To be truly resilient against potential attacks, it is not enough to simply look at patching the last one, but to anticipate the next. When commenting on the news that the NHS had not fared well in the recent round of cyber security checks, Matt Hancock, Secretary of State for Digital, Culture, Media and Sport summed up the issue.
He said on BBC Radio 4 last month that ‘The NHS has made improvements since the WannaCry attack last year, but one of the challenges in cyber security is that the criminals and the malicious actors who are trying to harm our space are moving fast, and you have to run to stay still. You can’t just make one update, you’ve got to constantly be updating’. NHS cyber security chiefs described their existing practices as ‘relatively unsophisticated’, and admitted that 88 of the 236 trusts that were assessed by NHS Digital failed to pass the required cyber security standards.
In spite of the negative publicity surrounding the event, the report did state that WannaCry’s lasting effect would have been significantly more widespread, had it not been so quickly disabled. With this issue front of mind, the Former Chairman of NHS Digital still blamed ‘a lack of focus and a lack of taking it seriously’.
So what actions are in the pipeline in order to safeguard the UK’s health service? Of course, every hospital authority will be ensuring that all software update patches are installed, after this proved to be the crippling weakness of the 80 trusts affected in last year’s cryptoworm attack. The majority of trusts had acted on this but the hesitation came from the potential implications and disruption to other IT and medical equipment.
Along with praising the initial response, it should be said that the robust plans going forward are setting the bar for others to follow. A cyber security ‘handbook’ is being issued to all employees, along with ongoing staff training and development; bringing the issue to the forefront and ensuring that everyone has their part to play.
Robust Incident Response, Business Continuity and Disaster Recovery plans are soon to be in place, reducing disruption to the operations even further in the event of an attack. This is to be reviewed and changed annually, in line with industry best-practice. It will work in tandem with both an annual ‘cyber incident rehearsal’ and Red Team-style engagements using ethical hacking teams that will consistently carry out both manual and automated penetration testing to the NHS networks. Finally, this links to their plans to appoint a CISO, after recognising that cyber security is indeed a board level issue and should be dealt with as such, as soon as possible.
It is these key practises that businesses across the globe should be looking to adopt into their next information security strategies. If your organisation is looking to mirror the proactive efforts of the NHS, SRM’s specialist solutions encompass the full scope of the governance, risk and compliance agenda. The trusted partner of government agencies, high street brands and SMEs alike, our bespoke and consultative approach enables our clients to achieve peace of mind.