In a recent report, auditors have raised alarms about the British government’s failure to achieve its 2025 cybersecurity goals. The report highlights a reliance on outdated IT systems, which severely undermines the resilience of government infrastructure against cyber threats. Despite a 2022 strategy aimed at significantly enhancing cybersecurity defenses within three years, it appears that the public sector remains vulnerable, with legacy systems consuming nearly half of the IT budget, hindering progress toward robust security measures.
The Government Audit Office’s analysis underscores the challenges posed by these legacy systems, which not only fail to improve cybersecurity resilience but also exacerbate the risk of security breaches. As of the previous year, government departments were found to depend on 228 legacy systems, with over a quarter of these having a high likelihood of experiencing severe operational and security incidents. The lack of fully funded remediation plans and a disconnect between departmental leaders and cybersecurity risk management contribute to these vulnerabilities.
Cybersecurity incidents surged in the United Kingdom throughout 2024, exposing significant weaknesses in national defenses. A notable incident involved a ransomware attack on a National Health Service IT vendor, resulting in a critical blood shortage. These events underscore the potential threats to public safety and the urgent need for government action to address cybersecurity gaps. Gareth Davies, head of the National Audit Office, emphasized the critical nature of the cyber threat and the necessity for the government to enhance its defenses.
Auditors have indicated that the 2022 strategy’s initial objective of protecting critical systems is already unattainable, and the 2030 goal appears overly ambitious. A review of essential systems revealed deficiencies in fundamental controls, such as asset management and response planning. While the government plans to introduce legislation, including the Cyber Security and Resilience Bill, experts stress the importance of gaining better visibility into legacy systems to address these issues effectively.
Security experts view the report as a crucial wake-up call for the U.K. government to act swiftly. Oz Alashe, CEO of CybSafe, highlights the necessity of understanding the scope and nature of legacy systems to tackle the problem effectively. Initiating comprehensive data collection is seen as a positive step towards addressing the cybersecurity shortcomings that threaten the integrity and safety of government operations.