Redscan, the penetration testing, threat detection and incident response specialist, today announced the results of a series of Freedom of Information (FOI) requests submitted to NHS trusts in the UK.
Redscan found that, on average, trusts have just one member of staff with professional security credentials per 2,628 employees. Some large trusts (with up to 16,000 total employees) have no formally qualified security professionals whatsoever. Expenditure on cybersecurity training over the last 12 months ranged from less than £250 to nearly £80,000 per trust, with no apparent link between the size of trust and money spent. A significant proportion of trusts have spent nothing on specialist cybersecurity or GDPR training for staff, requiring only that all their employees complete free Information Governance (IG) training provided by NHS Digital.
“These findings shine a light on the cyber security failings of the NHS, which is struggling to implement a cohesive security strategy under difficult circumstances,” explained Redscan director of cybersecurity, Mark Nicholls. “Individual trusts are lacking in-house cybersecurity talent and many are falling short of training targets; meanwhile investment in security and data protection training is patchy at best. The extent of discrepancies is alarming, as some NHS organisations are far better resourced, funded and trained than others.”
“WannaCry severely disrupted critical healthcare services across the country in 2017, costing the NHS an estimated £92m. The Government has subsequently increased funding for cybersecurity in the NHS by £150m, while introducing a number of new security policies. There are certainly green shoots of progress, but this doesn’t mask the fact that the NHS is under tremendous financial pressure, is struggling to recruit the skills it needs and must continue to refine its cybersecurity strategy across the UK.”
A breakdown of key stats is as follows:
Cybersecurity qualifications – Trusts were asked how many members of staff held professional data security and/or cybersecurity qualifications: On average, NHS trusts employ one qualified security professional per 2,582 employees. Nearly a quarter of trusts have no employees with security qualifications (24 out of 108 trusts), despite some employing as many as 16,000 full and part-time personnel. Several NHS organisations that employee no qualified cybersecurity professionals reported having staff members in the process of obtaining relevant security qualifications – perhaps an indication of the difficulties hiring trained professionals.
Nicholls: “The cybersecurity skills gap continues to grow and it’s incredibly hard for organisations across all sectors to find enough people with the right knowledge and experience. It’s even tougher for the NHS, which must compete with the private sector’s bumper wages. Not to mention the fact that trusts outside of traditional tech hubs like London and Cambridge have a smaller talent pool from which to choose from.”
“It’s true that NHS trusts outsource key security functions to NHS Digital and other third-party specialists, but I would still expect to see more security professionals employed in-house. No doubt resources are being strained further still if you assume that staff with security qualifications are part of IT teams responsible for far more than just cyber security.
Money spent – Trusts were asked how much money they had spent on data security training during the last 12 months, including any GDPR-related training: Trusts spent an average of £5,356 on data security training, although it’s worth noting that a significant proportion conducted such training in-house at no cost or only used free NHS Digital training tools. GDPR-related training was the most common course type procured for staff. Other training programmes cited included: BCS Practitioner Certificate in Data Protection, Senior Information Risk Owner and ISO27001 Practitioner.
Spending on training varied significantly between trusts, from £238 to £78,000. However, the size of each trust was not always a determining factor. For example, of mid-sized trusts with 3000-4000 employees, training expenditure ranged from £500 to £33,000.
Nicholls: “The figures suggest that some trusts may be lacking the budget required to adequately train their staff on cybersecurity and data protection. While this will not surprise anyone, the extent of the disparity between trusts might. Some trusts are outspending others by a factor of twenty. I worry that this clear divide will have a significant bearing on which trusts are better prepared to prevent, detect and respond to cybersecurity incidents. In any case, the NHS must make efforts to redress this severe imbalance.”
NHS Digital training targets – Trusts were asked to provide data on the total number of full-time and part-time employees to have completed security training over the last 12 months: NHS Digital’s mandatory information governance training requirements state that 95% of all staff must pass IG training every 12 months. The FOI responses revealed that, currently, only 12% of trusts had met the >95% training target and the majority of trusts had trained between 80% and 95% of their staff. A quarter of trusts had trained less than 80% of their staff (some reporting that less than 50% had been trained).
A separate FOI request was also sent to NHS Digital, which declined to provide data on how many trusts had met its Information Governance targets, or how many IT staff and board members had completed dedicated training. NHS Digital did however reveal that 139 Trusts had now undertaken a Data Security Onsite Assessment. This is a marked improvement on the figure released in July 2018 (60), showing that NHS trusts are taking these assessments more seriously and that measures are being implemented at trust level.
Nicholls: “These numbers are definitely more promising, and I’m sure there has been a marked improvement in security training over the last five years, especially since WannaCry. However, it is important to note that gaps still exist. People remain the weakest link in the cyber security chain. Despite IG training raising awareness of security risks and common pitfalls, you can never fully mitigate the risks of employees making mistakes or falling for social engineering scams.
“In order to effectively identify and respond to the latest threats, organisations need to develop a better understanding of hackers’ tactics, techniques and procedures. Only dedicated professionals that closely assess and monitor the threat landscape day-to-day and properly understand how an organisation’s infrastructure is architected can begin to work out how to mitigate evolving risks.”
(86)
