25% of NHS trusts have zero staff who are versed in security
.jpg)
A quarter of NHS trusts in the UK responding to a Freedom of Information request have no staff with security qualifications, despite some employing up to 16,000 people.
On average, trusts employ one qualified security professional for every 2,582 employees, according to Freedom of Information requests submitted by penetration testing firm Redscan.
Trusts were asked about their cyber, information and data security spending and training, with 159 responding to at least one question.
It found that nearly one in four – 24 of the 108 who responded to this question – had no employees with security qualifications.
However, several of the NHS trusts were reported to have said they had staffers in the process of gaining relevant security qualifications.
This might suggest they recognise the importance of training, or that they struggled to recruit people with the qualifications – or perhaps that they were aware of how the numbers would look amid concerns about NHS security.
Most prominent among these is the 2017 WannaCry malware outbreak – which hit one in three English NHS Trusts and cost the National Health Service £92m, but this is far from the only cyber attack NHS systems face. Meanwhile, there are reports about small-scale data breaches that still affect patients, and about clunky tech in need of updating.
Redscan also asked about training for data security and information governance in the past 12 months, finding that trusts spent an average of £5,356 on data security training, with figures ranging from £238 to £78,000.
This broad variation wasn't related to the size of the trust: mid-sized groups with 3,000 to 4,000 employees spent between £500 and £33,000.
Redscan added that "a significant proportion" had spent nothing on specialist training – but a lot of in-house training does not cost the trusts anything, and they can also rely on free tools from NHS Digital.
This includes free information governance training, which NHS Digital recommends that 95 per cent of all staff should have passed every 12 months.
The FoI found that only 12 per cent of trusts had met this target, but most were not far off, having trained between 80 and 95 per cent of their staff. A quarter said fewer than 80 per cent had completed the training.
However, Mark Nicholls, Redscan director of cybersecurity, said that information governance training was just one part in the information and security picture.
"People remain the weakest link in the cyber security chain," he said. "Despite IG training raising awareness of security risks and common pitfalls, you can never fully mitigate the risks of employees making mistakes or falling for social engineering scams."
More broadly, Nicholls said that, despite getting some extra cash from government for cybersecurity in the aftermath of WannaCry, NHS trusts are still under extreme financial pressure.
This will not only make it harder for the NHS to recruit staff as they struggle to compete with "the private sector's bumper wages", but also put pressure elsewhere in the system.
"No doubt resources are being strained further still if you assume that staff with security qualifications are part of IT teams responsible for far more than just cyber security," he said.
source theregister
Industry: Cyber Security News

Latest Jobs
-
- Network Security Engineer
- Germany
- €550 a day
-
German- based contract opportunity This is an onsite based position, we would need the Network Security engineer to be able to work on the client site 5 days a week Seeking an experienced Network Security Engineer for a leading technology company. Strong expertise in firewall/IPS solutions, proxy solutions, and certificate management is required. Good hands-on experience in networking and web-related technologies necessary. Strong problem-solving skills and the ability to work under pressure are essential. we are looking for a Network Security Engineer with the following experience: · Expertise in Administration, Management & Troubleshooting of Firewall / IPS solutions / Proxy solutions/Certificate Management Solutions · Good Hands-on Experience on security devices (PaloAlto/ /McAfee Proxy/CISCO ISE/Certificate Management) · Good Hands-on Experience in Networking with skills of switching, routing & wireless Technologies · Familiarity with web related technologies (Web applications, Web Services, Service Oriented Architectures) and of network/web related protocol · Configuration of NAT / PAT, firewall policies, profiling, objects, AD-Integration, backup – restore · Knowledge of Subnetting TCP/IP Communication, VLSM Configuration of VLAN VTP · Configuration of Routing Protocols e.g. RIPv1 & v2, OSPF, EIGRP, BGP Knowledge of standard and extended ACL 12 month contract
-
- IAM Consultant
- N/A
- Upto £110,000 depending on level of position
-
Identity Access Management (IAM) Consultant Location: Germany We are seeking an experienced IAM consultants in Germany. we are looking for people from consultant through to Architect, The ideal candidate will have previous IAM deployment experience and be fluent in German. Key responsibilities: Design and implement IAM solutions for clients Provide expertise on industry best practices and standards Troubleshoot and resolve IAM-related issues Work closely with clients to understand their business requirements and provide solutions to meet those needs Qualifications: Previous deployment experience with IAM solutions Fluency in German Strong understanding of IAM technologies and principles Excellent communication and project management skills If you are an experienced IAM consultant with a strong track record of delivering successful projects, please apply today.
-
- ForgeRock Consultant
- Spain
- Upto €85000 plus benefits
-
ForgeRock deployment consultant is needed for this expanding IT Services business within Spain, to act as their ForgeRock technical lead, Responsibilities include: High level and low level design, Scoping the techical needs of the project design, configure, develop and test the forgeRock deployment. We are looking for a strong IAM consultant ideally with ForgeRock experience, Must have strong Oauth 2.0, SAML and API experience
-
- IAM Consultant
- France
- Upto €85000 plus benefits
-
An Identity & Access Management Consultant is needed for an expanding IT Security consultancy, based in France. (Remote role with monthly office meet-ups) The Identity & Access Management Consultant will be responsible for the technical design and implementation of Identity & Access Management/IAM products for a wide variety of clients. Deliver bespoke end-to-end consultancy service to our clients, from gathering requirements through to implementation. Work in a close team designing, developing, and implementing first-class IAM solutions. Manage client relationships, working closely with key stakeholders to continually evaluate business requirements and ensure the highest quality solution delivery. If you are interested we are looking for an individual with Previous experience working within the IAM or CIAM field is essential, Strong knowledge with SAML and Oauth and ideally OpenID Previous experience from any of these technologies: One Identity, SailPoint, Saviynt, Ubisecure, Ping Identity, would be advantageous