Cyber Security Assessment - Supplementary Report
North Lanarkshire Council · 16 February 2023
Back to Audit and Scrutiny Panel — 16 February 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref: RL/KA/KH Date 16/02/23 Cyber Security Assessment – Supplementary Report From Chief Officers (Audit and Risk) and (Business and Digital) E-mail adamsonk@northlan.gov.uk hassellk@northlan.gov.uk Telephone 07939 280602 07903 096121 Executive Summary During financial year 2022-23, Internal Audit worked alongside Business and Digital to review and assess cyber security practice within North Lanarkshire Council. That assessment – categorised as reasonable assurance - determined the Council has robust and effective information governance arrangements, duly recognises the risks associated with cyber security threats, and operates practices commensurate with the good practice recommended by bodies such as the National Audit Office. This report seeks to supplement Internal Audit’s findings and recommendations – reported separately within the Internal Audit Progress report - through providing Panel members with additional details of cyber security activities performed by the Council. The audit report notes the Council seeks to guard against common cyber security threats and/or attacks through a range of cyber security arrangements, controls, and activities. With the Scottish public sector remaining vigilant against the threat of cyber-attack, and the outage suffered by the Scottish Environmental Protection Agency (SEPA) following the attack on them in 2020 continuing to resonate through this sector and beyond, the broad themes referenced within the Internal Audit report are expanded further in this supplemental Panel report. The Council endeavours to follow good practice guidelines and recommendations in terms of cyber security, but the threat landscape continues to flux making it challenging to achieve a substantial assurance Internal Audit opinion. Notwithstanding this, the Council’s security and risk management function respond positively by continuing to actively monitor how such changes affect the Council’s security posture and the adequacy of existing controls. The active, ongoing monitoring of risk and continual development of the cyber security control set is one of the key focus points of this report. The Cyber Security review and assessment was undertaken in a structured format using templates and guidance created by the National Audit Office, National Cyber Security Centre (NCSC), and Scottish Government. This report therefore follows that same structure to provide Panel members with a high-level overview of the cyber security management principles adopted by the Council. Recommendations The Panel is asked to note the contents of the report.
Page 2
1. Background 1.1 Cyber security is the activity of protecting an organisation’s data, devices, networks, and software from unintended or unauthorised access, change or destruction via the internet or other communications systems or technologies. Cyber incidents pose a significant threat to all organisations and the number of cyber-attacks is growing in terms of both number and sophistication. 1.2 SEPA was the subject of a major cyber-attack in 2020, with investigation findings being released to public sector bodies over the course of 2021-22. In response, the Chief Executive of NLC requested Business and Digital and Internal Audit work together to examine the effectiveness of the Council’s approach to cyber security. Internal Audit used a range of resources to create a ‘good practice’ checklist as the basis of this joint review and assessment. Amongst these were: • National Audit Office’s Good Practice Guide – Cyber and Information Security • NCSC’s Cyber Security Toolkit for Boards • NCSC’s 10 Steps to Cyber Security • SEPA Report – Response and Recovery from Major Cyber Attack • SEPA Report – Lessons Identified for Local Authority senior IT Managers 1.3 Internal Audit sought to provide independent assurance on the adequacy and effectiveness of the Council’s approach to guarding against common cyber security threats and/or attacks. A particular focus was on whether adequate arrangements and controls are in place in accordance with relevant external standards. Internal Audit categorised their findings as reasonable assurance, with those findings and recommendations reported separately within this agenda. 1.4 The adoption of home/hybrid working, the shift to online services, and the rapid uptake of ‘Cloud’ digital services mean that the threat landscape and cyber-risk profile of the Council has altered dramatically in the space of a noticeably short period. 1.5 That said, the Council’s approach to cyber security seeks to follow good practice guidelines and recommendations, which are recognised in several externally validated assessments including: 1.5.1 Annual accreditation with the Public Services Network (PSN) Code of Connection (CoCo), against which the Council is fully compliant. 1.5.2 Annual independent IT health checks which include penetration testing and other testing of the effectiveness of network cyber security controls; and 1.5.3 The council’s ICT resilience capability being evaluated using NCSC’s “Exercise in a Box.” 1.6 This report summarises the areas examined within the recent cyber security assessment. In recognising the prevalent threat landscape makes it challenging to achieve a substantial assurance audit opinion, the report also outlines for the Panel how existing good practice assists in preventing and detecting, and thereafter limiting the impact of significant cyber incidents. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements
Page 3
2. Report 2.1 The internal audit assessment process examined various elements of cyber security that together were deemed to be indicative of good practice. These included technical controls, human factors (including staff training and awareness raising), the risk management approach adopted by the Council and, importantly, operational context. This latter element included the impact of the Covid-19 pandemic and the move to home and hybrid working, and the technical and human security challenges these presented. Additionally, the fast-paced rate of changes to risk factors resulting from the ongoing digitisation of services and the uptake of third party-hosted ‘Cloud’ solutions were a focus of the audit. 2.2 The report produced by Internal Audit provides independent assurance on the adequacy and effectiveness of the Council’s approach to cyber security. Whilst findings were identified through collaboration between Internal Audit and Business and Digital, the audit was based on National Audit Office areas for examination and conducted in accordance with the ’Public Sector Internal Audit Standards.’ 2.3 The audit itself was structured into three sections, each separately subdivided. The audit covered the full breadth of expected cyber security practices, and detailed responses were documented within a checklist spanning 111 different questions, structured as follows: • The National Audit Office’s Cyber and Information Security Good Practice Guide o Approach to cyber security o Cyber and information security risks o Effect of Covid-19 on risk profile and appetite o Identification and deployment of capability • National Audit Office’s Key Controls (based on NCSC Cyber Security Toolkit and 10 Steps to Cyber Security) o Risk management o Engagement and training o Asset management o Architecture and configuration o Vulnerability management o Identity and access management o Data security o Logging and monitoring o Incident management o Supply chain security • Lessons Learnt from SEPA Ransomware Response o Increasing number of people and improving training for people with access to threats o Availability and testing of emergency management, disaster recovery and incident management plans o Enhanced network segmentation controls o Enhanced privileged account management controls o Ensure that recovery plan activities are clearly prioritised o Offline immutable backups
Page 4
2.4 During the initial collaboration and engagement a positive, evidence-based response was given to the topics assessed within the detailed checklist. Five areas were noted where the Security & Risk Management function believed assurance could only be partially given. There are no specific audit recommendations aligned to these areas, but additional commentary is provided below to assure the Panel that mitigating and preventative actions remain ongoing within them: 2.4.1 Approach to cyber security It was noted that the Council does not formally accredit to a scheme such as Cyber Essentials or ISO 27001. Formal accreditation to the PSN Code of Connection (CoCo) is maintained however, as evidence of the Council meeting the cyber security requirements of an external independent body. The process of accrediting with the PSN CoCo requires an annual submission of compliance and the conducting of IT health checks/penetration tests by independent and qualified personnel. In addition, the Council fully complies with the Scottish Government’s Public Sector Action Plan for Cyber Resiliency 2017-2018 and adopts relevant controls including implementation of strategies covering supply chain, email, and active cyber defence measures. And finally, adherence and accreditation with the Payment Card Industry Data Security Standard (PCI DSS) is maintained and relevant cyber security requirements formally adhered to. 2.4.2 Identification and deployment of capability Risks in terms of staff capability and the ability to recruit and retain staff were highlighted. These stem from the rapidly changing threat landscape and modus operandi of attackers, and the exceptionally high demand in the marketplace for experienced security personnel, meaning the public sector has considerable challenges in recruiting and retaining staff. To counter these risks a partnership agreement with a cyber incident responder has been entered into, and a ‘grow your own’ approach adopted, where appropriate, to develop suitably trained personnel. 2.4.3 Enhanced privileged account management controls Whilst privileged user and service accounts provisioned by Business and Digital are well-managed, it is important to note that line of business system user accounts are system owners’ responsibility, this being called out in the council’s Access Control Standard. 2.4.4 Ensure that recovery plan activities are clearly prioritised Resilience and incident response plans are assessed annually using NCSC’s ‘Exercise-in-a-Box’ methodology, most recently by an independent assessor in the employ of the Scottish Business Resiliency Centre. However, individual system owners are responsible for determining the level of criticality and recovery arrangements of their systems; this having been advised to individuals who hold that role. As outlined in paragraphs 2.16 and 2.17 below, service responsibility for recovery planning is being progressed through the Resilience Development Unit, with support as appropriate from Business and Digital. 2.4.5 Offline immutable backups At the time the audit was undertaken and owing to the in-flight procurement of new tooling in this area, it was not possible to give an exact breakdown of the funding (the balance between capital and revenue costs) for the provisioning of offline backups. This has now been determined and the procurement exercise completed.
Page 5
2.5 Turning to the good practice areas specifically identified within the Internal Audit report, Panel members may wish to note the following additional detail: • The Council having appropriate governance structures in place relating to Information Governance and Information Security which includes the Data Governance Board and Data Management Team. Panel members will also wish to note that several other boards, committees, and forums provide insight and direction for information and cyber security. There is representation on the Corporate Management Team where cyber security matters can be presented and if necessary approved. Strategic changes impacting council-wide business objectives have previously been discussed at the Organisational Design Authority with representation from several areas of expertise including information security and risk. New proposals requiring specific tooling and meaningful change to operational process are brought for initial approval at the Enterprise Architecture Governance Group (EAGG). The Technical Design Authority (TDA) acts as a subgroup to the DigitalNL Delivery Board ensuring DigitalNL architectural proposals are well designed, and implications understood. • The Council’s Chief Officer (Business and Digital) being the Senior Information Risk Owner (SIRO) for the organisation has overall authority and responsibility for information governance and security. The Information Risk Manager consults regularly with the SIRO and cyber security matters are co- ordinated by the Information Security and Risk Management Team in liaison with appropriate staff across the council and operational officer working groups. Other industry bodies, such as the NCSC or Digital Office for Scottish Local Authorities provide threat intelligence, as necessary, to the information risk manager to discuss with the SIRO. • The SIRO Annual Report reflects on the Council’s information governance work, including providing an overview of relevant activity including providing assurance that personal data is held securely. Reference is made within the report as to activities which have been undertaken, or are planned, to mitigate against cyber risks. • The Information Risk and Security Team within Business and Digital is responsible for oversight of cyber security. Whilst this team takes lead responsibility, the delivery of security controls and functionality extends beyond them, with nearly all of Technology Solutions personnel responsible for implementing, operating, and maintaining specific security controls within their remit. Furthermore, through ongoing communications and awareness-raising activities, all staff and Council personnel are made aware of their responsibilities for cyber security. • There is an Information Security and Information Governance corporate risk, with corresponding controls and actions identified. This is monitored in accordance with the associated residual risk rating. • There are mandatory information governance and security training modules for staff tailored to suit the needs of individual roles. These training modules, which must be re-taken at appropriate intervals, provide a solid foundation for information and cyber security. On top of that, a programme of continual awareness-raising of cyber security takes place through the introduction of added content or the refreshing of published guidance and leveraging of tooling such as the Council’s phishing email simulator.
Page 6
• Effective communication channels exist within the Council to inform Services and staff of relevant issues and developments in relation to cyber security. The introduction of specific social media-like platforms for generating ad-hoc content and the creation of a security-specific site within the Council’s Intranet (Yammer) has provided a further mechanism to promote good information and cyber security practices. It is recognised that this continual awareness raising through all user emails, Intranet, social media-like platforms, the phishing email simulator, training modules and verbal colleague communications all add to the strengthening of cyber defences and improvement of the Council’s security posture. • The Council’s Cyber Security arrangements have been assessed against the PSN CoCo, with the Council having achieved full compliance. As per many other local authorities and as explained in the audit report, while the Council has elected, for practical reasons, not to seek Cyber Essentials accreditation it nevertheless continues to ensure independently assessed accreditation against a sector-approved cyber security standard. In addition to the PSN CoCo, the Council complies with cyber security arrangements required to adhere to the PCI DSS. • Independent IT Health checks are undertaken annually, including penetration testing and other testing of the effectiveness of network controls. Such testing is conducted by industry-approved and accredited testing organisations and personnel. • Improvements have been made to supply chain management security through adoption of the Scottish Government’s ‘Cyber Security Procurement Support Toolkit’ (CSPST). This ensures the Council now adopts processes that the Scottish Government has recommended be used across the wider Scottish public sector to implement appropriate cyber security within the supply chain. • The Council’s ICT resilience capability has been evaluated through use of the NCSC developed ‘Exercise-in-a-Box’ toolkit. Such testing last happened in December 2022 and was performed in conjunction with a 3rd-party organisation, the Scottish Business Resiliency Centre. • There are robust authentication and access control procedures (including multi-factor authentication) in place to protect Council systems from unauthorised access. This has included the adoption of NCSC recommendations on access control such as using MFA and enhancements to existing access control methods. • A suite of malware protection products has been fully deployed (e.g. antivirus software, web filtering and email malicious content/payload detection systems) in addition to real-time analysis of security threats identified and managed through deployment of Security Incident Event Management (SIEM) software. Such products are regularly reassessed for effectiveness and efficiency and subject to updates as required, with all examples given being changed for new product sets within the last two years. • The Council has procured a cyber incident retainer service meaning professional support can be available on-site at short notice to help limit the impact of any significant cyber incident and to assist in recovery thereafter. This was one of the significant, if not most significant, recommendations emanating from the SEPA attack of 2020.
Page 7
2.6 The Information Security and Risk Team continue to support cyber security with policy development to direct the council’s approach to various aspects of cyber security. An example of this is the new password policy requiring long and strong passwords to access council devices – which further strengthens the technical measures already in place such as Multi-Factor Authentication, etc. 2.7 In addition to policy measures the Information Security and Risk team conduct significant activity in relation to staff awareness via email and staff announcement tools. Activity is split into publicising general good practice and more immediate cyber threats to the Council. 2.8 The use of threat intelligence-gathering tools augments the efforts made in 2.7 as well as informing the adequacy of technical capability. 2.9 Phishing is a type of cyber security attack that attempts to obtain sensitive data such as Username and Password. It attacks the user through mail, text, or direct messages, and with users believing the email, text or message came from a trusted source, they open the attachment activating the malicious code to ‘open the door’ to data breaches, compromised systems and ransomware. Looking to minimise these risks, the Council now operates an email phishing simulator on a pilot basis. This tool enables simulated phishing emails with varying levels of complexity to be sent to Council personnel. Intelligence on the type of malicious emails more likely to be received or opened is used to inform future campaigns. The tool uses short videos to raise awareness for those who click contained in a link in a simulated phishing email. The pilot will run until mid- summer 2023 and will help inform the longer-term strategy for managing the risk posed by phishing emails. 2.10 Building upon this, tooling now exists for staff to alert when suspected phishing emails are received. When used any offending email is deleted from inboxes and forwarded to interested parties for examination. 2.11 As well as awareness training which all staff must undertake to directly address cyber security, related courses cover wider information security concerns, data protection, and records management. All course content is updated regularly and as warranted by changing environmental factors. 2.12 The Council employs a variety of technical measures to bolster its cyber defences to prevent and detect common attacks. These include: • Firewalls • Network segmentation • Web filtering • Intrusion prevention systems • Penetration testing • Health checks • Vulnerability scanning • Regular system and security patching • Anti-malware tools • Conditional access tools being used • Virtual private network technology • Cloud access security brokering • Email protections • Computer policies limiting capability for standard users • Privileged account access management
Page 8
• Role-based access controls • Multi-Factor Authentication • Full disk encryption • Security Incident and Event Monitoring (SIEM) 2.13 Beyond technical considerations, management of the security risk function is robustly maintained and a process for identifying future strategy appropriately applied. With digital now an essential component of modern life and destructive cyber-attacks ever increasing, Business and Digital’s recent restructures expanded the core information security and risk management assurance team. This has grown from essentially being a one-person role less than 3-years ago to a permanent full-time equivalent headcount of 4.8 people. The number of individuals with responsibility for operational maintenance of security tools and functions is, in turn, much larger than that. Risk-based and industry-standard approaches inform future strategies, for example by leveraging maturity assessment frameworks and Scottish Government cyber security benchmarks for the public sector. 2.14 Turning now to Internal Audit’s recommended areas of improvement: • The current Information Security Action Plan needs more clarity in respect of relative priorities, key planned actions, milestones, and timescales. • Proposed arrangements and expectations associated with the refreshed ICT Disaster Recovery Plan need to be finalised and communicated to Services 2.15 The SIRO report available separately on the agenda confirms Business and Digital’s intention to use Gartner’s ‘IT Score for Security and Risk Management’ and the Scottish Government’s Cyber Resiliency Framework to inform and shape future iterations of a risk-based Information Security Action Plan. Panel will wish to note however that this action plan needs to dovetail with the division’s overarching Prioritisation Matrix and Integrated Programme Plan, which allocates workload to employees in accordance with ten criteria including: compliance and security; corporate governance and performance; strategic alignment; cost avoidance and operational risk. Given all required activity is dependent upon employee numbers, skills and capacity, action plan milestones and timescales are necessarily subject to change as there is always a high likelihood that officers will be asked to focus on alternative higher priority tasks. 2.16 The Panel have received regular updates on ICT disaster recovery (DR) in recent years and months and are therefore sighted on the roadmap Business and Digital have been following to refresh outdated arrangements to ensure DR processes are fit for modern ICT service delivery. Roadmap activities are well underway, and the service remains committed to a new DR baseline – clearly detailing a Recovery Point Objective and Recovery Time Objectives for critical systems based on services’ business impact assessments – being completed by June 2023. Business and Digital continue to lead this process, and now have regular interaction with identified Line of Business System Owners regarding differing roles and responsibilities. Notwithstanding this, further dialogue is required through the Resilience Development Unit to ensure services are clear on their responsibilities for DR and Business Continuity Planning (BCP). 2.17 Business and Digital remain committed to supporting previous recommendations from Internal Audit (September 2022) to formally review/challenge - and thereafter test - service DR and BCP to ensure they sufficiently detail the methodology and processes to be deployed to maintain critical service activities in the event of an ICT incident or cyber-attack. Given destructive attacks can lead to compromised systems and communications, and often occur out of hours, the Scottish Government’s Cyber
Page 9
Resilience Unit now recommend all functions update their DR and BCP to recognise that ICT and network services could be unavailable for extended periods of time. Business and Digital will continue to support and advise the Resilience Development Unit and services with formal testing arrangements. 2.18 Whilst this cyber security review and assessment confirms security matters are well managed and practiced within the Council, it must be recognised that the risk of the Council suffering a significant cyber breach cannot be removed. Given the evidence of many industry sectors and individual high-profile organisations being affected by massively disrupting cyber breaches – despite high levels of investment in security controls being present – very few businesses are willing to describe themselves as safe from the threat of being affected by a successful cyber-attack. Panel members are therefore asked to acknowledge that the likelihood of achieving a substantial assurance audit opinion in this area is low. 3. Measures of success 3.1 Ongoing initiatives and investments to enhance cyber security across the council will further protect council information, networks, and devices at a time when the council’s attack surface is growing. The threat environment is becoming increasingly complex and sophisticated. The Council’s approach seeks to reduce the likelihood of a successful attack – but the impact is harder to reduce. It should be remembered that there will always be a risk that an attack is successfully launched against the council however ongoing measures will seek to minimise this threat. 3.2 Immediate activities underway that will enable the security and risk management function to deliver a high-level of performance in a strategic sense, and that can be used to demonstrate measurable success, include: 3.2.1 Completion of the maturity assessment programme currently under way. 3.2.2 Development of the strategy that will inform the activities of the next financial year, and aspirationally beyond that. 3.2.3 Adoption of the Scottish Government’s toolset for more thoroughly assessing and assuring cyber security practices – the Cyber Resiliency Framework. 4. Supporting documentation Internal Audit Report Katrina Hassell Chief Officer (Business and Digital) Ken Adamson Chief Officer (Audit & Risk)
Page 10
5. Impacts ( http://connect/report-template-guidance ) 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts have been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts have been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ If Yes, have all relevant legal impacts have been discussed and agreed with Legal and Democratic? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact?
Page 11
Section 2.12 of the report details several technical measures used by the Council to bolster its cyber defences to prevent and detect common attacks. Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Section 2.5 of the report confirms any new proposals requiring specific tooling and meaningful change to operational process are considered in the first instance by the Enterprise Architecture Governance Group (EAGG) and/or Technical Design Authority (TDA). Yes ☒ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Cyber incidents pose an increasing threat to information management, and therefore give rise to increased risk of service delivery disruption, additional costs, and reputational harm. This report recognises the prevalent threat landscape and outlines for the Panel’s assurance how existing good practice assists in preventing and detecting, and thereafter limiting the impact of significant cyber incidents on Council service delivery. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services.