Police and fire services told to take urgent action to improve cyber security
Police and fire services are not properly protected from cyber attacks amid a reliance on legacy computer systems and not doing enough to prevent human error putting them at risk, a watchdog has found.
His Majesty’s Inspectorate of Constabulary and Fire and Rescue Services (HMICFRS) said police and fire leaders class using outdated systems as their biggest risk factor in IT security.
In a new report published on Tuesday, head of the inspectorate Michelle Skeer said: “Many police forces and fire and rescue services need to update their ICT systems to improve resilience.
“Leaders we spoke to in both sectors identified these ‘legacy systems’ as their highest strategic risk for cybersecurity.
“Modernising ICT across both sectors must become a priority. All the organisations we inspected relied on legacy systems to a greater or lesser extent.”
The watchdog also said using third-party IT contractors leads to additional risks, particularly where they hold sensitive information for the police.
Some back up systems put in place to recover after a cyber attack were also “unsatisfactory”, they found.
Inspectors, who visited three police forces and three fire and rescue services in England and Wales, found some forces are not doing enough to stop human error leaving them open to attack.
Ms Skeer said: “It wasn’t just a lack of training and awareness that created opportunities for cyber attackers.
“In some of the organisations we inspected, we found poor security controls for staff joining, moving within and leaving the organisation.
“We also found poor password management and a lack of up-to-date approaches, such as multi-factor authentication (where users must provide two or more verification methods to gain access to systems).
“Some forces and services simply aren’t doing enough to prevent human error from increasing the risk of cyber attacks.”
Senior leaders are left relying on younger, less experienced staff who know more about IT, the report found.
“Underpinning all these problems is a leadership issue,” Ms Skeer said.
“Several senior police and fire leaders we interviewed told us that they didn’t consider cybersecurity to be part of daily operational decision-making.
“This has led to financial investment being directed to other more operational and tangible priorities.
“It is difficult for both sectors to keep up with rapid technological change and cybersecurity-related threats as a result.
“Most senior leaders in both sectors have operational backgrounds.
“They have an expert understanding of operational risks and the investment needed to mitigate them.
“Often, they rely on more junior technical specialists to identify and explain cybersecurity risks and mitigations.”
The report makes a series of recommendations including ensuring that all police forces and fire services reach “baseline standards” for cybersecurity, and that the management of third party contractors is improved.
A national centre for digital management for the fire service should be set up, similar to that in the police, inspectors said.
Ms Skeer said: “The cyber threat to police forces and fire and rescue services is significant and expanding rapidly.
“A major cyberattack is not a hypothetical scenario and successful attacks have been disruptive, put the public at risk and were expensive to fix.
“While there have been gradual improvements, many forces and services still need to urgently redouble their efforts to respond to the increased risk of cyberattacks.”
She said that cyber security should be a “core organisational priority”, and that the major proposed reform of the police service as well as the overhaul of local government could offer a chance to improve.
Published: by Radio NewsHub
