Sunderland council’s new crusade against cyber attacks

The meeting about the threat of cyber attacks took place at Sunderland Civic Centre.
The meeting about the threat of cyber attacks took place at Sunderland Civic Centre.

Council bosses have revealed plans to up defences against cyber attackers with new training, software and safeguards.

On January 17, Sunderland City Council’s Scrutiny Co-ordinating Committee heard a presentation about the council’s defences and “cyber hygiene”.

This forms part of a national drive to improve security after the impact of huge global cyber attacks in recent years.

Examples include the ‘Wannacry’ ransomware incident which crippled NHS systems alongside causing disruption at Nissan’s Sunderland plant.

In the past six months, Sunderland City Council has seen a rise in  attacks, from cyber criminals attempting to disrupt services to malicious login attempts and ‘phishing’ emails.

In just one week in November 2018, the council received around 400,000 spam emails.
Head of Customer Service, Intelligence and ICT at the Council, Liz St Louis, said this number was “in no way unique” and normal for a council of Sunderland’s size.

She added security upgrades were needed due to the “recognised and increased threat” from cyber attacks, noting a recent global data breach which saw more than 770 million emails and passwords leaked to hackers.

“The National Cyber Security Centre published guidance back in September 2018 to help organisations like us assess our current cyber security provision,” she told councillors at Sunderland Civic Centre. 

“Always against that backdrop, there’s absolutely no silver bullet that can 100% protect or guarantee complete immunity from a successful cyber attack.”

Future plans include replacing the council’s existing network, making a shift to Windows 10 and introducing new training programmes for councillors.

During discussion, Coun Darryl Dixon raised concerns about the the “vulnerable” period of transferring between the old and new network systems.

The meeting heard that new contract for the network would have a condition around “dual-running” alongside extra safety checks.

In response to a question from Coun Paula Hunt, I.T bosses confirmed key functions, such as social care, would be  protected in the case of a cyber attack.

This includes performing annual security checks to simulate disruption to services with ‘telecare’ listed as a high priority.

Head of corporate services on the council, Jon Ritchie, also stressed the council would also ensure “adequate resources” for IT in terms of staffing and software upgrades.

Last year, the Local Government Association published a ‘cyber-stocktake’ based on a questionnaire completed by councils.

While SCC received ‘green’ and ‘amber’ ratings in several areas, Coun Niall Hodson raised concerns about ‘red’ ratings in ‘technology standards and compliance’ and ‘detection’.

ICT Business Assurance Manager, Richard Wright, stressed that the ‘red’ ratings were linked to staff training and a  “reactive” approach to cyber attacks.

A new ‘Security Incident and Event Monitoring System’ , he explained, would improve detection and allow bosses to identify unusual cases.

“A lot of the attacks we experience aren’t too complicated,” Mr Wright added.

“A lot of them boil down to the phishing exercise to get the email and take the password in order to use your email accounts to send further spam around.

“Your email address is basically a commodity that’s being traded freely online and they’re the most attacks we see.”

Examples of cyber crime can include unauthorised access, malicious software, or carrying out a Distributed Denial of Service attack – an attempt to disrupt an online service by overwhelming it with internet traffic from multiple sources.

Ransomware, used in the ‘Wannacry’ attack, also locks computers or mobile devices, encrypting files and forcing the victim to pay a ransom.

When new threats appear, Sunderland I.T bosses look at the vulnerability of the council, the cost of protection and what is needed to close the loophole.

The council will also continue to publish guidance to staff about passwords and ensure software and hardware is disposed of under national guidelines, the meeting heard.

For more information on cyber attacks and cyber safety, visit Sunderland City Council’s website here:

www.sunderland.gov.uk/article/12181/Cyber-crime-and-on-line-safety-advice

Chris Binding, Local Democracy Reporting Service