Kennedys responds to a call for views on software resilience for businesses and organisations

The ever-increasing use of digital technologies means that software resilience is crucial in preventing incidents such as the 2020 SolarWinds attack or the discovery of the Log4j vulnerability. While businesses and organisations have made significant progress to address cyber risks, this continues to be a threat to the wider UK economy and the rest of the world.

On 6 February 2023, the Department for Digital, Culture, Media & Sport[i] launched a call for views on software resilience for businesses and organisations.

Kennedys’ cyber and data experts worked alongside our technology arm, Kennedys IQ, to respond to the questions raised in the Government’s survey.

The key points in our response to the call for views included the following:

• Intentional compromises of software code, inadequate incident response and poor supplier management can lead to possible client liabilities, regulator fines or customer attrition, and can therefore have a significant impact on the economy.
• The increasing use of large language models (such as ChatGPT) that can generate long lines of code, will inevitably lead to errors and, without sufficient checks, could exacerbate the issue of accidental vulnerabilities in software code.
• Some vulnerabilities in software code are designed to look accidental, which is why developers should always aim to check the rest of the code to find the potential root cause.
• Software is rarely developed or used in one single jurisdiction and, as such, it is necessary to bring in an international perspective. In addition to an appropriate international standard for software development and adoption, the Government should consider approaching other countries to produce international guidance on incident management.
• We believe that it is necessary for the Government to prioritise cybersecurity awareness and literacy among the wider society. Software users should be encouraged to implement measures that will keep their data secure.
• Finally, any suggested measures will only be effective if they are affordable for businesses and developed with industry experts.

Eleanor Stewart, Senior Data Risk Manager, commented:

Legal director / of counsel* promotions