25% of NHS trusts have zero staff who are versed in security
A quarter of NHS trusts in the UK responding to a Freedom of Information request have no staff with security qualifications, despite some employing up to 16,000 people.
On average, trusts employ one qualified security professional for every 2,582 employees, according to Freedom of Information requests submitted by penetration testing firm Redscan.
Trusts were asked about their cyber, information and data security spending and training, with 159 responding to at least one question.
It found that nearly one in four – 24 of the 108 who responded to this question – had no employees with security qualifications.
However, several of the NHS trusts were reported to have said they had staffers in the process of gaining relevant security qualifications.
This might suggest they recognise the importance of training, or that they struggled to recruit people with the qualifications – or perhaps that they were aware of how the numbers would look amid concerns about NHS security.
Most prominent among these is the 2017 WannaCry malware outbreak – which hit one in three English NHS Trusts and cost the National Health Service £92m, but this is far from the only cyber attack NHS systems face. Meanwhile, there are reports about small-scale data breaches that still affect patients, and about clunky tech in need of updating.
Redscan also asked about training for data security and information governance in the past 12 months, finding that trusts spent an average of £5,356 on data security training, with figures ranging from £238 to £78,000.
This broad variation wasn't related to the size of the trust: mid-sized groups with 3,000 to 4,000 employees spent between £500 and £33,000.
Redscan added that "a significant proportion" had spent nothing on specialist training – but a lot of in-house training does not cost the trusts anything, and they can also rely on free tools from NHS Digital.
This includes free information governance training, which NHS Digital recommends that 95 per cent of all staff should have passed every 12 months.
The FoI found that only 12 per cent of trusts had met this target, but most were not far off, having trained between 80 and 95 per cent of their staff. A quarter said fewer than 80 per cent had completed the training.
However, Mark Nicholls, Redscan director of cybersecurity, said that information governance training was just one part in the information and security picture.
"People remain the weakest link in the cyber security chain," he said. "Despite IG training raising awareness of security risks and common pitfalls, you can never fully mitigate the risks of employees making mistakes or falling for social engineering scams."
More broadly, Nicholls said that, despite getting some extra cash from government for cybersecurity in the aftermath of WannaCry, NHS trusts are still under extreme financial pressure.
This will not only make it harder for the NHS to recruit staff as they struggle to compete with "the private sector's bumper wages", but also put pressure elsewhere in the system.
"No doubt resources are being strained further still if you assume that staff with security qualifications are part of IT teams responsible for far more than just cyber security," he said.
Industry: Cyber Security News
- Security Analyst. Financial Services. UK. Permanent
CH7863 Security Analyst. End User . Financial Services Security Analyst needed to monitor and manage a security suite of tools within an End User environment. The Security Analyst will be responsible monitoring, configuring, fine tuning, incident management and generally improving the security tool capability. Specific experience with CyberArk, Tripwire Log Center and Tripwire Enterprise is highly desirable). Current experience with Vulnerability management and penetration testing is highly desirable. Specifically the ability to effectively manage 3rd party pen tests. You will be working within a specialist security team reporting to the CISO. Experience working within an end user environment within financial services is highly desirable. Flexible location. This is an exclusive role to DCL Search & Selection. To book a call please use my Calendy link https://calendly.com/chris-holt/arranged-call-with-chris-holt-soc-role-
- DevSecOps - Security design / review consultant. SC Clearance. London
CH7858 London £70,000 DevSecOps - Security design / review consultant. DevSecOps - Security design / review consultant will ensure that newly created, public facing apps are secure by design and by default by aligning them to current / best practice security policies and standards into the design phases. The individual must have a technical software / application development background with specalist experinece in secure architecture design. (Frameworks, processes, best practice etc) Practical experience translating and ensuring that the OWASP top 10, ISO27001, HMG frameworks requirements are reviewed and embedded into project designs which are implemented is essential. Experience working projects through a full development lifecycle is key. You will work along side the design and project teams to idenitfy and mitigate risks throughout the design phases. This is a permanent role. SC clearance is essential as is the ability to get to the London office. (When appropiate #covid) Security DevSecOps consultant. To arrange a discreet call book via https://calendly.com/chris-holt/devsecopp--security-design-review-consultant
- CONTRACTOR Cyber Vulnerability Analyst, NESSUS, Rapid 7, SC clearance required.
Cyber Vulnerability analyst NESSUS, Rapid 7, needed for IMMEDIATE 3 month contract MUST have / be able to achieve UK SC clearance role to work within a live environment within a public sector department. The individual must have experience in using various security methods and tools such as Rapid7 and NESSUS scan for / identify vulnerabilities, prioritise them according to risk and raise appropriate tickets for remediation / follow up. In depth experience utilising Nessus highly beneficial. Current cyber public sector experience highly desirable.
- Internal Security Auditor, Level 1 Service Provider (ISO27001)
- Upto 55,000 plus benefits
Internal Security Auditor ISO 27001, PCI, needed to join a Cyber team within this expanding Fintech business. The Internal Security Auditor will have end to end responsibility for planning, delivering, remediating any findings etc. Experience working within financial services is highly desirable. This Is a great time to join a newly formed and growing Cyber team within a rapidly expanding fintech, that is taking a major share of its market. We are looking for someone with experience, (but not to be limited to) a mix of Information Security standards, frameworks, audit principles, controls / policies and the management and use of the technical tooling etc. ISO 22301, ISO 27001, NIST Cybersecurity Framework etc An ideal candidate will be working within an end user environment with a cyber consultancy background. Experience taking a company through accreditation is highly desirable Experience managing internal stakeholders, technical teams and external third parties essential Flexible working, but with the ability to get into London. This is an exclusive role to DCL Search & Selection.