Local Authority Internal Audit Virtual Forum

27 July 2022

Please note:

• All Institute responses are boxed and highlighted blue
• Where the chair comments in that capacity this box is highlighted in yellow
• For confidentiality, the identities of all delegates/attendees are anonymised

Key takeaways

Slides from the session are attached here. Notes below are supplementary. 

Pete Williams - Deputy Director, Internal Audit Specialisms at GIAA and Phil Byrne – Senior Audit Manager, GIAA Digital Data and Technology

• Work across government cuts to the heart of why GIAA was established to generate a birds-eye view and share insight across government, especially in areas of pervasive risk, of which cyber security is a prime example.
• Key to our role is ensuring cyber security receives sufficient attention at the right levels within our organisation.
• You don’t have to spend long on the internet to find headlines relating to cyber incidents. It’s worrying to see cyber security relegated to an afterthought, as though it’s solely a concern for the IT department. If the consequences of a breach are organisation-wide – so must be the shared responsibility for cyber security.
• Some research published yesterday from the US stated that while 99% of security leads agreed that a strong security culture is important, 30% of employees don’t think they play a role in maintaining their company’s cyber security posture.
• If there is a cultural disconnect between the awareness of CISOs and senior leaders, and more of a laissez-faire approach adopted elsewhere, then we as internal audit need to be at the forefront of challenging this.
• Cyber security to many can be a bit of a mystery, there are misconceptions about how to approach cyber security and incident response planning. Perfection is not feasible when it comes to cyber security.
• Data is the lifeblood of what central government and local government do – this data is what will drive your core business processes and core business activities.
• Disruption or loss of date can have a sustained effect on your ability to execute your services, e.g. for DWP and the disruption of benefits. We are talking about taking food out of people’s mouths.
• 40% of cyber-attacks in 2021 affected the public sector. We are in the crosshairs of cyber attackers.
• Ransomware is a bigger target. It takes on many forms and is becoming big business, attacking many sectors. Ransomware is not necessarily a highly technical type of cyber-attack. There is an accepted principle now of purchasing ransomware as a service, in the same way that we may purchase software in this way. Ransomware as a service is now freely available, on a subscription basis, franchise basis or a chance of success basis. These attacks are live, frequent – we need to be alive to those threats.
• Phishing is our weakest link as it involves people. Phishing can be as simple as clicking on an email link, downloading software from the internet, could be enough to take down your system.
• A high proportion of our audit activity in the cyber risk and security space receives lower assurance opinions, which is not a comfortable position to be in when talking about significant government organisations.
• There is a lot of support out there to help us manage cyber security the NCSC has 10 steps.
• Can we afford downtime? Risk of disruption and service delivery means we need a lens on the productivity side and how the business will be impacted if an incident is identified.
• Difficult to build a reputation but easy to lose it, so need to have this in mind when putting our incident plans together.
• Response plans should be living documents. These should be revisited frequently to ensure they stay relevant, reflect core business activity and strategic direction.
• The challenge for us is what we can do with the resources available to us. We could make an industry out of managing cyber risk and creating an incident response pan because of the depth and breadth of the subject. Cyber risk is not just a technology risk. When cyber risk materialises, it will be in one of your operational areas.
• Cyber incident response plans should be in your audit plan in some capacity. We need to be ready for any incident and need to have a plan in place, which is well rehearsed, well planned, regularly revisited and refreshed, so that we are ready when the worst happens.
• Internal audit needs to think about how the cyber incident response plan links with other existing plans – e.g. Business Continuity and Disaster Recovery plans. If these are out of sync with one another, our response won’t be coordinated and may fail to recover what’s needed.
• The cyber supply chain could include cloud hosting or data storage arrangements and so a cyber incident could be in the supply chain.
• Testing the incident plan – have we tested the plan? Does it work? Or did we do theoretical, desk-based testing and not really taken down systems and services to test the response? How do we know our plans are going to work and are we comfortable with the level of testing conducted?
• Governance arrangements – are these arrangements robust enough with sufficient communication and reporting lines? This needs to be revisited frequently. Are plans refreshed in line with any restructuring which may have occurred?
• Need to dedicate time to consider policy stance in relation to ransomware and external comms – how much do we want to publicise? Will we be prepared to pay a ransom demand and does our policy reflect that?

Q&A and chatbox comments

Q: What is good practice in testing cyber response plans?

A: Good practice is taking the testing as far as you can. Some organisations we’ve worked with will not run a live test in terms of taking down their systems and services to test their response capability for fear of not being able to bring them back online. In terms of good practice – take your testing as far as you can without disrupting business activity, which will be different for each organisation, due to their appetite as no one wants a system outage they can’t recover from. Rehearse your plan as much as you can, as often as can so you are ready. Test under different scenarios – when key staff are on annual leave for example, so this is done under worst case scenario, even if it makes for uncomfortable reading.

Q: I was just curious as to your thoughts on how robust are the PSN accreditations around cyber security as a source of assurance?

A: I would say they are robust as source of assurance, but I wouldn’t necessarily rely on this as the only source of assurance. I would take that accreditation as part of a broader suite of accreditation so for example get assurance from penetration testing and vulnerabilities management so whilst I would use this as part of a suite of assurance - I wouldn’t rely on this as the only source.

Q: What are your thoughts about whether internal audit is sufficiently equipped to provide assurance or highlight concerns across all these areas? 

A: We aren’t deep technologists, as much as we are a DDaT team, we are still rooted in governance, risk and control, so these are the terms in which we look at cyber response plans, cyber risk and cyber security. We are internal auditors equipped to ask the right questions, e.g., can you describe your governance framework? Have you tested your plan? There are standards out there we can align against to help us do that, we don’t need to be deeply technical to audit this type of activity. We need to look at this activity through the governance, risk and control angle. Ask the fundamental questions without the technology angle, it’s not out of reach to ask probing, yet valuable questions in terms of how our organisations manage their cyber security risk and it’s within our capability to do that.  

Q: Is this something within the capability of a general auditor, or are there any specific areas which would benefit from getting in a technical specialist to periodically supplement this assurance work?

A: There is value in that because we aren’t deep technologists but there is a need to test our vulnerabilities, e.g. through penetration testing, which is one angle of attack. We have orchestrated external phishing tests to test ourselves as an organisation to test our own awareness to identify potential cyber security incidents. Internal audit is involved in the design of that test to make this realistic. There are many ways we can help, e.g. to help look for vulnerabilities on our systems and services, do discovery exercises to make sure our systems are patched appropriately. Occasionally we do need third party support to do that – e.g. user awareness side of things to ensure sufficient user awareness to detect and prevent cyber incidents or indeed near misses just as much as an actual incident so we can learn lessons from that.