Feeds

UK.gov security is pants

Worrying lapses

  • alert
  • submit to reddit

5 things you didn’t know about cloud backup

IT security levels in UK central and local government are worryingly poor and need significant improvements if the UK is to meet its e-government targets, a survey out this week warns.

Government security levels fall far below those of comparable IT sectors such as banking and finance, according to a report from security testing firm NTA Monitor.

Almost one in two (49 per cent) of government bodies scrutinised by NTA Monitor had greater than 10 vulnerabilities per report. An average of 73 per cent of these public sector sites showed worrying firewall vulnerabilities. This mediocre security exposes government organisations to considerable risk from malicious attack, NTA Monitor warns.

Roy Hills, Technical Director NTA Monitor, said: "With such poor security performance, government will find it extremely difficult to meet its e-government targets. What worries me most are the implications for citizen's records if they do manage to get all planned services online at current levels of security."

The UK government has set a target of making all its services available online by 2005, but inadequate security could undermine this ambitious goal.

Hills warned: "Public confidence in e-services will be crucial for their successful uptake - but given consistently poor vulnerability levels and sluggish track record of improvements, significant breaches of confidential information are risked. This could set plans back by years. Action must be taken now before the public's trust is damaged."

According to NTA Monitor's report, the government sector had the worst record overall in firewall security, with flaws oscillating between 78 per cent and 71 per cent during tests conducted over the last four years.

In 2002, vulnerabilities were found in the following risk areas, expressed as a percentage of government sector test reports: router (90 per cent), server (82 per cent), DNS (69 per cent) and firewall (73 per cent). Similarly the government sector fared joint worst in terms of the number of organisations found to have high (9 per cent) and medium-level (82 per cent) security flaws.

NTA Monitor characterises a high-risk issue as a major security vulnerability that is typically widely known and exploited by hackers to gain external access to a computer system. Medium-risk issues permit external users to disrupt services or internal users to gain unauthorised access to systems, whilst a low risk issue provides information that could be useful to a hacker in attempting an external attack.

NTA Monitor Vertical Market Security Report 2003 is based on analysis of more than 600 Regular Monitor network perimeter security tests undertaken by NTA Monitor for a broad range of blue-chip clients. The research analysed test results across the financial, government, legal, IT & telecommunications, manufacturing and services sectors.

Related Stories

UK.biz getting on top of serious security risks
Inland Revenue site 'failing to perform'
Whitehall laptop theft prompts security concerns

Next gen security for virtualised datacentres

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.