Across the past 18 months, a variety of major global hacking campaigns have plagued public sector groups; from government agencies, to hospitals, to educational institutions, writes Deryck Mitchelson, Global CISO at Check Point Software Technologies.
During the second quarter of 2023, cyber attacks affecting public sector organisations increased by 40 percent, as compared to the first quarter. By the third quarter of the year, attacks increased by 95 percent.
The growing volume and sophistication of incidents implies that public sector organisations have a tremendous challenge ahead of them. Many public sector organisations aren’t secure enough, and some are languishing when it comes to improving security – likely because next steps are somewhat hazy. However there are tangible strategies that can be applied to help them build resilience in the face of changing cyber threats.
Secure Access Service Edge (SASE) can offer significant advantages for public sector organisations. In particular, it can ensure consistent policy enforcement, secure access-from-anywhere, and least-privileged permissions. SASE also automates certain tasks and reduces complexity for security administrators. In short, SASE is known for contributing to robust security while supporting flexible connectivity and simplifying security management for all stakeholders.
Endpoint security. Endpoints — from laptops, to servers, to mobile devices, to printers and scanners — are frequently considered to be the weakest elements in an organisation’s network. Around the world, millions of government and public sector employees use one or more of these types of devices everyday. In other words, there’s a lot of opportunity for hacker malintent that can lead to losses. In many cases, public sector entities under-appreciate the risk associated with endpoint devices, as it’s not viewed as a high requirement for IT procurement contracts, rendering endpoints inadequately secured.
Security Information and Event Management (SIEM). These solutions are designed to provide context around detection of cyber security threats. An SIEM will collect logs from systems and security solutions across a network, placing them into a single, centrally managed location. Data collected via SIEM is aggregated from a number of different systems, which may use different numerical benchmarks. To allow administrators to perform comparisons and analyses, SIEM solutions perform data normalisation, making all comparisons “apples to apples”. SIEM tools can also offer event notifications and response (and much more). The most effective SIEMs are integrated into Security Operations Centres.
Threat intelligence. Public sector entities can obtain a broad view of potential threats through cyber security intelligence platforms. The platforms enable entities to obtain greater situational awareness, and subsequently, to take a more proactive approach to security. Value-packed insights inform admins about adversaries’ motivations, capabilities and modus operandi. All of this informs mitigation measures. Prevention and defence against imminent attacks becomes faster and more effective. While your organisation may not require automation within a threat intelligence solution, it’s a nice-to-have that will likely turn into a must-have.
Automation. Cyber security automation is intended to make processes and people more efficient and accurate. Automated tools can collect information, sequence the information, and analyse the information. In turn, they can detect infections and potentially remediate issues faster than an attack can progress, and faster than a human could apply a fix. Thus, automation stops attack lifecycles at-speed and scale.
Consolidated cyber security architecture. In the past, public sector cyber security professionals leveraged a variety of products and tools. Each one was intended to address a different aspect of cyber security. However, these tools often aren’t interoperable, or the communication between them is poor. In addition, gaining visibility into a large number of tools is extremely challenging. Adopt a consolidated cyber security architecture. A consolidated architecture offers improved visibility, superior threat intelligence and simplified management across your entire environment.
Cyber security training. Leaders need to provide cyber security training in a way that resonates with employees – that ‘speaks the employees’ language,’ framing threats in terms of ideas and objectives that employees care about.
Emphasise the personal dimension of risk. Talk about how organisational data loss could lead to distribution of information about employees and their families. A breach could mean that employees and their family members experience identity theft, which could make it extremely difficult to renew passports, to enroll children in school, or to open new lines of credit, among other things.
Adhere to established standards. No need to reinvent the wheel. A number of independent industry groups have created high-level guidelines and frameworks that you can easily apply in order to make the most of your security efforts.
Leverage frameworks to assist your organisation in advance of compliance audits. The use of ISO 27002, for instance, enables organisations to demonstrate compliance with multiple regulations at once, including HIPAA, Sarbanes-Oxley Act (SOX), PCI DSS and the Graham-Leach-Bliley Act.
Integrate cyber resilience into strategic planning. Cyber resiliency “is about keeping the lights on with no downtime,” says Sue Bergamo, executive advisor, CIO and CISO with BTE Partners. It refers to “the ability to anticipate, withstand, recover from and adapt to adverse conditions, stresses, attacks or compromises on systems that are used or enabled by cyber resources,” explains the National Institute of Technology and Standards. Assess and identify risks, create incident response plans, foster partnerships and collaborations across your organisation, and implement data protection measures. All of these efforts contribute to the development of cyber and business resilience.
Collaborate with industry partners. Collaboration with other agencies, established groups and reputable cyber security vendors can enhance collective prevention and defence. Cyber security collaboration offers a low-cost means of significantly enhancing cyber threat detection, incident response and your overarching cyber security posture.
Conclusion
Although the solutions listed above may not be mandated by your organisation or department, I would encourage all public sector bodies to exceed standards and expectations wherever possible. Take an innovative approach and leverage these recommendations to strengthen the cyber security posture of your organisation and mature your cyber security capabilities.
