Article 5 Public Sector Security Concerns
By Insight UK / 22 Oct 2020 / Topics: Cybersecurity
By Insight UK / 22 Oct 2020 / Topics: Cybersecurity
Technology is helping to solve public sector challenges by offering remote collaboration and communication solutions. Cloud-based technologies allow many organisations to centrally control and implement cyber security processes while scaling their technological needs with budgetary constraints.
To adapt to new operating environments and maintain scalability objectives, many Public Sector customers are using the events of 2020 to rationalise their IT processes while implementing network security enhancements.
As both a direct and indirect result of the events encountered during our transition to remote working and segregation of physical duties, the five critical risks that are impacting the public sector today are as follows:
Data security is a primary focus for more than eight out of ten public sector agencies and this reflects a general global trend within both the public and private sector. As new hardware was procured, new operating models were implemented and increased BYOD/MDM security factors became prevalent, with our global focus turned to securing our data first.
As data protection regulations are strengthening around the world, government agencies face the need to be a model of establishing a proper data security strategy for other businesses who are subject to the regulations, accreditations and equally the fines levied by these very organisations.
All public sector departments now understand that if they do not prioritise data security, they will inevitably suffer breaches and in many scenarios significant fines. Ultimately, this will result in reputational damage, a loss of trust from customers and importantly central government led security bodies. Critically this could lead to a direct breach of regulations such as GDPR and hold commercial implications - not just in the form of fines - but also the possibility of future funding reduction.
The good news however, is that as the private sector faces the same fundamental evolution of security focus on data itself, the security solutions available to the public sector benefit from significant economies of scale when architected correctly.
Cloud technologies, particularly those specifically designed and commercially modelled for government organisations, have an extremely high level of cybersecurity features in place and provide constant monitoring to ensure data is protected. The security measures in place for a government cloud solution are undeniably more advanced than a single government agency in-house implementation.
However, cloud remains a significant cybersecurity concern to the Public Sector. Organisations require a cyberspace that meets the compliance and requirements for government compliance such as Cyber Essentials (and CE+), GDPR, Public Sector Network and PSN code of connection.
The irony of this resistance to a move to the cloud due to security concerns is that legacy IT is unquestionably much more difficult to centrally monitor, analyse and defend. A Public Sector executive order issued last year stated “the executive branch has for too long accepted antiquated and difficult-to-defend IT.”
In the public sector, as in the private business sector, cyber threats are increasing in complexity and intensity. For example, there have been more than a million different ransomware attacks over the last year. Some experts estimate that there are as many as 60,000 new ransomware variants in a single day.
The potential liabilities of such breaches pose a significant concern to the public sector as a whole, recent examples of the level of impact are as follows:
Targeted cyber-attacks on the entire public sector since the start of lockdown has been a particular problem. Government agencies around the world, including the UK’s National Health Service (NHS), fell victim to the WannaCry ransomware attacks and their resurgence in new forms. In fact, we can identify a more than 900% increase in cyberattacks on the public sector since 2019.
A general and widespread lack of awareness among public sector employees around cyber security is rendering the Public Sector as a whole vulnerable to ransomware and other forms of cyber-attack, according to recent research. With the current pandemic giving rise to increased cyber-attacks alongside the new remote working profile, the current environment justifies a laser focus on the most prevalent public sector security vulnerabilities. When we start to transition back to our new operating structures post-pandemic, local government and the wider public sector will be under mounting pressure to maintain public services whilst remaining secure.
The rate of new cyber threats has increased the number of cyber security positions with the global information security workforce study suggesting that there could be 100,000 unfilled UK cyber security jobs by 2022. Local public sector organisations do not have the large budgets to compete with the private sector in attracting and retaining skilled security professionals. As a result many local government IT managers have found new security responsibilities have fallen to them and they need to train and upskill to keep up with the latest threats and defense techniques as well as the associated tools to support these efforts. The layering of costs to not only resource the security team, provide and maintain the tools necessary to undertake these functions as well as maintain skillsets and external certifications create a scenario which is unlikely to be deemed commercially viable.
The solution to this growing problem is increasingly an outsourcing of security skills, monitoring, analysis and mitigation via a Managed Security Service Provider (MSSP), becoming an extension of a council’s Security Operations Centre (SOC).
It is evident that public sector organisations are increasingly a prime target for cybercriminals and the recent pandemic will inevitably impact IT and specifically security budgets. In helping Government departments to assess their current security posture for any gaps and then select the most effective and efficient security tools an MSSP essentially becomes a trusted security advisor. With a customer centric approach to the initial identification of vulnerabilities and risks the MSSP can even backfill security skills gaps should they be needed.
All businesses deal with budget constraints, however the public sector is continually accountable to stakeholders and must adhere to their directives. It is not uncommon for public organisations to sustain budget cuts on a regular cycle and historically cyber security budgets have tended to be one of the first to be cut. It is human nature for us not to recognise the value of an investment until it is being tested:
"Security is always too much until the day it is not enough"
William H. Webster, Former Director, FBI
Again, outsourcing or creating managed security service modules enables the public sector to determine and implement clear, comprehensive security solutions which map to their desired security posture, while avoiding the common pitfalls of traditional security investments in siloed products.
Why not read 'Public Sector Security Challenges In ‘The New Normal’?
