Management > Security

Government systems: how much security is enough?

Ian Levy Published 25 October 2011

Government systems: how much security is enough?

Dr Ian Levy , technical director of CESG, says there is no easy answer to the question, but there is a strong case for a mature information management culture

It is often claimed that government IT systems fail to give the right priority to security; either too much or not enough. This implies that there is an appropriate level of security which must be provided. But what is that level?

Those of us in the technology industry know that no computer system can be made completely secure. To establish how much security is enough, you need to balance the risks with the benefits; and the potential benefits are enormous. The internet is a wonderful tool for information sharing, offering a wealth of opportunities for commercial enterprise and the delivery of public goods and services, as well as new ways for citizens to participate in civil society.

People often compare information risk management with financial risk management, where many models run with a fraud and error budget of several percentage points. But this does not translate very well in terms of government ICT security.

Consider, for example, the range of information held by government concerning citizens' lives. Now consider the impact if some of this information was altered, either by a system error or targeted attack. A resulting demand for payment on the tax disc of a car you no longer own would be frustrating but it would not prove critical. However, inaccurate information in health records on which clinical decisions are based would be far more serious. An error rate of 0.5%, which might be acceptable for the former, would clearly be unacceptable for the latter.

So information value is a very difficult concept, and value is often in the eye of the beholder. My information may not be that valuable to me and I may only provide basic protection, but it may be exceptionally valuable to someone else, who may expend huge effort to get access to it.

People often point to evaluation as a security panacea. It isn't. No evaluation claims to remove all vulnerability, and no evaluation certificate is a statement of invulnerability. Evaluations are a way for information owners to understand the threat a product faces, and the amount of work required by an attacker to subvert that product. Provided the effort required to subvert a system is greater than the value of the information it holds, then the level of protection is appropriate.

Modern IT security is about reducing the impact and harm through operational assurance. At the basic end of the spectrum, this means keeping all software patched, minimising exposure to attack via untrusted networks and auditing for unusual behaviour. At the more complex end, it is about broad and comprehensive monitoring to quickly detect and respond to intrusions. At both ends, it's about ensuring you know when an attacker has got into your network, minimising the (temporary) access they enjoy, ensuring you know what they've done, knowing you can kick them out quickly, and being sure they can't get back in the same way.

Sometimes, government needs to provide services to the citizen that can't be defended by government IT security alone. Think about putting UK benefits online, a system that can process some £4bn a week. Not all the IT systems involved are under government control; for example, it has no control over a citizen's personal computer.

Of course, government is not alone in this dilemma. Online banking systems have some of the same problems, but have the relative luxury of being able to constrain their customer set and limit transactions (to the less risky ones).

In the case of online benefits, basic transactions involving change of address and bank account are inherently risky. However, this is what's necessary to provide real benefit to both the customers and the government department involved. And this is where government can leverage all its national assets, including the intelligence machinery, to help reduce the harm to these high risk but important services.

CESG is the information assurance arm of GCHQ. It sets standards for assessing and treating information risk, and helps government bodies to understand the risks we all face in securing data. Having assessed the threat and risks to a particular information system, it is necessary to understand how well a particular product or system will address those threats and risks throughout its lifecycle. This is what's known as assurance or, more narrowly, evaluation.

Assurance isn't just about proprietary software; there is no reason why open source software can't also be assured. There is no significant statistical difference in vulnerability rates between free open source and proprietary software, although the motivation to invest in security is different in each model, as are the vulnerabilities. As part of the government's ICT strategy, CESG is committed to overcoming the challenges that open source technology presents and is working with all types of software developers to achieve the best possible solutions across government.

Achieving the right level of security in government IT systems really depends on the threats to the data and systems, the impact that compromise of the data could have, and the fine art of balancing cost, business benefit and security. Getting this right needs a mature information management culture, a well understood risk management framework and a well rehearsed incident management process. Future success will also depend on government systems and services evolving to meet the changing threat as they become more exposed to the outside world.

As the government's strategy for cyber security develops, CESG will work more extensively with industry and vendors across product development and delivery cycles to ensure that the products used by government, industry and citizens in the UK are ready to meet the threat and are secure by default. This means sharing threat information with vendors and working with them closely to ensure that the right kinds of defences are in place.

So, how much security is enough for government systems? As in most things, there is no easy answer.

Dr Ian Levy OBE is technical director of CESG, the National Technical Authority for Information Assurance.

We have updated our privacy policy. In the latest update it explains what cookies are and how we use them on our site. To learn more about cookies and their benefits, please view our privacy policy. Please be aware that parts of this site will not function correctly if you disable cookies. By continuing to use this site, you consent to our use of cookies in accordance with our privacy policy unless you have disabled them.