Building a cyber resilient service: A guide for directors of children’s services

Welcome to our guide on 'Building a cyber resilient service: A guide for directors of children’s services'. This document aims to support directors and their senior team to develop proactive, protective strategies and capabilities to enhance the cyber resilience of their service; some recommendations are technical, some organisational and some are about your people. 

We discuss these protective strategies, how they work together, and what would be considered good practice and unsafe practice, so directors can create a positive culture surrounding cyber security in their service and organisation. 

The document is intended to get directors thinking about the intricacies of cyber security in the context of delivering children’s services. It does not seek to produce a single, set blueprint. 

Due to the ever-changing landscape of cyber threats, directors and their senior teams should regularly review their cyber security practices and policies, while also looking at their capacity and capabilities to deal with them.

This document aims to support directors of children’s services (DCSs) and their senior team with building the cyber defences of your service and enhancing cyber resilience which will reduce the likelihood of a cyber attack and its impact on your service if, and when, an incident takes place. It will help you as a director consider the risks to your service, the people, data and technology you want to protect and the harms you most want to avoid.

Good cyber security practices are essential for individuals and organisations. The responsibility for cyber security may sit at a corporate level, but each service within a local authority has a part to play in protecting their assets and critical services. Your service will be underpinned by data and technology, which is evolving at speed. These changes create benefits and opportunities – but also risk when it comes to cyber security. Your service needs robust cyber security to safeguard children, young people and their families, including their data, infrastructure, and service delivery.

Cyber security poses a major risk for councils. At least 11 million attempted attacks on UK councils occurred in 2022, with over 10,000 attacks every day [1] (Gallagher, 2022). If, or when, a cyber attack hits your council, it could cause significant disruption. An attack on critical systems could damage the council’s reputation and finances and have a significant impact on its ability to deliver on its priorities and comply with service legal requirements. What is your service doing to reduce cyber risk – to lessen the probability and severity of an attack? Is cyber security something you think about?

This guide for directors of children’s services offers a set of cyber security steps to consider: 

• Step 1: Be clear on what cyber security means
• Step 2: Be clear on your cyber security role
• Step 3: Be clear on the cyber risk to your service
• Step 4: Be clear on the likelihood of an attack and by whom
• Step 5: Be clear on why your service may be a target
• Step 6: Be clear on the impact of a cyber attack
• Step 7: Be clear on ways to mitigate cyber risks
• Step 8: Be clear on ways to respond and recover

The National Cyber Security Centre (NCSC) is an organisation of the UK Government that provides advice and support for the public and private sector in how to avoid computer security threats. It defines cyber security as: [2]

How individuals and organisations reduce the risk of cyber attack. Cyber security’s core function is to protect the devices we all use (smartphones, laptops, tablets, and computers), and the services we access – both online and at work – from theft or damage. It’s also about preventing unauthorised access to the vast amounts of personal information we store on these devices, and online.

The responsibility for cyber security may sit at a corporate level, but ultimately it is the responsibility of each service to protect their assets and critical services. Your service will be underpinned by data and technology, and that technology is evolving at speed. These changes create benefits and opportunities – however, there is also an increased risk in terms of the potential for cyber attacks.  You will need to ensure robust cyber security to safeguard data, infrastructure, and service delivery.[3] 

As someone entrusted to protect and safeguard the welfare of children, cyber security should be considered alongside your statutory role. This means using your role to ensure that clear and effective arrangements are in place to protect children and young people from harm – including harm caused by the loss or misuse of data about them and their families stored, controlled and shared digitally. This is reflected in your duty to provide ‘…a clear and unambiguous line of… professional accountability for children’s wellbeing.’[4] 

When discussing cyber risks, the conversation tends to focus on the role of the IT department. IT teams are there to support the whole workforce, and though they do have a role to play, you and your senior team should understand the vulnerabilities and threats to your service. A cyber attack can and will affect all areas of the council, and it is essential to prepare.

• 'A vulnerability is a weakness in an IT system that can be exploited by an attacker to deliver a successful attack. They can occur through flaws, features or user error, and attackers will look to exploit any of them, often combining one or more, to achieve their end goal.’[5]
• Cyber threats are: ‘Anything capable of compromising the security of, or causing harm to, information systems and internet connected devices (to include hardware, software and associated infrastructure), the data on them and the services they provide, primarily by cyber means’.[6]

Cyber security should be covered in the risk assessment for your service area and recorded as part of the corporate risk register. Cyber risk is a business risk consistent with those arising from physical threats – and processes should be in place to facilitate consistent reporting and escalation routes across the council. A fundamental aspect of your cyber risk assessment is to understand the likelihood and impact of an attack affecting your service. This assessment will help you respond through mitigations and minimisation techniques. For this to happen, you need identify what harms your service could withstand in the event of an attack, and what it could not afford to happen.

The more software, systems and data used as part of your service – the more vulnerability points arise. Also be aware of risks associated with your supply chains and ensure these risks are also managed through your risk assessment process. Vulnerabilities, opportunities or weaknesses in your information systems and internal controls can lead to security breaches if exploited. It is essential you understand the software, systems and data used as part of your service – including shadow IT [7] – and that you work with your IT service to gain assurances about security updates.  Putting in place a good vulnerability management process can help you understand which ones are most serious and need addressing first. [8]

There may also be high turnover of staff in your increasingly busy service area. With a large number of joiners, movers and leavers, this creates further vulnerabilities and there may be a risk that individuals have access to systems or information that they no longer require as responsibilities, management and accesses change often. It is important to have robust processes in place to manage this.

Robert Mueller, Former Director of the FBI, is on record as saying:[9]

I am convinced that there are only two types of companies: those that have been hacked and those that will be. And even they are converging into one category: companies that have been hacked and will be hacked again.

The UK government has identified ransomware attacks as the most significant cyber threat facing the country; and criminals are developing new techniques to circumvent cyber defences, including targeting the users of technology, as well as the technology itself.[10] It is therefore sensible to assume you will be effected by a cyber incident at some point and should push back on the narrative that an attack is unlikely. Your plans should reflect this reality too.

Consider the three categories of harm caused by a cyber attack: getting robbed (stealing cash, data or intellectual property), getting weakened (espionage, political interference or prepositioning) and getting hurt (ransomware and destructive or catastrophic attacks).[11] Which of these motivations is most relevant to your service? 

Think about:

• What assets do you have that make your service vulnerable to a cyber attack? Is data theft at the top of this list? All councils manage data of interest to malicious actors, making them a target.

Children’s services teams are supported by a huge amount of data. This will include, for example, data on children looked after, child protection, special educational needs and disability, pupil attainment, children’s health, and post-16 circumstances and judgements from Ofsted (see Figure 1). This amount and type of data makes your service vulnerable to cyber attacks. Attackers may be looking to extort data for resale on the Dark Web, and you will be particularly vulnerable to extortion from criminals who recognise the criticality of this data for services to continue to run. Cyber security is vital to ensuring that data is secure.

Figure 1: Commonly held children’s services data

• Personal details – Names, addresses, gender, dates of birth, and contact details for the child and their parents or carers.
• Contact details – Name and contact details of any person with parental responsibility, or who has care of a child at any time. 
• Education data – Unique Pupil Number (UPN), details of any education being received by a child, including the name and contact details of any educational institution they attended.
• Health data – NHS number, name and contact details of any person providing primary medical services in relation to a child. 
• Social care data – Child-level data, information about any safeguarding concerns, child protection plans, and any involvement with children’s social care services.
• Early years data – Information about a child’s development and progress in early years settings such as nurseries or childminders.
• Youth services data –Information about a child’s participation in youth services and any support they receive.
• Adoption and fostering data –  Information about children who have been adopted or placed in foster care, as well as information about prospective adoptive or foster parents.
• Legal data – Information about any court orders or legal proceedings related to the child.

In 2020, Hackney Council was the victim of an extremely disruptive ransomware attack which affected all systems and services including critical services such as social care, waste collection, benefits payments and housing – many ran using in-house systems. Two years after the initial attack, the council remained in recovery mode, with some IT systems still in the process of remediation, while some data was completely lost. The attack cost the council approximately £12 million.

In March 2023, Capita, which runs services for many local authorities was the victim of a cyber attack causing a significant IT outage at the organisation. Following the attack, Capita was found to have been storing client data in an unsecured AWS bucket. Seven local authorities were among the organisations affected by the attack, which exposed potentially sensitive data and caused some services to come to a halt.[12] The attack garnered much media attention and exposed the supply chain risk experienced by all councils. 

Figure 2: Example of service impact

Consider how the situation below would affect you and you and your team, and begin to answer the questions that follow.

Figure 3: Example of financial impact

Consider how the situation below would affect you and you and your team, and begin to answer the questions that follow.

Figure 4: Example of data impact

Consider how the situation below would affect you and you and your team, and begin to answer the questions that follow.

Cyber risks cannot be completely eradicated, but risks can be significantly minimised through planning for such an event, and also by developing a strong cyber security culture in your team. This includes putting in place strong data management systems to safely collect, share and store information about children and young people. For example, following best practice on managing the technical specifications and security or your databases.

Here are some considerations for mitigating the risks posed to information and data within children’s services:

Table 1: Storing data

Table 2: Managing data

Table 3: Sharing data

Table 4: Awareness and training

Table 5: Supply chain management

Planning

As a DCS, how confident are you that your service could adequately respond to and recover from a cyber incident or unplanned disruption? You will likely already be feeding into a BCP on a corporate level – and it is also important to maintain a BCP tailored for your service that provides clear actions on managing a cyber attack.

We would strongly advise against publishing this online – it is a threat actors dream to see what your response to a cyber attack is and how it will be managed.

Working offline

The first step taken by your IT service in the event of a cyber attack is likely to be taking down all IT services and disabling access to any systems while the cause and impact is identified. The IT team would then focus on preventing further damage, recovering systems, restoring backups, managing access and so on. During this time, there would likely be no access to IT services.

Areas to consider:

• Is there a clear plan setting out how your service would cope with no IT access for a significant period – sometimes stretching to weeks or even months?
• How would your team cope without access to the necessary case recording system? What about managing new referrals? 
• How would you ensure staff safety without access to case warnings such as ‘do not visit alone’ and ‘do not share this information’?

These are crucial questions to ask – and should be part of a regular cycle of reviewing and testing. Encourage your team to regularly consider how they could continue to provide essential services to children and young people if recording systems were unavailable, or all IT access was suspended?

Communication

If your service is the victim of a cyber attack, how would you communicate with colleagues, partners, residents and wider stakeholders? How would you do this if a cyber attack prevented you from accessing your usual communication methods (emails, MS Teams and so on)? Do you have an offline communication plan to support you in updating internally and externally? This may include using WhatsApp groups (which would need a full DPIA), posts on social media or phone calls – which means you will need access to contact details that are updated regularly and stored securely offline. Reviewing your plan with your corporate communications team will ensure a consistent approach across the council and reduce the pressure on the IT service to provide updates while managing a cyber incident.

Areas to consider:

• Do your staff understand how to report a cyber attack, and to whom?
• How will your staff communicate without access to IT or the internet?
• Is there a communications plan in place to help with response to media requests or questions from residents?
• Do you know where to report a cyber attack e.g., NCSC, LGA, police etc.?

Staff wellbeing

During a cyber attack, there may be an increased level of stress and responsibility on staff due to increased workload, concern for children and their families, and pressure from the media. It is crucial to make sure there are systems in place to support staff through this time. Focusing on these sorts of questions will help to promote a positive cyber security culture in your service area. 

Out-of-hours

Is your service supported by out-of-hours social care support teams based at other locations or authorities? You may be clear on the response plans of your authority, but do you know how these work across shared working environments? What plans are in place, for example, if your out-of-hours service was unable to access the necessary case recording system? How would they perform checks on protective measures put in place to protect a child, or processes put in place to support a child’s care plan?

Cyber security is a constantly evolving threat. It will be impossible to fully prevent and protect the services you provide for children and families from a cyber attack, however, the potential for harm is great so we must be vigilant.  

Your IT team should have robust processes in place to prevent as many attacks as possible, but it’s important for every member of your children’s services to take a proactive approach to cyber security. 

As explained in this guide, this means as a Director of Children’s Service, being clear on:

• What cyber security means
• Your cyber security role
• The cyber risk to your service
• The likelihood of an attack and by whom
• Why your service may be a target
• The impact of a cyber attack
• Ways to mitigate cyber risks and ways to respond and recover.