Information security must become an ‘enabler’ rather than a barrier

In the past, the main focus of information security was on building bigger, higher and stronger firewalls around systems and data. This has had to change. Photograph: Craig Aurness/Craig Aurness/CORBIS

The latest information security survey published by the Department for Business, Innovation and Skills makes for frightening reading. It reveals that 93% of large organisations had a security breach last year, with the “joke” being made by many that the other 7% don’t yet know that they were hacked.

It’s not surprising, therefore, that the latest advice from the Institute of Chartered Accountants (ICAEW) is that businesses need to accept that their security will be compromised and that the rectification and other costs involved are an inherent part of doing business in a digital environment.

You don’t have to make the case for taking cyber and information security seriously; almost every day there are media reports of cyber-attacks, data losses and other forms of hacking. As the UK public sectormoves to becoming “digital-by-default” – to improve convenience for citizens and reduce costs – we must recognise the increased vulnerability of government and public services to cyber-attacks and poor information management, and do everything we can to ensure that individuals, businesses and government retain high levels of trust and confidence in our digital systems.

Security breaches seriously damage the reputations of public service organisations and raise real concerns about the loss or inappropriate use of citizens’ personal data. Also, concerns about data security can inhibit collaboration and data sharing, and can slow down moves to greater use of mobile and remote working.

The vast majority of users of digital public services are honest and expect quick and responsive services. They want to be able to choose and move effortlessly between services and information, whether they access via their PC, tablet or phone. Unfortunately, security can often be seen as a barrier to easy access, modernisation and digital transformation.

In the past, for example, the main focus of information security was on building bigger, higher and stronger firewalls around systems and data. This has had to change. Security arrangements now need to focus more on monitoring and taking action only when an incident occurs or when threatening behaviour is detected.

These types of issues and concerns have led to the creation of the Digital Government Security Forum (DGSF), to which I am the secretary. In its first report, Operating Securely in the Digital World, the forum provides guidance to help managers and leaders in public sector organisations better understand the risks and the language of information security. This is an important starting point as these risks are often shrouded in a technical language that can incorrectly make information security seem less relevant to everyday management and delivery of public services.

The DGSF report introduces the concept of “the trust multiplier”. Investing in systems and processes that improve confidence and trust can significantly reduce costs, improve the speed of interaction and avoid costly questions about reputation and competence. Conversely, costs increase dramatically and citizens are much more cautious about online transactions when trust and confidence have been compromised.

The report concludes that while the UK has made huge progress in improving information handling and information security, there remain significant areas of concern. These include the need to raise awareness and understanding of cyber security at board and senior management levels, problems with legacy systems and the danger that concerns about information security could delay moves to digital-by-default and prevent public-sector organisations from reaping the full cost savings and service benefits envisaged.

Two tools, a suggested review process and a development framework, are outlined to help boards, senior managers and security teams that would like to review and improve their information security strategies and governance arrangements. The report also comments on developing the business cases for investing in information security.

Ultimately, as the report concludes, the success or otherwise of information security arrangements must be judged not simply by how effective they are at preventing breaches of security but also by the contributions they make to achieving corporate goals and efficiencies. Greater use of technology is not optional; information security needs to be seen as an enabler rather than a barrier.