Terry Storrar 09 April 2019

How local authorities can minimise the risk of data breaches

Data breaches are catastrophic for any industry, but particularly in local authorities where consumer trust is paramount. Britain's local authorities have been hit by almost 100 million cyber-attacks in the last five years, while one in four councils’ systems were successfully breached.

Councils are now using an increasing range of technologies, from apps and the cloud, to different devices and gadgets and with this the risk of a breach increases.

Whilst it is not possible to prevent all breaches, there are certain steps which can be taken to minimise risk:

Always vigilant

Vigilance should be an essential part of an organisation’s strategy. Authorities should be working with an IT managed service provider to ensure that they are always following up to date best practice guidelines and pro-actively questioning the set-up and the associated risks. A Managed Service Provider has the benefit of working with various organisations that span many verticals and this breadth offers many proactive benefits and insights into attacks and fixes. It’s also important to design a business continuity plan to ensure the minimum possible exposure to risk and a guaranteed successful recovery point both in time and data.

Any business continuity plan needs an executive owner/sponsor who has the experience and authority to get things done in a timely and processed manner. All action plans should be regularly reviewed at board level and shared with all stakeholders so that all the risks and organisational implications are visible and planned for to avoid the plan’s implementation being hampered by budget or knowledge constraints.

Data classification and encryption

Local authorities should take steps to classify their data in accordance with its sensitivity relative to a potential breach. There is no doubt that classification of data can help deliver tangible benefits such as reducing risk, while at the same time ensuring compliance with key industry regulations. The most sensitive data should have the greatest protection layers and encryption around it, with access level policies in place.

Examples of this data could be electoral information and residents’ financial information. Were this data to be breached it would present significant risk and all measures should be taken to ensure this data is inaccessible. It’s also imperative that all employees within the organisation are familiar with how the data is classified and protected to ensure they are all conscious of their own security levels. This can help to provide an early warning system of a potential threat caused by human error.

Software management

There are numerous entry points that are vulnerable to intrusion and you should make sure you are applying the latest software patches. After all, it is as important for vendors to keep their software free from bugs as it is for you, so always make sure you do not ignore patches. Organisations should apply patch updates regularly or deploy technology which removes the need for manual updating. This technology works by automatically identifying vulnerable applications and deploying the latest updates as they become available.

Employee engagement

Every local authority should have a process in place that involves the regular review of cyber security risks from C-suite level down to the rest of the organisation. It is important to remember that most security breaches are due to human error, with the wrong recipient for an email accounting for many of the security breaches. This highlights the importance of well-informed staff in avoiding a threat to an organisation’s IT systems. Employees must be regularly trained on any infrastructure or technology that is put in place to address cyber security.

The technology used to protect an organisations data is only ever as good as the people that are using it. Clear and precise usage guidance is imperative to minimise the chances of human error.

Top down security culture

Fostering a culture of security can significantly reduce an organisation’s risk. CIOs and CISOs need to ensure that every employee within the organisation is aware of the threats they could face, whether it’s a phishing email, sharing passwords or using an insecure network. The cyber security landscape is continuously changing with hackers finding new ways to access information. Hence one-off training sessions will not suffice creating a culture of consistent awareness of threats is required along with a robust security and continuity plan throughout the business.

For local authorities the threat of a data breach has never been more real. Due to the sensitive nature of the data which they hold, these organisations will continue to be a primary target for hackers. Whilst an attack cannot be fully prevented, by taking control of its security solutions and fostering a culture of continuous security awareness, local authorities can reduce the risk of becoming the next big headline.

Terry Storrar is director of managed services at MCSA

Creating net-zero public engagement image

Creating net-zero public engagement

Local Climate Engagement is a project to support local authorities or partnerships to plan, commission and deliver high quality public engagement in how best to reduce carbon emissions. Sarah Allan explains.
For your free daily news bulletin
Highways jobs

Senior Practitioner – Family Assessment Centre

Haringey London Borough Council
£43,860 – £48,819 per annum
This post is part of a specialist team working as part of the internal resource for... Haringey, London (Greater)
Recuriter: Haringey London Borough Council

Leader's Office Manager

Royal Borough of Greenwich
£40869 - £43860 per annum + n/a
Help us make Royal Greenwich a place where everyone can succeed and prosper. This interesting and unique job carries responsibility for managing the o England, London, Woolwich
Recuriter: Royal Borough of Greenwich

Social Worker – Family Assessment Centre

Haringey London Borough Council
£33,418 – £44,860 per annum
This post is part of a specialist team working as part of the internal resource for the conducting of... Haringey, London (Greater)
Recuriter: Haringey London Borough Council

Service Development Manager – Waste

North Yorkshire County Council
£39,880 to £43,857
As our Service Development Manager your core focus is to drive service improvement by seeking out opportunities for the County Council in... North Yorkshire
Recuriter: North Yorkshire County Council

Children's Services – Advanced Practitioner (Team Based)

Lambeth Council
We are looking for reflective, dedicated social workers Lambeth, London (Greater)
Recuriter: Lambeth Council

Public Property

Latest issue - Public Property News

This issue of Public Property examines how how flexible workspaces can lead the way in regeneration for local authorities, Why local authority intervention is key to successful urban regeneration schemes and if the Government’s challenge of embracing beauty is an opportunity for communities.

The March issue also takes a closer look at Blackburn with Darwen Council's first digital health hub to help people gain control over health and care services.

Register for your free digital issue