Fundamentals of Public Sector Cyber Security

Unprecedented events have forced the world as we know it to drastically adapt, and fast. The public sector is no different.

To keep up with global change, public organisations have had to act quickly, which is a difficult and never-ending task for any organisation, let alone one in the public sector. Public organisations experience a variety of unique challenges, some of which are — 

• Increased compliance considerations
• Sensitivity of data
• Public scrutiny 
• Budget constraints

While all industries, including the public sector, have efficiently made the switch to work from home (WFH) life, the smooth transition has largely rested on extensive and exhaustive digital transformations. The pandemic has forced organisations to adapt their entire business to be remote — typically cloud-based — and that’s infrastructure as well as human capital. The move to delocalised, sophisticated systems has also unfortunately meant that cyber security risks have exponentially increased in volume, frequency and degree of severity.

The unique challenges facing public organisations make digital transformations of the kind demanded by the pandemic, particularly difficult. Maintaining sophisticated cyber security systems is expensive and time-consuming to implement. So, while they know they undoubtedly need to update/renew or even implement a new cyber security system, they often can’t in the same way that large corporations can. 

At Six Degrees, we understand the importance of delivering an efficient cyber security strategy. Alongside the attendant threats brought about by remote access and device flexibility, the COVID-19 pandemic has caused economic disruption that affects resources.

In this blog, we will explain how public sector organisations can satisfy simultaneous demands for high-quality cyber defences and lower costs by doing more with less through an efficient cyber security strategy.

Suggested Reading: If you want to learn more about explaining the value of cyber security to the board, check out our free resources — Board Presentation Toolkit: Cyber Security and Threat Management.

Pillar 1: Embrace the Cyber Security Journey

The cyber security threat landscape is constantly growing and evolving, so you must too. Work tools change, new practices emerge, and cyber threats become more sophisticated. To meet this demand, cyber security must become an ongoing, iterative process.

But with threats on the increase, how can you deliver more efficient protection? The answer lies in orienting yourself and your public sector organisation towards your objectives with a pragmatic approach. You need to: 

1. Accept that no organisation can ever be 100% secure from cyber threats.
2. Build a fluid and agile system that can respond flexibly to uncertainty, change and new information. 
3. Incrementally improve that system one step at a time. 

This process is something we call the cyber security journey at Six Degrees. It involves a five-step iterative review process of your organisation and cyber security capabilities — illustrated in the diagram below.

Strategies to help:

Using the cyber security framework, you can increase efficiency because it moves the goalposts away from achieving impossible perfection to creating a functional system that uses real-world feedback to improve itself one piece at a time. 

Additionally, if your security budget funding becomes tight, the cyber security journey creates opportunities to execute operations that let you demonstrate the value of security investments faster. A major problem with securing cyber funding is connecting it with ROI, and your ability to support new projects and application rollouts earlier will help you build a more robust system over time. 

Finally, a shift in strategy can be achieved without significant investment. Finding new, efficient processes means you can do more with less, without sacrificing security. Ultimately, that is what an iterative approach is all about, and why it needs to be central to your strategy. 

Pillar 2: Create Flexible Response Capabilities

The disruption caused during 2020 underlines the importance of using a flexible approach to cyber security. Many processes and policies designed to work in a pre-pandemic world have become outdated and insufficient. Investment in a flexible and agile response capability gives an organisation the manoeuvrability to adapt to changing circumstances.

However, budget restrictions leave security managers in a tight bind. Security expectations haven’t changed, but finding cost-effective solutions has become significant. Understanding and embracing the cyber security journey is part of a flexible approach to cyber defence. However, that is just a framework for success. You need to use that approach to identify tactical choices you can make to improve flexibility on the macro and micro scale.  

Strategies to help: 

One approach that fits the ‘doing more with less’ ethos is Managed Detection and Response (MDR) in conjunction with endpoint security. 

• Endpoint security is a flexible solution that seeks to protect your system by monitoring flows of information from end-user devices — endpoints. 
• What is MDR? MDR is a fully-managed solution in which an outsourced incident response team monitors your system in order to respond to threats in real-time. 

Endpoint solutions create a scenario in which threats can be flagged before they become a breach — limiting exposure to specific endpoints. MDR then allows for the rapid response to those threats, preventing them from ever becoming a breach. The flexibility of this combination allows public sector organisations to engage with remote working far more safely. MDR is more cost effective than an in-house solution because of your ability to only pay for cyber security resources when they are actually needed — keeping costs down while improving results.  

Suggested resources: for more information on endpoint and MDR, check out our guide — Planning For the Future of Cyber Security Today.

Pillar 3: Understand Your Risk Appetite

Within the public sector, the concept behind ‘risk appetite’ is often broken down into two categories — 

• Risk appetite: The level of risk with which an organisation aims to operate.

• Risk tolerance: The level of risk with which an organisation is willing to operate.

Source: Risk Appetite Guidance Note 

Essentially, when public sector organisations can cultivate a culture that is informed by their risk tolerance and appetite, they can be better placed to make informed management decisions. Public sector organisations, by their very nature, experience a unique kind of pressure — their capacity for miscalculation or mistake is next to none. Public organisations cannot mess up in the same way private ones can. That’s why adoption of risk tolerant and risk appetite positions leaves public organisations prepared with both an optimal and acceptable position in the pursuit of

its strategic objectives.

So any effective public sector cyber security risks strategy needs to begin by asking one crucial question: What is your risk appetite (and tolerance)? Because of the nature of cyber threats, no organisation is ever 100% safe from risk. Additionally, you can’t implement every security measure and policy you’d like. At some point, you have to accept your limitations and then weigh up which type of risk exposure would be most harmful to your organisation, and prioritise your defences around that.

To achieve these aims, any cyber security investments must be made to align with your organisation’s appetite for risk. If, for example, specific security breaches will lead to fines or regulatory punishment that carry an existential threat, more weight and focus should be put towards securing these aspects. A clear understanding of how cyber security failings can impact a public sector organisation can be achieved through a cyber security risk assessment.

Strategies to help: 

Many public organisations must consider that when it comes to plans to improve their cyber security, ultimately, they are presented with the dilemma of pay now or pay later. 

By paying attention to potential cyber security risks — and taking a proactive stance — a small upfront investment can save your organisation from vast financial and reputational costs in the future. When it comes to security, prevention is better than a cure.

Additionally, by understanding your organisation’s risk appetite, you can focus your priorities on the main threats. This lean operating model eliminates unnecessary tasks, which reduce costs. However, cutbacks like this can create risks and vulnerabilities. Again, understanding your risk appetite is crucial when prioritising your focus.

Pillar 4: Leverage Strategic Partnerships

To achieve a more efficient and streamlined operation, third-party strategic partnerships can make a great deal of sense for your organisation. Fundamentally, outsourcing can improve quality while increasing efficiency. This is for three main reasons: 

1. Economies of scale: By using a strategic partnership, you get access to an industry-leading cyber security team that does nothing but cyber security. This enables that organisation to be more efficient with their investments and pass savings on to you. 
2. On-demand access: Partnerships allow you to access experts when you need them, rather than building an in-house team that you need to pay all of the time. For example, MDR provides access to 24×7 monitoring. But you only need to pay for the incident response capabilities when a threat actually surfaces. 
3. High-quality: The cyber security skills shortage means that access to specialist staff is limited and highly expensive. By using a strategic partnership, you can ensure that they’ve got the staff with the skills and tools to keep up with the changing threat landscape.

Strategies to help: 

Staying ahead of cyber security trends and information is no easy task for most organisations, so strategic partnerships with cyber security experts can be used to supplement or manage the entirety of your online security. By outsourcing these concerns, organisations can focus on their core competencies and benefit from a well-trained team that is on-trend and informed about the latest concerns and risks in the cyber security space. 

The challenge when engaging with partners is selecting the right partnership. Look for flexibility, expertise and a range of quality services that align with your business needs. Fundamentally, strategic security partners should be willing to work with you to identify the right solution for your organisation, and help you better understand the critical security needs on which you should focus. 

Suggested reading: For more information on the value of cyber security partnerships, check out our blog — Four Ways Strategic Partnerships Improve Cyber Security.

Six Degrees Can Help

Economic uncertainty has led to a need for the public sector to tighten its belt even while it deals with changes in its operations caused by remote working. These contradictory concerns have created a situation where governmental and public health organisations are forced to find a way to do more with less when it comes to cyber security. 

By adjusting your framework, creating flexible responses and garnering a deep understanding of what risk means to your public organisation, you can find a way to keep things secure without considerable investments in people and infrastructure. Of course, if you want to get efficient, partnering with a cyber security team is the ultimate solution.

At Six Degrees, we understand the specific limitations that public sector organisations face. We know that the public sector needs access to cyber security solutions that are adaptable, easily-implemented and importantly, affordable. We have been designing security solutions that meet the unique requirements of public and private sector organisations — we understand the different requirements for both and how to deliver tailored solutions that work. 

If you’re looking for the right cyber security partner, don’t hesitate to get in touch with our team. At Six Degrees, we’re committed to delivering a range of flexible, on-demand services that can help you get the most from your resources in these times of great flux.

Suggested reading: For more information on what a partnership with Six Degrees can deliver, check out our blog — The Six Degrees Approach to Cyber Security.