The Government Cyber Action Plan promises stronger cyber resilience across public services, backed by more than £210 million and a new unit to coordinate risk. This is necessary work. Its first unofficial mission, however, is to persuade every public password that “Fluffy123” is not an act of emotional honesty. It is a cry for help.
The plan includes a Government Cyber Unit for risk management and incident response. That is serious. Meanwhile, the Office of Digital Locks has inspected the staff kitchen router, whose password was “Password”. The router said it felt exposed. Nobody could disagree, although the router did seem to have better risk awareness than several departments.
The imaginary security spokesman Nigel Keypad, Senior Guardian of the Unclicked Link, has a simple programme. Update software. Use strong passwords. Do not open an email called “definitely_not_a_problem.zip”. This applies even when the message comes from someone named IT Support Wizard, whose entire professional strategy appears to be confidence and a colourful signature.
The action plan also promotes better software security practice, including a scheme intended to encourage organisations to follow a Software Security Code of Practice. This should improve protection across the supply chain. An imaginary pilot workshop nevertheless found several important files in a folder labelled “desktop stuff”. The folder has now been reclassified as an active weather system, because nobody can explain where it came from or what it is carrying.
First, one team identified a risk. Next, it fixed the risk. Then, it recorded the fix. Finally, it told the next team where to find the record. The room applauded. One official called the final step “a devastatingly ambitious innovation”. Somewhere, a spreadsheet received a bravery award.
Cyber resilience needs investment, skills and clear responsibility. It does not need a catchy slogan, although the Department of Firewall Feelings has produced three. The favourite is “Think Before You Click”. The least popular is “Be the Patch You Wish to See”, mainly because nobody could decide whether it was advice, a workplace affirmation or a cry from a laptop.
At the launch, every attendee changed one password. The staff kitchen router changed two. It now uses a passphrase. The phrase is apparently secure. It is also 48 words about a goose, which means the nation’s critical infrastructure is protected by literature. The goose has since been promoted to chief information security officer. It cannot remember the password, but it has already rejected three suspicious breadcrumbs.
