University News Last updated 27 October 2015
Cyber-crime will continue to rise unless the government introduces compulsory qualifications for all IT workers, a leading computer networks expert has warned.
David While, Associate Professor in Cyber Security, believes the government must ‘intervene’ to fix a lack of training and education which is needlessly placing sensitive information at risk.
Mr While, who has been teaching students how to prevent cyber-attacks for more than 10 years, said the TalkTalk hack was likely caused by an SQL injection, which was a simple technique and very easily guarded against by those with adequate training.
A string of high profile attacks have taken place over the last few months with TalkTalk becoming the latest victim last week, while adultery website Ashley Maddison was also breached.
Mr While said: “I would suggest that the real problem is that the staff responsible for these sites are not sufficiently aware of the threats and how to mitigate them.
“Requiring people in charge of major IT systems holding sensitive data to have Chartered Engineer status would be a start towards reducing the frequency and impact of the attacks.
“Ultimately it should be a requirement that all people working in the IT industry have a mandatory suitable qualification before being employed.
“Now is the time for the government to intervene and put in place some regulation as there are in other industries such as health, construction and finance.”
With an increasing number of systems being moved online and more data being stored in ‘clouds’ the dangers of cyber-crime continue to rise.
However, at present there are no legal safeguards to ensure those in charge of personal and sensitive data kept on systems are adequately skilled and trained.
“This leads to people being employed who haven’t had the appropriate training and education and being responsible for these major systems.
“We already have several professions that are regulated and require appropriate qualifications.
“The losses associated with cyber-attacks are significant and in line with potential losses from other sectors so why isn’t the IT industry regulated?”