CYBER-ATTACKS The Five Eyes warning wasn't for enterprise security officers - It was for local government
 | Chris is Chief Executive of Passpack, a credential management platform used by small organisations and the managed service providers that support them. |
In these disturbing times, Chris alerts us to the real threats of cyber-attacks, which could hit small as well as large public sector organisations, many of which may not be properly prepared. He sets out very practical advice of “where the weak point sits in a council and what a first line of defence looks like without a security function behind it. Property and estates teams sit closer to this than they are usually credited with.” |
On 22 June, the cyber agencies of the Five Eyes alliance [Ed – an intelligence alliance of UK, US, Canada, Australia and New Zealand] published a rare joint statement on artificial intelligence (AI) and cyber risk. The sentence that travelled furthest concerned timing. The agencies wrote that the pace of frontier AI development means cyber risk assumptions can become outdated in months rather than years, and they pressed leaders to act now.
What struck me was the audience for the document. It speaks to organisations employing a chief information security officer, a named individual whose job includes receiving warnings of exactly this kind and converting them into a programme of work.
Larger metropolitan and unitary authorities will usually have someone in that role. Many smaller borough and district councils will not, and nor will most arm's-length management organisations or local authority trading companies. The warning still lands on them, and I would argue it lands harder, since an attacker's shortlist is ordered by ease of entry and small authorities keep appearing near the top of it.
Access management is what I do for a living, so I want to set out where the weak point sits in a council and what a first line of defence looks like without a security function behind it. Property and estates teams sit closer to this than they are usually credited with.
What a working login can open
Think about what a property function holds keys to. Building management systems controlling heating, ventilation and water in civic offices and leisure centres. Door entry and key management platforms covering depots, schools and sheltered housing. Camera systems, contractor portals, asset registers, terrier records, energy dashboards, planning and Land Registry accounts.
Each arrived with its own project, supplier and login, and few authorities have ever pulled the whole set under a single owner. Central IT procures the network and patches the servers. Access to everything on that list has been governed by departmental habit for years, which differs enormously from being governed by policy.
Redcar and Cleveland Borough Council shows what that arrangement costs once anything gets inside. Ransomware took hold in February 2020 and spread through a council that ran largely as one connected system. It reached around 95% of its data and left about 135,000 residents without online services.
Recovery reached £11.3 million, of which central government met £3.6 million. Its leader told MPs afterwards, "We didn't think that we were at risk." That admission describes the position a great many authorities remain in. So, the question I would put to an estates team is narrower than "are we secure." If a facilities officer leaves this month, how many systems will still accept their password next month?
Phishing without the tells
The advisory itself is careful. It says AI lowers barriers for malicious actors and increases the speed and complexity of attacks. That simply means attackers have an easier time researching a target and drafting a malicious message that sounds plausible. Local authorities make the research easy.
Committee papers, contract registers and every payment above £500 are published as a matter of legal duty, which makes them cheap raw feedstock. Clumsy phrasing and the wrong logo once gave people a reason to hesitate over a suspicious email. A password reset request that names the correct framework contract, the right cost centre and a real supplier contact takes that reason away.
Notice where the pressure lands. A stolen password generates no alert and installs nothing, because from the system's point of view, a permitted user has signed in. Security tools look for activity that appears wrong, and a valid credential appears entirely right.
A small authority rarely has anything else standing behind that login, so the password is often the only barrier between an attacker and the systems it opens. The teams most exposed are those whose work is urgent, since a maintenance request marked urgent gets acted on quickly and questioned slowly.
The shared login that nobody owns
The British Library is the clearest recent illustration in the UK public sector. Ransomware took its services down for months in October 2023, and the Library later published a full report of what happened. Its own review concluded the attack most likely began with a remote-access server set up in 2020 for suppliers and IT administrators.
It sat behind firewalls but had no multi-factor authentication (MFA), so stolen privileged credentials were likely all it took to get in. MFA had reached much of the organisation that same year, and the decision to leave this route out on cost grounds was recorded as a risk at the time. The Information Commissioner's Office later noted that the incident escalated because an administrator account lacked MFA
The same pattern turns up in councils, described to me without embarrassment, because it developed for sensible reasons. One login for the building management system, passed between two facilities officers, a maintenance contractor, and whoever covered the last handover. Somebody has to reach a plant room at three in the morning, and no one ever funded a tidier arrangement.
The cost of it is attribution. When something goes wrong the record shows only that the shared account signed in, not who was holding it, so the incident cannot really be reconstructed.
Access tends to outlast the contract it was created for, because withdrawing it is no one's job. The oldest passwords in the estate usually sit on operational systems, since changing one means booking a maintenance window nobody wants. No role in local government is written to own access to the estate's systems, so if you ask who can get in today, the honest answer is usually that no one is sure.
Building a credential baseline without a security function
Sequence matters here more than tooling, and the first step costs nothing but attention. Build an inventory of access: one list covering every system the property function touches, who can sign into each, and which logins are shared. Teams are consistently surprised by their own list, and a spreadsheet finished this month will do more for you than a platform procured next year. Attribution comes second. Give every person their own credential to every system, contractors included, which makes an incident traceable and proper offboarding possible.
Then apply MFA where it counts most, starting with anything reachable from the internet, anything holding tenancy or citizen data, and anything that unlocks a physical door. Older building systems unable to support MFA need a documented decision and a compensating control such as network restriction, precisely the step the British Library review found had been left undone.
Make offboarding a property process as well as an HR one. Tie access removal to contract end dates and leaver dates, and name the estates team as a party to it. Of everything here, that single change delivers the most protection for the least effort. Give people a managed place to keep credentials, so passwords stop living in shared drives, handover packs and phone notes. Then anchor the work externally. The National Cyber Security Centre's Cyber Essentials scheme and its Cyber Action Toolkit supply a vocabulary for members and auditors, and a route into funding conversations that a purely technical framing rarely opens.
Months, not years, means this financial year
Local authorities plan in financial years, and the Five Eyes agencies has described a threat moving in months. No additional funding will arrive alongside its advisory, so the work has to happen in its unglamorous form. Estates professionals already do this job in another guise.
You maintain registers of what the authority owns, what condition it is in, and who is accountable for it. Credentials are simply an asset class nobody has put on the register yet. The gap between an authority that knows who can reach its systems and one that does not amounts to a few weeks of careful, boring work, and that gap will decide which councils spend the next two years delivering capital programmes and which spend them in recovery.
Comments