Labour sticks to ‘basic’ $20 cyber defence after attacks, emails show

Britain's opposition Labour Party was using a $20-a-month "basic security" service to protect its website when hackers attempted to force it offline last week and temporarily slowed down online campaigning, according to internal emails seen by Reuters.
Such entry-level protection is not recommended for large organisations at high risk of cyber-attacks, but the messages show Labour has since decided against upgrading to an increased security package on grounds of cost.
Labour and Britain's governing Conservative Party were hit by back-to-back cyber-attacks last week, just days into an election campaign security officials have warned could be disrupted by foreign hackers.
Labour uses the services of cybersecurity firm Cloudflare to help protect its website from attacks, party emails show, but only the level the company recommends for "professional websites, blogs, and portfolios requiring basic security."
After the attacks, the party considered upgrading to the increased security measures used by large organisations to help ensure their websites stay online, but decided the $60,000 annual cost was unjustifiable, according to the emails.
While the lower-tier security package protected the Labour site from major damage, it may not be enough if the party is hit by more sophisticated attacks, said a person with knowledge of the matter.
In a separate message, Labour's head of technology warned that the party could be at increased risk of cyber-attacks on the days of two televised election debates and its upcoming manifesto launch.
A Labour party spokesman declined to comment. Cloudflare did not respond to a request for comment.
A Conservative Party spokeswoman did not respond directly to questions about the type of website defences used by the party.
"We have the appropriate security measures in place to protect the party's IT and web infrastructure so were not disrupted in the recent incident," she said.
Election
The country's security agencies have warned that Russia and other countries may attempt to disrupt the election with cyber-attacks or divisive political messages on social media, a charge Moscow denies.
Officials say initial investigations have found nothing to link the attacks on Labour and the Conservatives to a foreign state.
The attackers used a common and relatively simple technique to attempt to force the parties' web services offline by flooding them with traffic.
Cloudflare says its services help defend against so-called distributed denial-of-service (DDoS) attacks by filtering out malicious website requests and absorbing the additional traffic.
Both Labour and the Conservatives have provided data to the police and Britain's National Cyber Security Centre (NCSC), part of the GCHQ signals intelligence agency, to help investigate the attacks, according to people with knowledge of the matter.
The NCSC said analysis was ongoing following last week's attacks but declined to comment on specific defences used by individual political parties.
"We are confident that the Labour party took the necessary steps to deal with the attack. The attack was not successful," an NCSC spokeswoman said, adding that major parties have been briefed on how to guard against future DDoS attacks.
source teiss
Industry: Cyber Security

Latest Jobs
-
- Contact 12 month- Security Operations- Crowdstrike Falcon Insight EDR / Analyst.
- United Kingdom
- Dependent on experience
-
Security Operations engineer / Analyst with Crowdstrike Falcon Insight EDR experience for a 12 month contract. Experienced Contractor with Crowdstrike Falcon Insight: Endpoint detection and Response (EDR) experience needed - 12 month rolling project. Implementation, configuration and Analyst experience needed with Crowdstrike Falcon Insight: (EDR) Migration project- relocating capability internationally. technically implementing, configuration of that that migration and then transition to BAU role monitoring. DCL Search exclusive associate Project.
-
- SailPoint Consultant
- London
- Upto £75,000 plus benefits
-
SailPoint Consultant is needed for an expanding Financial Service business, this is an exciting time to join the Business as they are in the Process of deploying both IAM and PAM solutions and this consultant will form a key part of the IAM team Location can be flexible but would require the individual to come into the London office a couple of times a month for team meetings and face to face project reviews Duties include · Engage in the Identity & Access Management project to deliver SailPoint IdentityNow and Privileged Access Management · On-board applications and users into IAM tools and customise or configure integrations as required · Regularly review, secure and recertify privileged roles in applications, databases and operating systems · Implement least privilege, just-in-time access, password rotation and vaulting wherever possible · Migrate application authentication to Single Sign-On through the use of SAML and OAuth · Implement and enforce the use of MFA where possible, focusing on critical applications and risky sign-ins · Provide technical support to Centrify and SailPoint users Key experience required: Previous experience with SailPoint, including integrating and deploying into a business, onboarding users and applications, supporting users and performing manual administration tasks. Experience with SAML and OAuth to migrate applications to Single Sign-on. If you are interested in hearing more please reach out to me for more information
-
- Centrify Consultant
- London
- Upto £75,000 plus benefits
-
A Privileged Access Management Consultant is needed for an expanding Financial Service business, this is an exciting time to join the Business as they are in the Process of deploying a Centrify PAM solution,, this consultant will form a key part of the team Location can be flexible but would require the individual to come into the London office a couple of times a month for team meetings and face to face project reviews Duties include · On-board applications and users into PAM tools and customise or configure integrations as required · Regularly review, secure and recertify privileged roles in applications, databases and operating systems · Implement least privilege, just-in-time access, password rotation and vaulting wherever possible · Migrate application authentication to Single Sign-On through the use of SAML and OAuth · Implement and enforce the use of MFA where possible, focusing on critical applications and risky sign-ins · Provide technical support to Centrify users You would also gain expsoure with the IAM toolset as part of an Identity Access deployment. Key experience required: Previous experience with a PAM tool (Centrify would be an added bonus but not essential) including integrating and deploying into a business, onboarding users and applications, supporting users and performing manual administration tasks. Experience with SAML and OAuth to migrate applications to Single Sign-on. If you are interested in hearing more please reach out to me for more information
-
- SOC team lead- Deputy SOC manager - Managed Security Services, Bradford. Exclusive
- Bradford
- £70,000 +
-
SOC team lead- Deputy SOC Manager - Managed Cyber Security Services, Bradford. Exclusive Identifier project. Technical team lead needed to join a Managed Cyber Security Services business. The role will be a hands on lead role and technical escalation point for the team. You will also be responsible for leading, mentoring, growing and developing the team. You will be the deputy SOC manager and be involved in the strategic growth of the capability. A managed security services background is essential, specifically within a managed security operations capability. Current hands on support experience across Firewall, SIEM, Incident Response is essential.