M&S chairman Archie Norman has declared that the º£½ÇÊÓƵ is likely under-equipped to combat cyber threats and must strengthen its security capabilities to attract investment.
Addressing parliamentarians on Tuesday, Norman argued that the º£½ÇÊÓƵ is "just not resourced up to operate at [the US] level, as reported by .
"It's very advantageous if we in this country have leading cyber security experts, because we have a cyber services industry," he stated, suggesting it should be "our aspiration" to maintain exceptionally high cyber standards, top-quality advisers and robust national authorities.
M&S endured a severe cyber assault on April 17th through social engineering methods, with the Scattered Spider hacking collective managing to breach systems and ultimately causing a £300m dent in M&S profits for this financial year.
"It's not an overstatement to describe it as traumatic," Norman remarked. "We're still in the rebuild mode, and we will be for some time to come."
M&S has predominantly restored its online operations, but doesn't anticipate a complete return to normality until August.
"It's very rare to have a criminal act in another country or in this country... essentially trying to destroy your business," Norman observed. "It's like an out of body experience."
M&S chair: 'Assume the perimeter is permeable'
Norman warned that all online enterprises face the risk of a cyber attack similar to M&S's experience. "The right thing to do, if you're in our business, is to assume that the perimeter is permeable. Ultimately, can they get in? They probably can, if they try hard enough," he said.
"You [can] have all the preventions that you should have... double dual factor authentication, password control, everything like that. But this business is to assume that the perimeter is permeable," he said.
The retail sector was hit hard by cyber attacks earlier this year, with the Co-op, Harrods, Dior, Cartier and North Face all reporting breaches or attempted breaches.
During parliamentary proceedings on Monday, Conservative MP David Davis sought an update on the "progress of the government's actions to ensure that blackmailers of this sort do not succeed in future" following an "undisclosed sum" paid by a "major company" to their cyber attacker – though he refused to identify the firm.
Minister of State for Security Dan Jarvis responded that the Home Office "recently closed a consultation into a world leading package of legislative proposals to counter ransomware, and a public response will be published shortly".
Cyber expert Spencer Starkey has cautioned that swift action is essential, given the rapidly-evolving tactics of cyber criminals.
"Threat actors are now exploiting vulnerabilities within 48 hours of disclosure – far faster than most organisations can patch," Starkey said.
