Cyber Crime
Driving cyber-resilience in public sector IT: practical insight at GOVSEC
Government has a cybersecurity problem. The services it delivers and the data it holds on citizens make it a prime target for state-backed espionage, financially motivated extortion and much more.
Save to Folio
Data from the National Cyber Security Centre (NCSC) cited in a government report last year revealed that 40% of incidents tackled by the NCSC over 2020-21 impacted the public sector.
To find out more, hundreds of cybersecurity and government IT specialists will converge in London later this month for the annual GOVSEC & CyberGov conference. Platinum sponsor Trend Micro will be there to share its vision for a more cyber-resilient public sector.
Government under attack
Digital transformation is a critical task for any organisation. But in government there is an extra urgency to efforts to modernise IT systems and processes. They hold the key to improving service delivery, and enhancing efficiency – especially when it comes to costs. The challenge is that such investments can also unwittingly expand the cyber-attack surface for government departments. Take cloud computing. Managing data across hybrid and multi-cloud environments creates complexity and potential cyber risk, especially when government departments are already short of in-house IT expertise.
Married to the risks presented by the new are persistent challenges associated with legacy, such as IT assets that run on unsupported operating systems. In short, cash-strapped Whitehall leaders have plenty to keep them awake at night. Other security challenges include:
Skills shortages: A recent Public Accounts Committee (PAC) report found that the civil service has less than half the number of digital, data and tech professionals it requires, including “particular shortages” of cybersecurity professionals.
Asset management: National Audit Office (NAO) CIO, Daniel Lambauer, warned last year that “the public sector will need to overcome known legacy and data issues in a situation where IT assets are not always catalogued or risk assessed.”
Supply chain risk: Even if government assets are well defended, the same cannot always be said for its suppliers and partners. Take outsourcer Capita, which receives billions of pounds for running critical programmes for the NHS, HM Prison and Probation Service, the Royal Navy and other government customers. Earlier this year it admitted hackers had compromised client data after an incident in March.
An evolving threat landscape: Threats could range from phishing and ransomware to hacktivism, insider threats and state-sponsored spying. Trend Micro detected more malicious files targeting customers in the government sector than any other last year.
Time for action
In response, Whitehall this year published details of an ambitious multi-year initiative, to be run out of the Cabinet Office’s Government Security Group. GovAssure is designed to build cyber-resilience in government through to 2030 via two pillars and five key objectives. However, the devil’s in the detail. It’s not enough merely to protect systems against attack today—as protection can never be 100% successful. It’s also necessary to enhance such efforts with improved visibility and control—to ensure teams can rapidly detect and respond to breaches in order to contain any threat before they can impact the organisation.
Enhancing cybersecurity posture starts with implementing best practices like prompt patching, good password management, network monitoring and analytics, encryption, and training programmes. But this work needs to be done in a coordinated and strategic manner. What we therefore need to see is a whole-of-government approach which will look to continuously map and manage cyber risk across the entire attack surface. Aligning such an approach across departments and arms-length bodies won’t be easy. But it’s vital to the success of GovAssure.
Trend Micro’s Cyber Threat Intelligence Manager, Erick Thek, will be sharing more thoughts at GOVSEC & CyberGov at the end of the month. To find out more, join us at the show on stand 5 and/or listen to Erick’s seminar, Staying Ahead of the Curve: Navigating Cyber Threat Intelligence in the Evolving Threat Landscape.
What: GOVSEC & CyberGov 2023
Where: Victoria Park Plaza Hotel, London
When: 30 November 2023