Opinion: A cyber-resilient public sector needs investment

Arnie Armstrong, Cyber Security Principal at public sector technology delivery experts, Made Tech, discusses why building a cyber-resilient public sector has never been more important.

Cyber-attacks on local government organisations are happening with increasing frequency. We’re seeing impacts on citizen services and additional financial pressures on a public sector already under strain.

It’s important to note that it’s not just council services at heightened risk. Citizens are being targeted directly under the guise of the cost-of-living crisis, with cyber criminals using phishing attacks appearing to offer council tax or energy rebate payments.

We’re now 11 months on from the release of the Cyber Security Strategy and we need more clarity from the government about how it will bring the public sector together to face these challenges head on.

Cyber Security Strategy guidance

The Cyber Security Strategy launched at the start of the year. It went a long way in identifying the need to share cyber security data and expertise between local authorities and government organisations to have a more streamlined and centralised approach to cyber security risk.

The guidelines to help councils better evaluate their cyber security risks are based on the Cyber Assessment Framework (CAF). This is used to evaluate cyber threats and help organisations determine which objectives they should be working towards.

Although useful, the framework gives no guidance as to how this can be achieved. £37.8 million of additional funding was invested in the 2021 Comprehensive Spending Review to help address the cyber security challenges faced by local government. However, this funding has not been specifically targeted and is simply not enough to challenge the scale of the problem.

The strategy outlines the need for a comprehensive and centralised approach to cyber security risk. But public sector organisations need support and guidance to achieve this goal. There’s no real practical advice for IT teams within local authorities on cyber security prevention and most local authorities won’t have specialist cyber security experts in house. Local government needs a sensible and actionable plan for attaining cyber assessments.

The sharing of data across local authorities could enable a centralised approach to cyber security monitoring and better incident response times. This would greatly reduce costs, ensure quicker remediation and decrease the need for the already-overstretched expert resources within this space.

Local government needs cyber security funding and tech

We’ve recently seen a huge rise in state-sponsored attacks and an increase in cyber crime targeting the public sector. High-profile attacks on councils have demonstrated the severe effects that potential cyber events could have, incurring significant costs for rebuilding the

public service. Cyber attacks may potentially jeopardise essential services like social care and the accumulated funds that support community innovation.

Cyber attacks also damage public trust and credibility in using local services. Citizens are becoming increasingly cautious about sharing personal or payment details with a government organisation affected by a cyber attack.

One reason the government has struggled to get a grip on this increasing risk comes down to funding and technology. Cyber security is expensive business, though the expense is dwarfed by the potential costs of ignoring it. Even so, it’s often well out of the reach of stretched local government organisations. Although central government has taken great strides forward in building a strong cyber security defence, their local government colleagues are at risk of being left behind.

We need a larger funding pot for local authorities, a clearer technical strategy with support from industry, central government organisations and the National Cyber Security Centre (NCSC). This alongside a clear centralised plan to help government organisations share data and expertise will help ensure the delivery of centralised and cost-effective cyber security risk reduction.

Photo by FLY:D