Feeds

UK.gov security is pants

Worrying lapses

  • alert
  • submit to reddit

Internet Security Threat Report 2014

IT security levels in UK central and local government are worryingly poor and need significant improvements if the UK is to meet its e-government targets, a survey out this week warns.

Government security levels fall far below those of comparable IT sectors such as banking and finance, according to a report from security testing firm NTA Monitor.

Almost one in two (49 per cent) of government bodies scrutinised by NTA Monitor had greater than 10 vulnerabilities per report. An average of 73 per cent of these public sector sites showed worrying firewall vulnerabilities. This mediocre security exposes government organisations to considerable risk from malicious attack, NTA Monitor warns.

Roy Hills, Technical Director NTA Monitor, said: "With such poor security performance, government will find it extremely difficult to meet its e-government targets. What worries me most are the implications for citizen's records if they do manage to get all planned services online at current levels of security."

The UK government has set a target of making all its services available online by 2005, but inadequate security could undermine this ambitious goal.

Hills warned: "Public confidence in e-services will be crucial for their successful uptake - but given consistently poor vulnerability levels and sluggish track record of improvements, significant breaches of confidential information are risked. This could set plans back by years. Action must be taken now before the public's trust is damaged."

According to NTA Monitor's report, the government sector had the worst record overall in firewall security, with flaws oscillating between 78 per cent and 71 per cent during tests conducted over the last four years.

In 2002, vulnerabilities were found in the following risk areas, expressed as a percentage of government sector test reports: router (90 per cent), server (82 per cent), DNS (69 per cent) and firewall (73 per cent). Similarly the government sector fared joint worst in terms of the number of organisations found to have high (9 per cent) and medium-level (82 per cent) security flaws.

NTA Monitor characterises a high-risk issue as a major security vulnerability that is typically widely known and exploited by hackers to gain external access to a computer system. Medium-risk issues permit external users to disrupt services or internal users to gain unauthorised access to systems, whilst a low risk issue provides information that could be useful to a hacker in attempting an external attack.

NTA Monitor Vertical Market Security Report 2003 is based on analysis of more than 600 Regular Monitor network perimeter security tests undertaken by NTA Monitor for a broad range of blue-chip clients. The research analysed test results across the financial, government, legal, IT & telecommunications, manufacturing and services sectors.

Related Stories

UK.biz getting on top of serious security risks
Inland Revenue site 'failing to perform'
Whitehall laptop theft prompts security concerns

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.