Public sector organisations the world over have been the focus of a number of high-profile hacking attacks in recent months. Victims include the CIA, the EU and the US Senate and, closer to home, Britain’s own Serious Organised Crime Agency (SOCA).
“Government hacking is taking place right now behind the scenes,” announced a recent tweet from LulzSec, which claims to be the ‘hacktivist’ group that brought down the CIA’s website, and that used a denial-of-service (DoS) attack to overload the SOCA website with web requests until the organisation had to take it offline.
Vulnerable systems
In spite of all the horror stories about the stealing and leaking of confidential information, we still come across quite a number of public sector organisations that have yet to protect the sensitive data they hold – including email addresses, passwords and phone numbers – from cyber-attack. The NHS is just one high-profile example – LulzSec recently brought the weaknesses in the NHS’ networks to the public’s attention.
Public sector organisations’ failure to make their networks less vulnerable is particularly surprising, considering how easy it is to implement security measures, and considering how security budgets seem more or less to have survived cuts. In some instances it might just be that these organisations have too many priorities to consider, and not enough time in which to consider them all. In any case, many fail to take the action needed to protect their systems.
The cost of inaction
But there is much to gain and nothing to lose in being proactive about data security, in addressing weak password policies, un-patched systems, or badly configured firewalls and intrusion prevention systems.
If delayed action is just a question of timing, public sector organisations should weigh up the pros and cons of acting immediately or acting later. It makes a lot more sense to take preventative measures now than to wait for the worst to happen. The fallout from a hacking attack can be more than a little damaging: negative publicity, unwanted media attention, the cost of mending a shattered reputation, and the possibility of being fined thousands (one council recently paid £120,000) by the Independent Commissioners Office (ICO) for breaching the Data Protection Act.
Prevention is better than cure
Waiting to get hacked isn’t a viable option. Prevention is better than cure, and methods of prevention are cost-effective. Penetration testing is particularly effective in establishing which areas of an organisation’s security are vulnerable. The procedure involves checking the internal and external infrastructure, including web applications, and attempting to gain unauthorised access. Some organisations have an engineer turn up unannounced and try to gain access to the network under false pretences.
It is often surprising to see which assets are publically discoverable, but once you have identified where your network is strong and where it is exposed, you will know that the changes you implement will actually make a difference. A good engineer will leave you with instructions on how to check the network yourself for future reference.
In the process of securing their systems, public sector organisations should ensure that their internet access is controlled with an intelligent web solution, that they are aware of all the applications running on their networks, and that they have appropriate spam controls in place. Naturally, they should also ensure that they comply with all the relevant regulations.
Secure data
There have been many embarrassing, damaging headlines in recent years about public sector data leaks. Missing laptops and memory sticks are just one small part of a huge data security problem that it is in everybody’s interests to address. Data security providers can help to implement security at the device level, the network gateway level, and at the level of the client device within the secure network, so that a public sector organisation and its data are protected when the next hacktivist strikes.