Legacy systems and widespread human error are putting police and fire services in England and Wales at huge risk of cyber attacks, according to the policing and fire inspectorate.

A report from His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) noted that while there’s been some improvement in cybersecurity over the last six years, it’s still not enough.

“The cyber threat to police forces and fire and rescue services is significant and expanding rapidly. A major cyberattack is not a hypothetical scenario and successful attacks have been disruptive, put the public at risk and were expensive to fix,” said His Majesty’s inspector of constabulary Michelle Skeer.

“While there have been gradual improvements, many forces and services still need to urgently redouble their efforts to respond to the increased risk of cyber attacks.”

According to the report, the biggest issue lies in continued dependence on legacy systems. Indeed, tech leaders in both services identified legacy dependence as their greater strategic cybersecurity risk.

Similarly, there are significant concerns about cybersecurity risks linked to third-party ICT suppliers, particularly where suppliers store or manage sensitive police data covering victims, safeguarding, intelligence, and ongoing investigations.

Gaps in training are also a lingering problem, the report noted, with poor security controls for staff joining, moving within, and leaving services. Elsewhere, researchers found poor password management and a lack of up-to-date security measures such as multi-factor authentication (MFA) were rampant.

Cyber resilience needs to improve

Inspectors warned that not enough is being done in terms of preparedness and resilience arrangements, with “unsatisfactory” arrangements for backing up and restoring ICT systems following a cyber attack.

All these issues are being made worse by a lack of commitment from leaders, with several senior police and fire leaders saying that they didn’t consider cybersecurity to be part of daily operational decision-making.

Unsurprisingly, HMICFRS wants to see changes and has made a series of recommendations.

These include making sure all police and fire services achieve baseline standards for cybersecurity capabilities, introducing robust external validation to check up on the services’ own assessments of cybersecurity capabilities, and improving the procurement and contract management of third-party IT suppliers.

It also wants improvements to the way government and policing cybersecurity leads collaborate, and wider use of the Police Digital Service’s National Management Centre, along with a similar national capability for services.

In terms of preparedness and resilience, the report noted that services require significant improvements on this front.

HMICFRS said police and fire services need to be capable of responding swiftly to a cyber attack and should improve learning and development for both security staff and senior leaders.

“Cybersecurity should be viewed as a core organizational priority and not solely a technical risk. Leaders need to prioritize and invest in their cybersecurity arrangements to improve their organization’s ability to prevent, detect, respond to and recover from attacks,” said Skeer.

“The government’s program of police reform and local government reorganization could offer both sectors opportunities to improve and better co-ordinate the approach to cybersecurity. These opportunities to strengthen cybersecurity cannot be missed. Protecting systems and data is essential to protecting the public.”

Repeated warnings

The report from HMICFRS comes after the Information Commissioner’s Office (ICO) issued a stern warning to the Metropolitan Police Service earlier this month over security practices.

The data protection watchdog found that members of staff had uploaded data to an unauthorized third-party platform, putting highly sensitive information at huge risk.

Elsewhere across the UK, security capabilities have contributed to a number of incidents, most recently an attack on Dyfed-Powys Police earlier this month, which caused disruption to some non-emergency systems.

“We intend to carry out a reinspection in due course, to assess each sector’s progress in implementing these recommendations,” she said. “Police and fire and rescue ICT systems need to become much more secure.”

FOLLOW US ON SOCIAL MEDIA