The IT security landscape has changed dramatically over the last two years: the level and complexity of threat has increased considerably. We are seeing a massive escalation in malicious assaults and the government now categorises cyber attacks as a Tier One threat alongside international terrorism.
With one of the world’s largest networks, BT has firsthand experience of the frequency and intensity of attacks. Every month we block two million viruses and prevent five million suspicious (and 250,000 definite) attacks on our infrastructure.
Sophisticated, multipronged cyber strikes can do serious damage to essential public services, transport, banking infrastructure and organisations of every type. Even sporting events are targets - the security BT put in place for our London 2012 Olympic and Paralympic Games communications network withstood as many as nine million attacks a day. In this environment, everyday local government services are certainly in the line of fire.
The Department for Community and Local Government says: “this is a persistent threat that if left unchecked, could disrupt the day-to-day operations of councils, the delivery of local public services and ultimately has the potential to compromise national security ”.
A tall order
This escalation comes at a time when local government is about to undergo further upheaval. On the back of financial constraints, local government needs IT infrastructure that can support decentralised administration, the sharing of information with other agencies and meet the demand of citizens for 24/7 digital delivery of services.
We know it is a tall order. We’ve found that more than one third (36%) of public sector IT decision makers admit their organisation was hit by Distributed Denial of Service (DDoS) attacks over the past year, with three-quarters (75%) hit more than once.
When it comes to keeping information safe, local government is not a stellar performer. It has been fined £2.3 million for data breaches by the Information Commissioner since 2010. But more power for local authorities will mean more accountability. They will be held to a higher standard. Not only will citizens will take a dim view of seeing council tax revenue spent on fines, but a poor track record on information security will damage reputation and undermine public trust in council governance and services.
Culture + technology = protection
So what’s to be done? In the age of mobility, collaboration and shared resources, we can’t keep data and computers locked away in isolation. Of course, not everything in local government needs the same degree of protection. Planning applications are in the public domain, adoption casework is highly confidential. A good security strategy will recognise the differences and treat them appropriately.
According to the ICO, local authority data breaches are fairly consistent, with “personal information being disclosed in error and lost or stolen paperwork and hardware prevalent” . Until people can easily distribute and share information electronically, working in the way they need to, they will find other ways to do so which open up risk. So that means case notes sent to the wrong fax number. Files mislaid in the office. A smartphone lost at the weekend. Sensitive information exposed unprotected on the internet.
Because it’s also about people, securing your network and assets takes more than technology. To be as safe as possible, organisations will need to combine the right human behaviour and attitude with tough technology protection.
No more DIY
It is not a time for DIY solutions and local government CIOs don’t need to go it alone. They should call in experts in security who can help them properly guard their networks and cloud services against attack with sophisticated firewalls, proactive monitoring and comprehensive threat intelligence to identify and prevent breaches, block malware or denial of service attacks and to ensure that critical public services stay online and available. Using managed security solutions to protect services makes sense and could help to make savings that can be used to keep more staff in front line jobs.
Finally, no-one can afford to underestimate the scale of this problem. Even the smallest local authority is at risk. When it comes to the threat of cyber attacks, we are indeed all in it together.
Neil Mellor, business development director, BT Security
