Digital transformation in the public sector: balancing the risks with data-driven cyber security
The 35 million people who saw Skyfall back in 2012 were in for a treat – thrills, tension, and a spectacular hacking attempt against the UK public sector. While many have picked up on the evident flaws in the Bond version of MI6’s approach to cyber security, the film provokes an interesting reminder that in our rush to digitise public services, there is certainly more to be done in ensuring that these services are secure. Cloud adoption in the public sector has risen to 78% in the UK in 2017 according to the Cloud Industry Forum. This is encouraging in showing that the public sector is moving towards adopting digital cloud-based technologies, but it is debatable whether the current cyber-security protocols are up to date for this new type of environment.
These days most employees in both public and private firms have at least two devices connected to the company network – a personal phone and a work computer, often a laptop. While the organisation itself may have robust network security, with these types of devices, it is very easy for users to download confidential information from a cloud server and then access it while connected to a different, less secure network. In fact, 52% of data breaches are attributed to human error, according to CompTIA.
While organisations can ensure they are educating their employees about the importance of not sharing confidential information over unsecure connections, it can also be useful for organisations to be able to track who has accessed which bits of information in the cloud environment. This is especially effective in monitoring for corporate whistle-blowers, or habitual leakers. Data lineage technology can keep track of who is accessing, copying or changing information, while big data analytics can be used to spot erroneous activity from different individuals or groups within an organisation. For example, if a person is channelling terabytes of data out of the organisation, or repeatedly accessing information that isn’t pertinent to them, the system can spot this and alert management. The advantage of automating this is that the system can scale to detect these types of activity across the organisation, in a way that humans cannot.
According to recent research from Corero Network Security, organisations in the US were hit by 237 DDoS attacks per month on average, during Q3 2017. This represents a 91% increase compared to Q1, highlighting that this ever-popular cyber-attack remains a pertinent threat to organisations both in the public and private sectors.
When it comes to public sector services, the damage that downtime can cause is often not just financial, but can severely hamper essential public services. The 2007 cyber-attacks on Estonia impacted the parliament, several news organisations, banks and presented a major threat to national security on a scale that had previously been unprecedented. As we increasingly digitalise services such as health and transport, it’s not hard to imagine the potential for chaos should a successful DDoS take one of these critical infrastructure networks offline.
However, far from being immitigable, sophisticated real-time mitigation software can make use of big data analytics to identify and block IP addresses making repeat suspect requests.
