By Gerard Thompson, Information Security Consultant
With over 3,500 MPs, lords and staff, being a computer security administrator in the Houses of Parliament must be a stressful job. They have a lot to think about. There is the possibility of state-sponsored brute force cyberattacks, much like the one that compromised 90 ministerial accounts in June 2016. There are also other, more delicate issues to be negotiated; like the fact that there were 113,208 attempts to access pornographic material within Westminster in 2016 alone. Yet in actual fact one of the most alarming revelations from the Houses of Parliament this month, has been the admission by a number of MPs that their passwords are far from secure.
Admittedly, the social media admissions by MPs that they shared log in details with staff were posted to help defend Damien Green who has recently been accused of accessing thousands of pornographic images on his House of Commons computer back in 2008. They wanted to make the point that it might not have been him, given the fact that others might have his password information. Yet, for information security professionals, these admissions were probably more shocking than the news story they were attempting to deflect.
One MP tweeted: ‘My staff log onto my computer on my desk with my login every day. Including interns on exchange programmes. For the officer on @BBCNews just now to claim that the computer on Greens desk was accessed and therefore it was Green is utterly preposterous!!’
The same MP went further that afternoon: ‘All my staff have my login details. A frequent shout when I manage to sit at my desk myself is, ‘what is the password?’’
Unsurprisingly, cybersecurity professionals on Twitter have been shocked by such admissions, with many pointing out that it demonstrates a severe lack of privacy and security understanding within Westminster. To the consternation of the information security industry, however, other MPs have proceeded to jump in, tweeting their own confessions. One such tweet said: ‘I often forget my password and have to ask my staff what it is.’
Another tweeted: ‘Less login sharing and more that I leave my machine unlocked so they can use it if needs be.’
With these admissions, it might be believed that the House of Commons does not have an Information Security policy. Of course it does. The House of Commons Staff Handbook has a specialised section on Information Security Responsibilities and the House of Commons Advice for Member and their staff specifically states that MPs should not share passwords. It is therefore more a question of awareness and training rather than policy. After all, the majority of breaches occur through user error so Westminster staff need to be reminded of their responsibilities.
Other government departments are exemplary in their information security procedures, providing best practice examples of how it should be done. With GDPR and the UK Data Protection Bill soon to be enacted, making the responsibilities of data holders even more stringent, the Houses of Parliament should also lead the way in demonstrating a robust stance on data defence.
SRM provides a complete range of information security services, from GDPR compliance to advanced penetration testing; from its Virtual CISO service to full blown Incident Response. To find out more, for a no-obligation discussion contact firstname.lastname@example.org or call 03450 21 21 51.