10 Questions on Cyber Security

CfGS exists to promote better governance and scrutiny, both in policy and in practice. We support local government, the public, corporate and voluntary sectors in ensuring transparency, accountability, and greater involvement in their governance processes.

Governance and scrutiny are essential for the successful working of any organisation. Now, more than ever, trusted decisions are needed. We believe that decisions are better made when they are open to challenge and involve others – whether that’s democratically elected representatives, those affected by decisions, or other key stakeholders.

At the heart of better governance and scrutiny are the right behaviours and culture. Our work champions these relational aspects and designs the structures to support them, leading to more effective decision-making and improved outcomes for organisations and people.

What has already been done in relation to cyber security in your council and are you using or aware of the National Cyber Security Centre (NCSC) Active Cyber Defence tools and services?

A good place to start in terms of examining cyber security practices, policy, and procedures in your council is to determine what is currently implemented. Some questions scrutiny may wish to ask, as a starting point when looking at cyber security, could be:

• Does your council have a cyber security strategy? If it does not, does your council have a digital strategy and does cyber security form a clear and defined part of this?
• Do you know who has leading responsibility for cyber security in your council – members, corporate leadership and ICT.
• Which scrutiny committee(s) oversees changes and holds to account on the matter of cyber security?

CfGS has found that members of scrutiny committees may not be aware of what councils are already doing on cyber security. There are multiple reasons for this, including:

• a lack of awareness of the threats
• consideration that the subject is purely technology-led
• high member and chair turnover preventing learning.

Whatever the reason, members should establish a baseline of knowledge about the fundamentals of council policy and approach in this area. It is useful, especially during research, for the scrutiny function to be able to understand the attitudes and culture within the council about cyber security, as it will inform any work that needs to be undertaken.

Furthermore, the NCSC has a wide range of tools and services that your council should be aware of and ideally engaging with. Their Active Cyber Defence tools seek to reduce the harm from commodity cyber attacks by providing vital tools and services. You can find out more on the NCSC website.

How can the organisational leadership and the cabinet and executive effectively incorporate cyber security into the council’s central objectives?

Cyber security cuts across all council department and functions. If an attack were to occur, there is the potential for every aspect of your council to be affected.

One councillor that we spoke to as part of our evidence gathering exercise advised that, when their council fell victim to a cyber attack it was akin to having an epicentre that continued to ripple out. They stated that it caused months of disruption, systems had to be rebuilt at the cost of millions of pounds. Most importantly, it directly affected residents. As example, resident’s benefits were not paid to landlords. Because of the potential scope of impact, leadership must be engaged with the challenge, and must possess sufficient understanding to be effective.

Why is cyber leadership important?

Achieving assurance around cyber security arrangements should be a part of the council’s central objectives and be a feature of the council’s overarching strategy.

Ultimately, the leaders and executive set and promote the culture and values of the council. Cabinet and the political leader also set the work programme, leading the direction for policies and practices for the municipal year. From a leader’s perspective, cyber security should be an element within that programme, a running thread pervasive through all departments.

Achieving assurance around cyber security arrangements should be a part of the council’s central objectives and be a feature of the council’s overarching strategy.

Leaders across the council must collectively ensure that cyber security risks are identified as routine and managed appropriately, minimising risk. Whilst the technical elements of cyber security are likely to be implemented by trained officers, the risk is to the organisation and its departments, whose leadership are, in turn, responsible.

Relevant training for officers and members is vital. Promotion of the importance and dangers of cyber threats is crucial.

Political

The prioritisation of cyber security can be politically contentious. In terms of spend, leaders and cabinet may be hesitant to allocate significant portions of money and resources to cyber security needs. However, the costs if a cyber attack does occur can be devastating, therefore it is important to consider investing in this area. It is true that some solutions to cyber security issues will require investment in technology. However, pragmatic and forward-thinking solutions may also offer opportunities for cost savings and improved delivery in the short, medium or long term.

Selling the need to constituents to invest in cyber security may be a challenge. We spoke to councillors who advised that, on the doorstep, it was difficult to convince that funds need to be input into cyber security and related back-office staff and infrastructure, with some constituents seeing this as additional bureaucracy and a waste of public money. Public education has a vital role to play, and it may be wise to consider this within the overall cyber security strategy. Public views will shift swiftly in the aftermath of a successful cyber attack.

Within the local public sector, cyber attackers do not discriminate along political party lines, and as such there is a benefit in seeking cross party consensus with regards to proactivity on cyber security. We also noted comments from councillors in the opposition that they felt ‘out of the loop’ when a cyber attack did occur, losing the opportunity to understand both the reasons for the attack, and to contribute to lessons learned.

How does scrutiny play into this?

The role of scrutiny is crucial regarding cyber security and leadership. Scrutiny committees have the power and influence to help to guide the leadership on this matter and effectively hold it to account.

If a council has more than one scrutiny committee, it may be wise for cyber to be placed under the remit of one committee for purposes of co-ordination. The committee can then give the matter full focus, and carve out clear roles and responsibilities. Understandably, there will be a large volume of work passing through scrutiny, however cyber security is sufficiently pervasive to require ongoing conversation. Threats and risk postures change over time, they need to be considered and relayed to the leadership.

There are several questions that scrutiny can ask in relation to cyber security and leadership:

• Who has responsibility for cyber security in the council, inside and outside of ICT?
• Do the leadership have the necessary tools and knowledge to effectively make decisions on this matter?
• Are the leadership performing due diligence on the matter of cyber security?
• Is there an understanding that cyber security risk can affect all council departments and that the risk cannot be eliminated, but can be minimised?
• Is cyber security incorporated into the council’s central objectives and will this be a topic that is continually reviewed?
• Is there sufficient transparency on this matter?
• Do members receive regular cyber security updates from senior officers and leaders – including on threats, incidents and near misses?

How does the council have confidence that members and all staff members have the skills and knowledge to understand and play their part in action on cyber security?

Cyber security can appear quite an intimidating topic due to a focus on technical components. However, Members need not have technical expertise in the subject of cyber security to have an overall awareness of the issue and to begin incorporating approaches into their council’s strategic plans. That said, the need for training is important, so that members and officers have a basic understanding of the threats that face their organisation and how they can reduce the risks to an acceptable level.

Specific training opportunities are available for members, together with useful publications such as the LGA’s ‘Councillor’s guide to Cyber Security’. The LGA also run regular events on this topic for a range of officer and member audiences. These can be found on the LGA events page which is updated regularly.

Many councils also conduct regular or annual cyber security training. This is vital for members to take as well as officers and offers the additional benefit of understand the baseline being provided to all staff. Training regarding cyber security ought to be an ongoing priority as the threat is continually evolving. It should not only inform on organisational policy, but should also educate on the nature of the threat, personal responsibility, and the need to highlight vulnerabilities where present.

To supplement basic training, many councils will provide department specific training (e.g. in areas where sensitive data is handled), or undertaken wider training programmes, such as sending fake ‘phishing’ emails to employees. In this case, if an employee does not recognise a faked e-mail, there is opportunity to ensure that they receive additional education to understands what to look for in future.

It is also important to ensure that technical officers have the right skills and knowledge pertaining to cyber security, so they may play their part in minimising the risk of threats and identifying vulnerabilities.

In terms of the scrutiny function, there is a crucial part to be played in relation to examining the effectiveness of training, determining any gaps barriers to learning, for both members and officers. As example, scrutiny could ask why training has not taken place, or why it is not considered a priority.  As with all queries in this area, members of the scrutiny committee should consider utilising the knowledge of technical expertise from within the organisation where assistive.

Additional questions you may wish to ask in terms of training and cyber security:

• Is training sufficient?
• Does it take account of the risks and threats to our organisation?
  • Does it inform learners of our policies and expected behaviours?
  • Does it encourage disclosure of security concerns and vulnerabilities?
  • Is it revised to take account of new risks, threats and responses?
  • How is training re-enforced? Re-training, supplementary training, etc?
  • Is training mandated? What targets apply to training?
• Does my council seek out, and utilise the learning and tools published from within the sector and authorities such as the NCSC?
• Is there a disparity in knowledge and awareness between officers and elected members; if so, how can this be addressed?
• What are our organisational barriers to learning about cyber security?
• How well connected is my council with those who have developed good practice in this area?

Information about training by the NCSC can be found on the NCSC website.

How can the scrutiny function be more proactive on the issue of cyber security?

As discussed previously, cyber security arrangements need to be continually reviewed and monitored as threats change and evolve. Therefore, proactivity on this matter by the scrutiny function is critical. Policies and practices need to be reviewed on a regular basis to ensure that risks are reduced. The scrutiny function has the means to hold the executive to account on these matters, considering whether there are potential gaps and/or inaction on cyber security policies.

Frameworks

The use of assessment frameworks can be assistive in determining the posture of the council against good practice, and indeed there may already be artefacts in place from annual compliance exercises which your council may be required to undertake, for example:

• The Data Security and Protection Toolkit (DSPT, NHS Transformation Directorate) requires an annual self-assessed return for councils in England who work with NHS originated healthcare data. The return is focused on the NHS National Data Guardian’s 10 data security standards^[12]., which include valuable ‘good practice’ requirements in relation to Cyber Security.
• The Public Services Network (PSN) IA Conditions. The PSN is a pan local government network to which most councils will be connected. An annual return, signed by the Chief Executive and stating security practices is required, as well as technical testing to determine IT vulnerabilities, plus a remedial action plan to manage them.
• The Payment Card Industry Data Security Standard (PCI DSS) are a set of security standards designed to ensure all those that accept, process, store or transmit credit card information maintain a secure environment^[13]. If this applies to your council, more information can be found on the PCI Secruity Standards Council.

As Asset Management is a cornerstone for other areas of cyber security, does the scrutiny function have confidence in the current asset management system in that it adequately supports delivery of services and other important operational matters?

Assets, in the context of asset management, are defined by the NCSC as anything that can be used to produce value for your organisation^[14]. For context, in terms of assets that relate to cyber security, these include information, such as customer data and types of technology, IT hardware including laptops, smart phones, and tablets as well as comprising  operating systems, network resources, software licenses and applications. With that said, the definition of asset management can vary, it can be information assets, technical assets or both. Scrutiny needs to understand the nuances of this.

How can scrutiny add value in terms of ensuring that cyber security is effectively considered as part of your council’s risk management procedures?

What is risk management and how does this relate to cyber security policy?

“Risk management enables organisations to ‘create plans for the future in a deliberate, responsible, and ethical manner. This requires risk managers to explore what could go right or wrong in an organisation, a project, or a service, and recognise that we can never fully know the future as we try to improve our prospects”’^[17]

Or, in simpler terms – risk management enables us to make plans and increase the likelihood of their success by avoiding threats. Robust considerations of risk focused on cyber security “ensure that risks to essential services are identified, assessed, prioritised and managed in line with the council’s defined risk appetite’^[18]. This leaves a number of areas to consider:

Cyber security risk governance:

• Risks, and the processes used to manage them will differ from council to council – however, it is vital that there are working processes in place to identify, evaluate and manage risk across the organisation.
• Cyber security risks and IT risks should be governed in the same way as other business areas, to ensure they are linked in with your organisational goals and strategy. However;
• Your council will need to invest time and energy in ensuring that resources are available who can assist in determining cyber risks and approaches to their management to ensure effective governance.

 Cyber security framework:

• Your approaches and efforts to maintain cyber security should be traceable back to risks which require management.
• Knowledge and awareness of those risks and threats should be communicated between departments and relevant stakeholders to validate that approaches are well considered and effective in all necessary areas.
• Policies and procedures should also be founded on and linked back to the management of risk, as well as leveraging opportunities where beneficial.

Cyber security risk assessment:

• Risk assessments will need to be undertaken by your council, supported by appropriate knowledge and information, to recognise and understand the nature of risks and pinpoint vulnerabilities.
• Risk assessments must be seen as an ongoing process – the nature of risks, threats and vulnerabilities changes on a daily basis.

Cyber security risk treatment:

• Risks should be treated or avoided by implementing appropriate management controls, in adherence with the council’s wider risk management policy.

Scrutiny committees have an important part to play in terms of considering the council’s cyber security risk management policy and procedure. When scrutinising this matter, there is opportunity for members to probe what governance approach is right for them. Looking at elements such as, how the council will manage security risks in different business contexts and cyber security feeds into the wider risk management framework.

Members and decision makers need to ensure that they have the necessary tools and information when looking at risk management, the use of technical experts will be imperative here. Underpinning all of this is a culture of recognising that cyber security pertaining to risk management is a ‘given’ and that it needs to be included at all levels.

Questions to ask regarding risk management:

• How will your council incorporate cyber security into your wider risk management plan?
• Is information readily available and presented in a way that is easy to digest to ensure that members can make competent decisions in relation to cyber security?
• Is there a culture within the council that recognises that cyber security is unilateral and needs to be incorporated at all levels within the council pertaining to risk
• How will your council ensure that risk is effectively monitored in terms of cyber security?

You can read more on this on the NCSC website.

Is the scrutiny committee assured that risks are identified and managed effectively in relation to your supply chain partners and is this monitored regularly?

Your council will likely conduct business with a range of partners, suppliers, and stakeholders. These may include NHS bodies, social care providers, contractors, housing associations etc. Your supply chain may involve multiple partners and varying levels of integration – cyber threats may become relevant at any part of this chain - it is vital that you understand the nature of the supply chain, and the processes in place to safeguard your information and systems from threats.

You will need to ensure that your scrutiny committee is aware of^[19]:

• Who has responsibility for cyber security at the organisation within your supply chain, and how it links in with procurement;
• The cyber security policies and procedures of organisations in your supply chain;
• There are measures in place that ensure that the supply chain security is reviewed and vulnerabilities are detected.
• Who is responsible for undertaking the supply chain cyber security processes and policies in your council;
• Whether there is a clear feedback programme to organisations in your supply chain if you have questions about their practices;

Is your data secure?

Data back-up is fundamental in this digital age, especially as much of your council’s data is valuable to malicious actors. Data must be protected from outside actors, but also from modification and deletion (within GDPR guidelines, though this would not apply to financial data). The NCSC advises that data should be protected in transit, at rest, and at end of life (that is, effectively sanitising or destroying storage media after use)^[20] You should make sure that you are not retaining data that you no longer require. More information about data retention can be found on the Information Commissioners Office’s website.

Members and officers might have their own personal devices, here it is crucial that your data is secure, protected and the risks of threat are minimised. This should be in line with organisational policies which aim to reduce the risks from personal device usage. Though it is important to add here, that many officers and councillors will not have ‘personal devices’ that they use for work, they will be given devices by their local authority. If this is the case, usually is it then the responsibility of the authority to have stringent back-up policies in place. For example, the IT department will be the main ‘admin’ on your device, that can remotely add or remove programmes and can back-up data. Whilst this is a job for the IT professionals and departments, it is important for scrutiny to be aware of it, when overseeing the wider cyber security strategy, for example, how often this may be reviewed or updated.

Backing up data

A data back-up is defined by the NCSC as a copy of your data that is stored in a separate, safe, location. If access to  data is lost, then you will then be able to obtain a copy of it from your back-up.

Depending on how your organisation is set-up, back-ups may be stored on the internet (‘in the cloud’), on disk storage within your IT infrastructure or that of your suppliers, or on tape. Regardless of where, backups must be:

• Secure from unauthorised access, tampering and loss;
• Comprehensive – sufficient information is backed up to enable you to recover business functions;
• Timely – having a backup made 6 months ago means that you will lose 6 months of information if you are forced to restore from it;
• Recoverable – you need to know that your backups actually work, and they must be recoverable within a suitable time period.

Depending on the risks, you may need to have multiple back-ups stored in multiple locations.

In the case of a ransomware attack, attempts are made to corrupt, or encrypt any data to which the attacker has access – and this can include backup data. You should be aware of whether you have back-ups are ‘immutable’ – i.e. sufficiently separated from everyday storage that an attacker cannot reach them.

Questions that scrutiny committees can ask regarding back-ups

• What methods of back up do we use, e.g. cloud storage, tape, external hard drives and how are these managed in line with the goals above?
• Is important data (see the introduction section for an overview as to what constitutes important data) backed-up in multiple locations and ways and does it need to be?
• What is our current data retention policy, and does it adhere to the wider information management architecture policies, such as those set out in FOIA, GDPR and EIR?
• How is data back-up monitored?
• Is there a need to back-up officers’ and members’ devices? If so, are back-ups regularly reviewed and is training on data back-up readily available?
• What advanced access control do we have on sensitive data, who has access to this and why?

What are the response, recovery, and continuity plans for cyber incidents?

Cyber security policies and procedures should consider how the council would detect an incident, manage it, and operate during and following it. Incidents do occur, and no level of preparation offers a guarantee of invulnerability. It is important to be prepared for them, to examine your capabilities and explore where vulnerabilities may lie.

The National Institute of Standards & Technology (NIST) expresses this as five functions, of which the last three are most pertinent in this context:

• Identify: What assets and processes do you have, how will risks be identified and managed?
• Protect: Implementation of functions and resources, including trained people, to manage those risks.
• Detect: How will you monitor for, or be aware of an incident?
• Respond: How will you act when an incident occurs, and how do you learn from incidents?
• Recover: How do you plan for recovery of your services, implement improvements based on lessons learned, and communicate to stakeholders?

Your council will need to have a comprehensive incident response framework as well as understanding the need for incident management ^[21].

To form an effective response plan, it is integral that your council is regularly testing and undertaking exercises that identify where the incident response is robust and where it falls short. Exercises should consider a range of potential incidents, and should be seen as an opportunity to involve diverse parts of the organisation, as well as IT and Business Continuity and Emergency Planning teams.

Within your incident response plan, you will require plans for if your services and operations are disrupted, taken offline, are inaccessible or subject to data breach. You will need to consider the impact on services, and how you would maintain them or handle their absence for an acceptable period of time, whilst managing issues within your community.

Incident response plans must also consider how normal operations should be resumed, and in what priority order. Approaches for specific service areas, because different services may require different plans (e.g. benefits vs. housing) – however, you must be conscious that the resource to enact them may be shared across the council.

Scrutiny committees can provide a significant role in with regarding to determining the response plan for cyber security. Scrutiny members should keep an informal watching brief over developments in this area, bringing things to committee if they feel there are urgent or problematic issues that need to be dealt with.

Scrutiny committees can also assist in engendering a culture whereby it is understood that response planning is a matter that is relevant for all facets of the council. Scrutiny committees can highlight where there may be gaps in the incident management plan and the overall incident response strategy.

Questions scrutiny committees may wish to ask regarding response planning:

• Do we have a comprehensive, effective response and recovery plan in the event of a cyber attack or incident?
• Do we have measures in place to ensure that work and operations are able to carry on as normal, or at minimal acceptable levels in the event of an incident?
• Have we considered how services will operate in the event of systems not being available for prolonged periods of time?
• Does our council continually monitor its environment for current cyber risks and vulnerabilities to determine the potential for, and nature of, likely attacks?
• What is our process for initially responding to a cyber security incident?

If an incident were to take place, how can we learn from this and improve?

If a cyber security attack were to take place, it is important to recognise why and how this happened, and how measures can be implemented to ensure that there is a reduced risk and prevent potential reoccurrence.

As stated previously, it is impossible to eliminate the risk of cyber threats, this is due to the inherent nature of cyber threats in that they are constantly evolving and changing.

However, if your council were to fall victim to a cyber attack or incident, it there is an opportunity to learn from this and understand why and how this happened.

Scrutiny committees can proactively look at this issue as part of response planning, but should also consider asking questions as to why the issue occurred and how there can be improved processes in terms of identifying threats and vulnerabilities, managing risk, response and recovery. Scrutiny can also form part of the council’s formal debriefing processes from operational incidents and ensure that they have reasonable input.

Questions scrutiny committees may wish to ask regarding lessons learned:

• Has your council identified the source of the incident and are there now measures in place to reduce the risk of this reoccurring?
• Have the details of the incident been documented effectively and stored in a secure place?
• Will there be a review into how this happened, and will cyber security measures be looked upon closely because of the incident?
• Are decision makers been transparent and communicating with relevant officers, members and stakeholders?

Jargon buster

[1] Cyber and information security (nao.org.uk)

There are a number of sources in which you may find information around cyber security arrangements and challenges, including:

• performance information from across the authority and its partners
• finance and risk information from across the authority and its partners
• corporate complaints information, and aggregated information from political groups about the subject matter of members’ surgeries
• business cases and options appraisals (and other planning information) for forthcoming major decisions. This information will be of particular use for pre-decision scrutiny
• reports and recommendations issued by relevant ombudsmen, especially the Local Government and Social Care Ombudsman.