The risk of cyber threats to business is high, but when your stakeholders include citizens, the impact of successful breaches have far wider implications. In the first half of 2019 local councils faced 263 million cyber-attacks (Gallagher, 2020) and the Government sector was found to be the 6th most targeted sector in the IBM X -Force Threat Intelligence Index, 2020, signalling councils are very much in the cross-hairs of cyber criminals. We’ll take a look at the top cyber security challenges facing local government in an already complicated world.
Successful local government cyber-attacks cost the taxpayer and as the saying goes, there are only 2 things certain in life: death and taxes. We all suffer when a local authority falls victim. While data breaches can cost organisations through GDPR-related ICO fines, man-hours, recovery costs and solution upgrades, ransomware attacks can cost even more with no guarantee of data being returned.
In February 2020, Redcar and Cleveland council suffered a cyber-attack that lead to the disabling of their servers for 3 weeks and left 135,000 citizens without online public services. The council reported that the attack has cost them £10.4 million in restoring or replacing IT infrastructure and loss of council tax/business rates income whilst systems were down. In May 2020, 3 months after the attack, it was reported that it had restored 90% of its systems. During this time, the local authority prohibited the use of any council computers, mobile or tablet devices which led to employees resorting to pen and paper which further aided the loss in productivity.
Tighter budgets
The public sector has always had tighter budgets than the private sector and as a result of the ongoing COVID-19 pandemic, local authorities will have even further depleted funds. The Local authority COVID-19 financial impact monitoring information research found that the total income loss to UK councils due to COVID-19 between March-May 2020 was £3.8 billion. The research also found that the additional expenditure of councils due to COVID-19 during the same period was £1.24 billion. This will have a negative impact on local authorities spending in the future.
Being able to ‘do more with less’ will never have rang truer than now, however, the speed of new cyber threats and vulnerabilities can make it extremely difficult to keep pace with fewer resources. In order to extract the most value from existing tools, local public sector organisations need to adopt solutions that will integrate with their existing security environment rather than replace. The key to this cost saving tactic is to identify where your organisation is with your security, where you want to be and how can you fill the gaps. A security assessment and roadmap will provide the information necessary to make smarter and more informed decisions on future security solutions you know you need rather than spending blindly on what you think you need.
Citizens Data is At Risk
Data privacy has always been important and with the enforcement of the General Data Protection Regulations (GDPR) in May 2018, the fines associated with inadequately protecting data can be costly to businesses. Councils have the added pressure of securely storing sensitive data of their most vulnerable citizens e.g. adult and children social care records. This adds extra consequences to potential data breaches in local government.
Whilst a lot of tools aim to identify attacks and prevent network penetration, what happens if a hacker gains access to your system? This is where air gap data backup solutions can play an important part by storing an immutable copy of your data off-site, and out of reach should attackers breach your network.
Security Skills Gap
The rate of new cyber threats has increased the number of cyber security positions with the global information security workforce study suggesting that there could be 100,000 unfilled UK cyber security jobs by 2022. The lack of security roles creates a market where employees can dictate their salary easier and the biggest purse tends to win. Local public sector organisations do not have the large budgets to compete with the private sector in attracting and retaining skilled security professionals, but rather you need to create a better work environment that’s more appealing. Some might see a government job as a more secure option than in a commercial business.
Many local government IT managers have found new security responsibilities have fallen to them and they need to train and upskill to keep up with the latest threats and tools. In-house training can add extra benefits as current employees will have a better knowledge of the council’s IT infrastructure and systems, giving a greater understanding of the threat perimeter as a whole. However, not all organisations have the luxury of time or resource to train their IT staff and that’s where a Managed Security Service Provider (MSSP) can fill those skills gaps, becoming an extension of a council’s Security Operations Centre (SOC).
It is evident that public sector organisations are still a sought-after target for cybercriminals and the COVID-19 pandemic will affect IT budgets. It’s important that you assess your current security posture for any gaps and then decide on the right security tools to help reach the level of defence you strive for. Working with an MSSP can help with the initial identification of weak areas and they can even help plug your security skills gaps should they be needed. You can’t fix what you can’t see, and prioritising vulnerabilities will enable councils to do extract greater value from their reduced budgets.
You can download the eBook here