Microsoft-commissioned study offers concrete guidelines on effective government cybersecurity

Dhakad shares insights from the 
TRPC paper.

Governments are still vulnerable to cyber attacks even though they are spending more on IT resources and increasing budgets on cyber security, according to an independent study from research consultancy firm TRPC, Public Data At Risk: Cyber Threats to the Networked Government. 

The study, commissioned by Microsoft, assessed trends around IT systems and infrastructure being built by governments and the related IT investments, types of public and sovereign data and information stored by governments, as well as the types of cybercrime threats being targeted at governments. 

The study noted that there are still blind spots and weak links in public sector IT management, usage and policies which opens up the government sector to cyber attacks that ultimately affect safety and security of government data, national security, critical infrastructure, and  international diplomacy.

Dhakad noted that government records include public information but also sensitive public data, internal government communications, as well as national security and defence information. "(Criminals) can gain a lot of insights and cause a lot of damage if the data is leaked," he said.

The study established that an unmanaged and unregulated IT supply chain is one of the most powerful ways to allow malware infections to take root inside systems and commit cyber security breaches. 

"Current government efforts to address cyber security to date are often piecemeal at best,” said Dr Peter Lovelock, Director, TRPC. “Two problems are arising for procurement professionals in Asia – the increasing prevalence of infected networks, including in supply chains, and the lack of experience in dealing with actual threats.”

“A more holistic approach towards cyber security must be undertaken if a country is to be 'cyber-ready' – such as setting up of agile and empowered computer emergency response teams (CERTs), to sensitising and educating civil officials, particularly non-IT focused personnel, to regulating and monitoring the IT procurement and purchasing processes, to using trusted technologies capable of defending and responding to cyber security breaches – are all elements of building a safer government ecosystem,” said Keshav Dhakad, Regional Director, Digital Crimes Unit (DCU), Microsoft Asia.

He shared that procurement professionals in the Asia Pacific region are grappling with a rise in infected computers, but do not have much visibility into the infections, and in some cases may not be even aware that a PC is infected, so they do not know what information is being leaked. 

For example, a global survey by security firm ISACA found that just 21.6% of respondents have been subject to an advanced persistent threat (APT) attack, a type of network attack in which an unauthorised person gains access and stays undetected for a long period of time, usually with the objective of stealing data. This leaves the bulk of security professionals with very little actual experience of an actual APT attack.

The ISACA study further noted that many were not taking enough precautions against the threat of an APT. Nearly 82% of respondents had not updated their agreements with vendors who provide protection against APT, while 67.3% of respondents had not held any APT awareness training programmes for employees.

Many security loopholes can be addressed by ensuring that best practices guidelines are enforced for the purchase, maintenance, and upgrading of IT infrastructure and services, according to the TRPC study. This includes following a cyber security roadmap to identify which risk areas require attention and devoting more resources to the problem.

"This is really about cyber-hygiene," Dhakad said, "Cybersecurity can't be taken lightly; just because you haven't seen the damage yet (could just mean) that the damage hasn't been discovered but is already going on."

The study aims to propose a roadmap to senior government policy leaders and business decision makers in non-technical terms that will enable a resilient, reliable and strong cyber security strategy and trusted IT usage frameworks. Such an effective roadmap should include steps to:

• Raise awareness 

Awareness can be built through regular training on cyber-hygiene to government officers and staff. "If you're unaware then you can't make informed decisions," Dhakad explained. 

Mandate usage of genuine and current software products, safer Internet practices, and added malware protection through antivirus solutions. 

Government IT procurement officers, government contractors and agencies should be strictly regulated, audited and sensitised towards the standards of security and safety of public data as well as national security.

• Ensure readiness 

Create a central agency responsible for coordinating cyber security preparedness and prevention protocols and for coordinating cyber security responses in the event of a state-targeted attack. 

Establish a strong and empowered Computer Emergency Response Team (CERT) and create or join a network of trusted CERT partners to share information and cyber threat intelligence and mock attack exercises.

• Prevent attacks 

Building and maintain a safe and secure network infrastructure and clean and genuine IT supply chain through strong IT maintenance and procurement practices. 

Develop, implement and enforce cyber security standards for IT vendors and suppliers for all public sector, particularly for critical infrastructure and sensitive national projects.

• Respond effectively 

Establish domestic, regional and international legal avenues for pursuing redress following a cyberattack. 

Outline best practices for recommended timeframes and standards for constant upgrading and updating software used in the public sector.

• Mitigate damage 

Start a cyberforensics team which can work alongside the CERT, private industry and police to investigate security breaches and prevent further losses. 

Develop or join a cyber security network of other government or international organisations for information, intelligence and alliance-building purposes.
Click here for further details on the study.