The UK’s Cabinet office recently announced it is on the hunt for a Government Chief Digital Information Officer (GCDIO). Paul Jackson, head of public sector at Tanium discusses how this individual can overhaul the governments outdated legacy systems and boost its cybersecurity
Historically many government organisations have thought they have a unique set of challenges when it comes to IT operations and security compared with the private sector. However, our experience shows the public sector face many of the same challenges as the private sector, which includes a lack of device visibility, poor IT hygiene and shortage of skilled resources. Establishing and implementing a comprehensive plan to address these challenges will be integral if the GCDIO wants to accelerate change.
Here are three ways the new role of the GCDIO can further accelerate change.
- Improve IT hygiene: Research shows that 99% of all breaches come from known vulnerabilities, meaning suffering a cyber-attack often comes down to a malicious actor finding security weaknesses with an operating system. More often than not, these vulnerabilities are fixed by patches. Given that global cyber-attacks such as WannaCry were catalysed by poor patching hygiene, it is vital that the GCDIO ensures basic processes, like patching, are in place.
- Gain a full grasp of the IT environment: Our latest research shows that 94% of CIOs in the UK said they have to make compromises on how well they are able to protect their organisation from disruptions to technology, including cyber threats and outages. When asked about the key reasons for making these compromises, a third of those surveyed cited pressure to keep the lights on and more than a quarter cited that being hamstrung by legacy IT commitments restricted their security efforts. With the Cabinet Office stipulating the new GCDIO will be responsible for updating IT systems and reviewing the government’s cybersecurity, it’s easy to see how they could be faced with making the same compromises as the CIOs that responded to our survey. With more than 20 ministerial departments and thousands of public officials and civil servants operating from multiple devices, identifying endpoints alone is a mammoth task. When it comes to maintaining a secure network, you can’t protect what you can’t see, so establishing an oversight of computing devices will be essential if the government wants to boost its IT operations and cybersecurity efforts.
- Unite IT Security and Operations teams: The scale of today’s networks and the proliferation of computing devices introduces complexity and risk for every organisation, including government. The fragmented array of legacy endpoint platforms and narrow point solutions also leaves organisations blind and unable to effectively operate and secure their business. The problem is that you can’t have a strong approach to cybersecurity and IT operations without understanding where your computing devices are, what’s running on them and the vulnerabilities that exist across the environment. The GCDIO must ensure that IT security and operations teams within all government departments are united around a common set of actionable data so that they can protect critical assets, monitor impact, and recover from the unexpected disruption.
The path forward
Given the nature of modern cyber threats, it is clear the appointment of a GCDIO is a crucial move for government. If the GCIDO is going to be successful in boosting the government’s cybersecurity, they’ll need to encourage cohesion across all government departments, instill IT hygiene and gain complete visibility of the IT environment within government.
