The Threat The Threat n 18. The starting point in developing a cyber strategy for the civil nuclear sector is an assessment of the threat. The Government is clear that there is a credible cyber threat to the UK CNI, including the UK’s civil nuclear sector, and that without mitigation or prevention these threats could lead to potentially serious consequences. aw 19. A number of threat actors including terrorists, hacktivists, criminals and foreign intelligence services can use cyberspace as a means to exploit vulnerabilities and cause damage or disruption. Such disruption could manifest itself in interruption of power generation or the compromise of SNI and other critical information. Technological developments have increased attackers’ reach and made their identification more difficult. dr 20. Cyber threats should not, however, be viewed in isolation. Capable adversaries could also seek to employ cyber methods as part of a ‘blended attack’ to enable or reinforce a physical attack, or to seek to control industrial plant and control systems on nuclear facilities. ith 21. In addition the civil nuclear sector faces cyber risks that are outside of regulation (for example the potential compromise of intellectual property, reputational risk, website defacement). Whilst the potential compromises of this information may not be as detrimental to the UK as a compromise to areas that are regulated may be, it is still important that industry practices good cyber hygiene. This is because there is still potential for a cyber incident to cause significant financial and reputational consequences. W 22. The Government Cyber Security Breach Survey demonstrated the increasing risk that cyber poses. The survey found that 65% per cent of large organisations reported detecting a cyber security breach in the last 12 months, with 25% reporting that they were detecting a breach at least once a month. Cyber breaches are increasingly costly, with the most costly breach identified in the survey being £3m.12 23. The cyber threat is evolving rapidly as technological advancements increase opportunities for hostile actors. Within the next decade, cyber tools and techniques that are presently the preserve of nation states will be much more widely available and the offensive cyber capabilities of state actors will improve. The potential for terrorist cyber 12 https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/521465/Cyber_Security _Breaches_Survey_2016_main_report_FINAL.pdf 11