Improving Cyber Effectiveness Across Central Government
Working with the Cabinet Office to deploy best practice cyber maturity consistently across central government
Fragmentation of services typically delivers poor consistency
In light of the global increase in cyber-attacks targeting large companies and governments, the Cabinet Office took steps to improve security capabilities across the UK government as a whole. Although some departments were more mature in their cyber posture than others, in general there was improvement required in the areas of protection, detection and response.
With government security-related incidents becoming more highlighted in national press coverage for things like data loss it was recognised that cyber maturity needed to be addressed to mitigate the growing risk of attack.
Government security teams were acting independently and somewhat siloed. With limited resources and skills, they tended to be reactive rather than proactive.
The continuous workload of cyber-security incidents resulted in a lack of focus on basic cyber hygiene elements in most departments.
With cyber-crime trending materially upwards, and nation-state sponsored threat actors more frequently targeting the UK government, a change of strategy was needed.
Move to Centralised Security Centres
The Cabinet Office, in conjunction with some lead government departments created a model that saw specialist areas of expertise stood up to support wider government organisations. These Security Centres have developed a core set of security capabilities that can be leveraged across government.
Through our established relationships, Finyx were engaged early in this process and for one of the Security Centres tasked with a focus on Cyber Security, we led the definition of the Target Operating Model (TOM), service designs and the subsequent implementation.
The goal was to establish a team able to offer consultancy and delivery services to all government departments to help improve their cyber security and therefore the UK Government cyber posture.
Once established, the Government Security Centre for Cyber had – and continues to have – Finyx team members at its core. This team was positioned to provide services across government such as cyber maturity risk assessments, purple team testing, cyber defence projects and cyber supply chain best practice approaches.
Core to the success of the Government Security Centre for Cyber is leveraging NCSC standards and tools such as the Cyber Assurance Framework (CAF). The team subsequently is positioned to champion the adoption of NCSC tools such as Protective DNS, Mail Check and Web Check into government departments
Consistent Cyber Baseline and Wider Visibility
The Cabinet Office is now seeing an improved cross-government view of maturity against common cyber vulnerabilities. Capability gaps across different departments are now mapped and objectively assessed to recommend improvements. This collated knowledge is assessing thematic issues cross-government and helping identify scalable solutions to efficiently mitigate risk.
The centralised team is also able to offer consultancy and delivery services across government to offer best practice advice, build knowledge and develop departmental skills, with the end result being a material improvement of the UK Government’s cyber security.
Finyx continue to play a pivotal role in this crucial government capability.
