Local governments hold millions of gigabytes of this type of data – including financial and legal information, sensitive planning details, confidential medical data, data relating to children at risk and even vulnerable women – including locations of domestic violence refuges.
And poor cyber security has led to numerous high-profile attacks against councils in the past few years.
The London Borough of Hackney was subject to a ransomware attack in which personal staff data was released, land registry information was scrabbled, and local authority payments had to be halted. Sensitive personal data also led to a year long police operation to try and mitigate the risks to individuals caused by the loss and publication of this data.
Redcar and Cleveland local authorities were attacked in early 2020 and it is estimated to have cost in the region of £10 million due to the loss of services and a need for system upgrading across many sites.
In the August bank holiday of 2017, Copeland Borough Council was hit by a zero-day ransomware cyber-attack. Within three days, most of Copeland’s files had been encrypted. Hackers demanded Bitcoin in return for the files to be returned.
As more services go online and information becomes digitized the challenges faced by local governments and the solutions to the areas of attack become more complicated.
Websites are essential to local government providing a digital connection to residents about services provided. They also may provide a portal for worker and customers, whether it is to allow remote working or to allow residents to access services. Having a single place for people to interact with your business simplifies interactions, is cost effective and efficient. But if there is a misconfiguration or vulnerability in the way the website is set up then you could be leaving your sensitive data open for a criminal.
The only way to really know is to pressure test your site.
But do you really want to know? Nothing bad has happened so far and if you don’t know about it then surely you can’t be guilty of not fixing it?
Ask yourself these questions:
The ECRC offers members affordable web application vulnerability assessments. We work with local university students who conduct the testing and provides you with a detailed report, but explained in plain English, so you understand what the risks are and what you need to do to fix them. Find out more here: Remote Cyber Vulnerability & Threat Assessment Services (ecrcentre.co.uk)
You can contact the Cyber Resilience Centre for guidance and support through our e-mail enquiries@ecrcentre.co.uk or use our online booking system to make an appointment with one of our team.
Finally, you may have access to some sort of IT support within your business and we recommend that you speak to them now to discuss how they can implement cyber resilience measures on your behalf.
Click to Open Code Editor