Feeds

UK.gov security is pants

Worrying lapses

  • alert
  • submit to reddit

SANS - Survey on application security programs

IT security levels in UK central and local government are worryingly poor and need significant improvements if the UK is to meet its e-government targets, a survey out this week warns.

Government security levels fall far below those of comparable IT sectors such as banking and finance, according to a report from security testing firm NTA Monitor.

Almost one in two (49 per cent) of government bodies scrutinised by NTA Monitor had greater than 10 vulnerabilities per report. An average of 73 per cent of these public sector sites showed worrying firewall vulnerabilities. This mediocre security exposes government organisations to considerable risk from malicious attack, NTA Monitor warns.

Roy Hills, Technical Director NTA Monitor, said: "With such poor security performance, government will find it extremely difficult to meet its e-government targets. What worries me most are the implications for citizen's records if they do manage to get all planned services online at current levels of security."

The UK government has set a target of making all its services available online by 2005, but inadequate security could undermine this ambitious goal.

Hills warned: "Public confidence in e-services will be crucial for their successful uptake - but given consistently poor vulnerability levels and sluggish track record of improvements, significant breaches of confidential information are risked. This could set plans back by years. Action must be taken now before the public's trust is damaged."

According to NTA Monitor's report, the government sector had the worst record overall in firewall security, with flaws oscillating between 78 per cent and 71 per cent during tests conducted over the last four years.

In 2002, vulnerabilities were found in the following risk areas, expressed as a percentage of government sector test reports: router (90 per cent), server (82 per cent), DNS (69 per cent) and firewall (73 per cent). Similarly the government sector fared joint worst in terms of the number of organisations found to have high (9 per cent) and medium-level (82 per cent) security flaws.

NTA Monitor characterises a high-risk issue as a major security vulnerability that is typically widely known and exploited by hackers to gain external access to a computer system. Medium-risk issues permit external users to disrupt services or internal users to gain unauthorised access to systems, whilst a low risk issue provides information that could be useful to a hacker in attempting an external attack.

NTA Monitor Vertical Market Security Report 2003 is based on analysis of more than 600 Regular Monitor network perimeter security tests undertaken by NTA Monitor for a broad range of blue-chip clients. The research analysed test results across the financial, government, legal, IT & telecommunications, manufacturing and services sectors.

Related Stories

UK.biz getting on top of serious security risks
Inland Revenue site 'failing to perform'
Whitehall laptop theft prompts security concerns

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.