5 minutes reading time (1008 words)

Key findings and recommendations from the cyber security discovery

The Local Digital Collaboration Unit Cyber team has come to the end of a two-month discovery into cyber security at local authorities.

The purpose of the discovery was to investigate how MHCLG might support local authorities to reduce the incidence and impact of cyber attacks, and support sustainable cyber health.

During a short exploration phase earlier this year, the team sought to understand the wider cyber security landscape within government, including what support is available and who provides it, while gathering evidence from councils and stakeholders. We were then able to identify three key themes and assumptions to focus on during the discovery:

Secure by design - could vulnerability to cyber attacks be reduced if local authorities built, planned and maintained services in a secure manner? Standards and guidance - would cyber security risk decrease at local authorities if they subscribed to clear standards, expectations and goals? Roles, responsibility, accountability - would cyber security risk be reduced if the behaviours, ownership and responsibility for cyber health at local authorities were improved?

You can read more about the goals and outcomes of the pre-discovery work on the MHCLG Digital blog, or download the full pre-discovery report (PDF).

What we’ve done during discovery

A diagram to demonstrate the break down of user research participants, we conducted 37 virtual user research interviews across 7 different role types, engaging with 27 different organisations

This diagram shows the breakdown of user researcher participants that were interviewed as part of this cyber discovery work

Over the course of 8 weeks, the team has:

conducted 37 virtual user research interviews across 7 different role types, engaging with 27 different organisations reached out to several other government departments that deliver cyber security programmes, including NHS-X, NHS Digital, MoJ Digital and the Scottish Government, to share our learning and to learn from their experience analysed the impacts of previous malicious cyber attacks using case studies and cost data conducted two workshops with key stakeholders in order to explore ideas and solutions from key experts in the industry refined the three prioritised themes from pre-discovery: ‘Standards and Guidance’, ‘Ownership, Responsibility and Accountability’ and ‘Secure by Design’ held a systems thinking session with the Government Security Group (GSG) and Local Government Association (LGA) to explore causal links between people, process and technology in a complex context of cyber security and local government Created a detailed proposal for technical remediation activity for selected “at risk” councils highlighted in the ransomware survey (a survey we sent to councils to understand their risk and mitigations against a ransomware attack)

To make sure our work is visible, we held fortnightly Show and Tells, published updates in sprint notes, and met with people across Government (and other interested parties) to share our work.

Join the last #LocalDigital cyber security show & tell tomorrow for an overview of our findings and recommendations from the discovery.

📅 31 July, 11.30am-12pm

Request to join 👉 https://t.co/Ft3qjhws3V pic.twitter.com/NZYmrkd1mr

— Local Digital UK Gov (@LDgovUK) July 30, 2020

What we discovered

Building on the work completed during pre-discovery, we were able to gain a clearer picture of problems and opportunities. 

 These are some of the key findings that came out of the discovery:

There are many cyber standards, but no clear baseline. An effective cyber baseline must encompass culture, leadership and ‘cyber first’ processes. Leadership support is vital to embed standards and best practices across the organisation. Leaders need to understand cyber risk to inform their decisions.  Legacy technology is a critical blocker to achieving cyber health.  There is an opportunity for councils to collaborate in order to achieve greater security.

Through our research it became clear that, while councils are doing the best they can with the resources and knowledge they have, there are a number of areas in which MHCLG might provide support.

Quote: People see everyday work as more important, but don't realise that cyber is part of everyday work.

A quote from a user research participant

What happens next

After having researched the problems and challenges that local authorities faced in improving their cyber security, we sought to generate holistic solutions that solve the largest amount of pains. Through a series of workshops with stakeholders and local authorities, we identified the main areas of focus to solve the known problems. We then selected the top five areas of opportunity for MHCLG and key stakeholders to progress into alpha

Cyber Health Framework - develop a framework of cyber security standards and guidance that organisations can apply in order to achieve a minimum level of cyber health and measure where they are against this baseline Cyber Roles - formalise the role of the decision-maker for cyber security at the executive level within local authorities, with clear lines of communication to that person Peer Support - explore how to formalise a professional network for cyber security professionals from local authorities and create  a trusted ‘safe space’ where peers are able to share and learn  Training and Support - provide a range of training that fosters cyber responsible attitudes and behaviours  Technical Remediation - provide support to councils identified through the recent survey on mitigating malware and ransomware

We are currently submitting bids to secure funding for the continuation of this work. Some of the work will be owned and carried out by MHCLG directly and some we will look to collaborate with stakeholders and leaders in this space on. We want to continue our collaboration and research with local authorities in developing the cyber framework and to continue to test our findings and recommendations using a user centred and evidence based approach.

We will look to support the councils identified as “at risk” in the ransomware survey as an immediate action.

If you have any questions about the report or our findings, please email This email address is being protected from spambots. You need JavaScript enabled to view it..

Follow Local Digital on Twitter or Medium for more updates on our cyber work.

Original author: Local Digital Collaboration Unit
Creating a framework for designing consultations  
Two years of fixing the plumbing: celebrating ‘Dig...
 

Comments

No comments made yet. Be the first to submit a comment
Already Registered? Login Here
Guest
Thursday, 24 June 2021
If you'd like to register, please fill in the username, password and name fields.

By accepting you will be accessing a service provided by a third-party external to https://www.wiggywam.co.uk/

Random Posts

08 January 2021
UK Government News
mrmohock/Shutterstock.com 1. Our infrastructure drives economic growth ZGPhotography/Shutterstock.com HM Land Registry safeguards land and property ownership across England and Wales worth more than £...
17 November 2020
UK Government News
Trismegist san/Shutterstock.com A few months ago I wrote about the inconvenience and inconsistency of manually verifying a client’s identity – inconvenience for both lawyers and their clients. Along w...
06 May 2021
UK Government News
My name is Aishah and, after graduating from university, I joined HM Land Registry in January 2021 as a trainee Registration Officer in Coventry Office. Right from the get-go HM Land Registry has been...

Top Articles

29 March 2020
Experts Corner
Einstein once famously said, "The definition of insanity is to keep doing the same thing, over and over again, expecting a different result". Less infamous, yet still a quote by Einstein is; "The diff...
29 March 2020
Experts Corner
This guide has been compiled from years of experience in various sectors of the property industry, from estate and letting agency, surveying, property investing as well as training and mentoring many ...
16 December 2019
Latest platform updates, features, tips, tricks and tutorials to help you get the most out of WiggyWam
There are a number of providers offering virtual tours/3D modelling but the one that stands out for us is Matterport. They have been around for a while now and just get better. Mat...
No Internet Connection
0
Shares
Cron Job Starts