NAO blog

Middlecolumn

Cyber security: has the pandemic changed anything?

• Posted on January 14, 2022 by Tom McDonald

  

  The start of a new year brings the opportunity to look back and reflect on the challenges we faced in dealing with COVID-19 during the last year. One of the many impacts of the pandemic we did not foresee was moving many aspects of our social and economic life online to try and keep them going through lockdowns. This came with considerable advantages, keeping many businesses, social networks and relationships going. But it also came with a significant downside, as we all became more vulnerable to the risks associated with operating online. In addition to the major attacks like WannaCry and SolarWinds, which have affected organisations in the UK and overseas, it is now increasingly likely that each of us has either personally suffered from some kind of online crime or know someone else who has.

  In its latest Annual Report, government’s National Cyber Security Centre (NCSC) is clear about the nature of the risks we have faced during the pandemic, noting the startling finding that “From household goods to vaccine appointments, there have been few avenues criminals have not tried to exploit”. And the move to living more of our lives online has resulted in some shifts in criminal activity.

  The major trend identified by the NCSC is the growth in criminal groups using ransomware to extort organisations of all kinds. The NCSC describes ransomware as the most immediate cyber security threat to UK businesses: this obviously makes it a threat to the resilience and performance of the economy. But it is also a risk to both central and local government and the wide range of services which they support. So, whether we are taxpayers or service users, we should be concerned at this increased use of ransomware being added to the existing list of cyber threats.

  Unfortunately, the other threats on that list haven’t gone away. The March 2021 Microsoft Exchange Servers incident, in which a sophisticated attacker used zero-day vulnerabilities to compromise at least 30,000 separate organisations, highlighted the dangers posed by supply chain attacks. And there are plenty of examples in the news of other incidents, both malicious and accidental, which have put data, operations and organisational resilience at risk in both private and public sectors.

  In its new National Cyber Strategy, government has set out some of the things it wants to do to make the UK more resilient to cyber-attack. Like its predecessors, the Strategy is painted on a broad canvas, setting out high-level objectives: it says that the UK should strengthen its grasp of technologies that are critical to cyber security and that it should limit its reliance on individual suppliers or technologies which are developed under regimes that do not share its values. These objectives are aimed at the structural factors behind cyber security. And in the meantime, government is developing its Active Cyber Defence programme – which seeks to reduce the risk of high-volume cyber-attacks ever reaching UK citizens – and pressing ahead with other work on skills, resilience and partnerships across different industries and sectors.

  So, it seems clear that, despite the efforts of public and private sectors, the pandemic has exacerbated some of the threats we face online. But one thing that most experts agree on is that our best defence is getting the basics right. Many of the attacks which we have seen during the pandemic could have been avoided if individuals and organisations had followed recognised good practice. This includes actions like implementing formal information security regimes, avoiding unsupported software and adopting good password practices. We have specific guidance to help Audit Committees think about these sorts of issues in our updated Cyber and Information Security Good Practice Guide.

  So, if you are still thinking about your New Year’s resolutions, how about refreshing your cyber security practices? That may help you avoid becoming the next victim of a cyber-attack.

  About the author

  Tom McDonald is the Director responsible for the NAO’s work on cyber security. Tom has worked at the NAO since 2001 and has focused his career on the defence, overseas, health and national security sectors. He has degrees in modern languages, international relations and management from Bristol University and Ashridge Business School.

  Comment on this post...

WannaCry: what does it mean for government?

• Posted on June 23, 2017 by Tom McDonald

  WannaCry, the 12th of May global cyber attack, brought home clearly one of the key cyber security risks to government services: loss of access to data. This ransomware attack didn’t target the NHS, but the NHS was particularly affected by it, causing extensive disruption to patients and healthcare for a week. With digital transformation of public services a key government priority, what lessons from this episode can the government learn to protect public services from cyber attacks? more… WannaCry: what does it mean for government?

  Tagged: Accountability, Cyber security, Devolution, Digital transformation, Fraud and error, IT, Process management, Regulation & consumer protection, Risk management, Skills

  Comment on this post...

Forecasting for ‘Saints’

• Posted on August 17, 2016 by Tom McDonald

  Ever wished to be a Saint – or to visit the world’s oldest land animal: Jonathan, the 184 year-old tortoise? To help the 4,100 ‘Saints’ – the residents of the UK Overseas Territory of St Helena – to become economically and socially sustainable, the UK funded the island’s first airport. But the airport’s opening has been delayed and our investigation highlights the challenges and risks to Realising the benefits of the St Helena Airport Project. This is an unusual and fascinating example of project decision-making. It also highlights common issues about managing high risk projects, potential optimism bias in forecasting, and the challenges of realising project benefits. more… Forecasting for ‘Saints’

  Tagged: Forecasting, Good practice principles, International, Investigations, Major projects, Overseas aid, Project management

  Comment on this post...