Police and fire services in UK issued urgent warning over 'significant' cyber attack threats

Police and fire services are inadequately safeguarded against cyber attacks due to a reliance on legacy technology and insufficient safeguards against human error, a watchdog has warned.

His Majesty’s Inspectorate of Constabulary and Fire and Rescue Services (HMICFRS) reported that police and fire chiefs view obsolete systems as their single greatest IT security threat.

The watchdog also noted that employing external IT contractors poses further hazards, especially when these firms store sensitive police data.

In addition, several backup systems intended to restore operations following a cyber breach were rated as "unsatisfactory".

Having examined three police forces and three fire and rescue services in England and Wales, inspectors determined that authorities are failing to adequately minimise human mistakes that leave them vulnerable to attack.

In a new report published on Tuesday, Michelle Skeer from HMICFRS said: “Many police forces and fire and rescue services need to update their ICT systems to improve resilience.

“Leaders we spoke to in both sectors identified these ‘legacy systems’ as their highest strategic risk for cybersecurity.

“Modernising ICT across both sectors must become a priority. All the organisations we inspected relied on legacy systems to a greater or lesser extent.”

Senior leaders are left relying on younger, less experienced staff who know more about IT, the report found.

Ms Skeer said: “It wasn’t just a lack of training and awareness that created opportunities for cyber attackers.

“In some of the organisations we inspected, we found poor security controls for staff joining, moving within and leaving the organisation.

“We also found poor password management and a lack of up-to-date approaches, such as multi-factor authentication (where users must provide two or more verification methods to gain access to systems).

“Some forces and services simply aren’t doing enough to prevent human error from increasing the risk of cyber attacks.”

The report makes a series of recommendations including ensuring that all police forces and fire services reach “baseline standards” for cybersecurity, and that the management of third party contractors is improved.

“Underpinning all these problems is a leadership issue,” Ms Skeer said.

“Several senior police and fire leaders we interviewed told us that they didn’t consider cybersecurity to be part of daily operational decision-making.

“This has led to financial investment being directed to other more operational and tangible priorities.

“It is difficult for both sectors to keep up with rapid technological change and cybersecurity-related threats as a result.

“Most senior leaders in both sectors have operational backgrounds.

“They have an expert understanding of operational risks and the investment needed to mitigate them.

“Often, they rely on more junior technical specialists to identify and explain cybersecurity risks and mitigations.”

A national centre for digital management for the fire service should be set up, similar to that in the police, inspectors said.

Ms Skeer added that cyber security should be a “core organisational priority”, and that the major proposed reform of the police service as well as the overhaul of local government could offer a chance to improve.

She said: “The cyber threat to police forces and fire and rescue services is significant and expanding rapidly.

“A major cyberattack is not a hypothetical scenario and successful attacks have been disruptive, put the public at risk and were expensive to fix.

“While there have been gradual improvements, many forces and services still need to urgently redouble their efforts to respond to the increased risk of cyberattacks.”