Photograph: MStudioImages/Getty
Public sector organisations are embracing digital transformation to make it easier for citizens to interact with them. We see the benefits of this in our daily lives, whether it’s filing and paying taxes online, renewing a passport, booking a driving test or registering to vote. Offering services online means they can be provided far quicker and at a lower administrative cost, saving citizens time and helping government bodies to get the most out of finite budgets.
However, because the services are now available through a computer or smartphone, there is an inherent risk of hackers gaining access to highly sensitive personal information.
The public sector is now realising, as are many private companies, that this means cybersecurity can never be just an afterthought, and nor is it just a means of protecting online services from hackers.
Important though that still is, digitally astute public bodies are starting to see cybersecurity as a mindset and a suite of enabling tools that help innovate new services to make life more convenient for the public. They also drive budgetary efficiencies through reduced administration, less paperwork and smoother running IT projects.
As Stephen Wray, director of the cyber risk services team at Deloitte, explains, this means public organisations are now embracing cybersecurity as a vital consideration right from the start of a project. “It used to be a case of building something and then passing it on to the cyber team at the end of a project to see if it was secure,” he says. “Today, though, smart organisations realise they need to build in security-by-design throughout the entire process.”
This is not just because compliance has been brought into sharper focus by the General Data Protection Regulation (GDPR), which offers members of the public more privacy and greater control over how companies and government departments collect and store their information.
In Wray’s opinion, public organisations seeking the best advice will come to see compliance as “a carrot, not a stick”, because by ensuring secure-by-design practice is incorporated from the start to the end of all projects, government services are empowered to deliver optimal features and at the same time provide a defendable position should there be a cybersecurity incident.
People expect any provider of public services to be as flexible as any private company they deal with. Rather than fill in forms and queue in a town hall, they want to press a button on a smartphone to access services. This digital first approach requires a total rethink about how security is applied.
“Cybersecurity has just got so much bigger. It used to be about securing a clearly defined perimeter,” says Wray. “Now cyber is everywhere. It is foundational and an enabler for all digital technology. Organisations are having to think about the wider picture, often critical systems and key assets are not within an organisation’s control and a significant portion of the value of the organisation rests in its supply chain. They may have computer-controlled devices, such as security cameras or automated doors to a public building, or huge swathes of citizen data managed and maintained by somebody else. Systems are built on systems and things can get complicated very quickly. It is within this complexity that hackers thrive. That’s why you need to start out every project with security in mind from the start.”
Deloitte is finding that embracing this approach of security-by-design is enabling public bodies to turn around the preconception of cybersecurity as an expensive bolt-on to a suite of tools that can actually boost IT efficiency. “When organisations build security-by-design into everything they do, they prevent over-specification of the solution and avoid putting in too many features that are often unnecessary, unused and expand the opportunity for vulnerabilities from a security perspective,” says Wray. “What we’re seeing is that when cyber is built in from the start, public sector bodies don’t overscope, they can get it just right.”
And when they get it right, they achieve two huge strategic goals at the same time. Not only do they protect citizens’ data and help maintain the public’s trust in government services, they also keep pace with the public’s expectations for how they should be empowered to interact with those services. Rather than get left behind, the public sector can be at the forefront of designing innovative services.
“People want to use the latest, smartest products and services, but they can’t unless they’re safe,” says Wray. “It doesn’t matter what new technology can do, it’s only of use if it can be made secure for the public to enjoy. That’s what makes cybersecurity such an exciting, enabling capability. Without it, you couldn’t launch anything new without risking the trust customers have in you.”
There is still work to be done, however, in demonstrating the value of cybersecurity to public bodies. Deloitte research has discovered that public sector organisations often fear technology will be too expensive, and only one in five public sector workers (19%) feel that their organisation is in line or ahead of private sector organisations when asked about technology adoption. And almost half of civil servants reported they are not sure, or are not confident, their organisation could deal with a cyber-attack.
Wray cautions that government bodies must not only work on the technology but also the people within their organisations. “People can be your strongest link,” says Wray. A user-enabled security approach means that well-trained and cyber savvy workers can contribute to the overall security posture of the organisation. A single compromised computer could provide a path to a treasure trove of citizen data. But healthy password use, security policy adoption and being able to identify and report phishing will counter some of the most prevalent and common attack vectors.
Getting the people focus right and embracing cybersecurity throughout the life cycle of any new service is essential. When combined, these measures allow the public sector to delight citizens with convenient, slick new ways of accessing services that they might have previously only imagined was possible through a Silicon Valley startup.
