasons our primary site was unavailable.

Immediately we had to scrap the plan and set about writing a replacement based on dispersed local working. Initially this seemed like a daunting task, but it quickly became apparent that producing a workable plan was actually surprisingly easy. All of the design considerations we had made for our original plan meant that we had a fundamentally agile architecture that could be bent to accommodate our new requirements. The same applied to our processes; the fact that we had planned so rigorously meant that we understood what we needed to change in order to work in a novel and alternative way. 

We began looking at this challenge two weeks before our offices formally closed, but within 48 hours we were very confident we could, for the first time ever, seamlessly move a large team that had always been office based to dispersed, remote working. We were right too, and when the day came that migration was seamless with no loss of service to our customers.

Crises are unpredictable by their very nature and, ultimately, they rarely happen in the way planned for. In the end our standing business continuity plan didn’t work, but the lessons we had learnt from our years of planning enabled us to design a workable alternative extremely quickly. Dwight D Eisenhower put it succinctly when he said Plans are worthless, but planning is everything.

I was asked recently to answer some questions about building and running an effective Security Operations Centre (SOC) for a forthcoming article in Infosecurity Magazine. Thinking about the answers certainly helped pass the time on a work trip back from Denmark! Here’s what I came up with:

How important is it for companies to have an effective SOC and why?

Barely a day goes by without the news recording another high profile cyber breach. Such events are expensive, both financially and in terms of reputation. It is a common misconception that cyber-attacks are highly targeted. A few are, but most are not, so organisations of every scale and across all sectors can be vulnerable. No solution provides guaranteed protection, but a holistic approach to cyber defence can radically reduce risk. A SOC is a critical component of any organisation’s cyber defences. When done well it offers 24/7 vigilance and the ability to respond immediately when the worst happens.

What are the biggest challenges to overcome when running a SOC?

There are several, especially when starting from scratch! However I would say the biggest challenge is finding the right people. Security is fundamentally a people business; the right tools help too of course, but having the right blend of skills and experience in SOC analysts and engineers is the most important aspect to get right. Recruiting such talent isn’t easy – the skills gap in this industry is widely publicised – but by using dedicated recruiters who seek out talent, and by developing talent through an apprenticeship scheme, it is possible to build the right team.

What are the key elements of an effective SOC?

I think of a SOC comprising four fundamental and interlinked elements:

People: It is critical to build a team of analysts and engineers who have the skills (and passion) to run an effective SOC.

Tools: Using a blend of industry leading tools and bespoke detection capabilities across the Kill Chain ensures maximum coverage at all stages of an attack.

Processes: The SOC is fundamentally an operations room, and for it to work effectively under pressure and at pace there must be established processes for analysts to follow. Crucially however, these must not be so prescriptive that analysts don’t have freedom to bring their analytical skills to bear.

Threat Intelligence: Intelligence is essential for getting on the front foot. A mature and current understanding of the threat landscape makes the difference between operating reactively and proactively.

If implemented effectively, what impact can a SOC have on an organisation’s security posture and health? 

SOC impact is notoriously difficult to measure, however one approach is to track coverage before and after implementation by employing a recognised industry standard. Using the MITRE ATT&CK framework, I have seen organisations grow from 15% coverage to more than 90% following the implementation of a well scoped SOC. There is a financial impact too. Given the extremely high cost of breaches, it is not overstating the case to suggest a mature SOC can defend against millions of pounds worth of damage.

The requirement for robust and comprehensive cyber security exists across all sectors. Whilst we normally associate the threat to be most acute in finance, government and Critical National Infrastructure, it is increasingly clear that a similar threat exists in what hitherto may have been regarded as ‘softer targets’.

Earlier today, the BBC published an article that revealed both the scale of the threat to Universities and their vulnerability to cyber-attacks. Universities may initially appear to be a low yield target – after all what value is there in an undergraduate essay or the minutes of the Dungeons and Dragons club AGM?

But it isn’t about those things. The targeted and organised threat is geared towards uncovering the vast library of intellectual property that is developed and held by academic institutions. A huge proportion of our nationally important, cutting edge knowledge is contained in red brick repositories. It is easy to see how cyber criminals motivated by financial gain or state actors motivated by industrial espionage would see these as rich pickings.

They are easy pickings too; universities quite rightly foster a spirit of openness and sharing, including in the digital domain. This creates a massive attack surface, which is difficult to mitigate with generally meagre IT security budgets. That is why an intelligent, risk-based approach to cyber security is essential for academic institutions. Only by implementing a forward leaning and targeted approach to cyber defence can the academic sector defend their intellectual property from exfiltration and exploitation.