Building resilience in the public sector: a strategic guide

Beyond traditional cyber security: how to create an effective cyber resilience plan

In an era where cyber threats are growing in scale and sophistication, public sector organisations must go beyond traditional cyber security. While many may feel like they are too small a target to fall victim to the headline-grabbing attacks we see in the news, it is the unfortunate truth that all organisations are at risk, whether they turn over vast amounts of money or not. Therefore, the ability not only to defend against attacks, but also to recover quickly and continue delivering essential services is of paramount importance.

Public sector organisations like your own are prime targets for cyber-attacks due to the sensitive data they hold and the critical services they provide. A successful attack can disrupt operations, erode public trust, and even endanger lives. Cyber resilience ensures that even in the face of an incident, essential functions can continue with minimal disruption.

In this blog, we’ll explore the key components of a cyber resilience plan tailored for public sector bodies, covering both proactive and reactive strategies. Cyber security rests on three core pillars, people, processes and technology – so it’s vital that we consider each of them when defining our strategy.

While not covered in detail in this blog, other important elements to consider are risk, policy and compliance. A strong cyber resilience plan starts with clear governance, which helps define roles and responsibilities, establish leadership accountability and ensure alignment with national cyber security strategies. This aligns with carrying out regular risk assessments to identify critical assets, evaluate threats, and determine your organisation’s risk appetite. The result is that it is easier to prioritise resources and focus on what matters most.

Firstly, let’s look at the proactive aspects of a cyber resilience plan, based on five key areas.

1. Penetration testing

As the saying goes, you don’t know what you don’t know! So, it is absolutely essential that you carry out not only initial testing (if this is something that has not been done before), but continuous testing on at least an annual basis to understand what vulnerabilities exist within a given system, as until these are surfaced, it is impossible to know where to start.

2. Network segmentation and zero trust

If we work on the principle that regular penetration testing is being carried out, the next proactive step to look at with the how systems are architected.

In order to reduce your organisation’s attack surface, it is vital to implement layered security controls such as network segmentation and move toward a “zero trust” , endpoint protection, and encryption—to reduce attack surfaces.

3. Identity and access management 

The importance of multi-factor authentication cannot be overstated. Countless cyber incidents that CyberGuard has assisted with could have been mitigated, had this one control been in place. We live in a world now where most people access their banking online etc, and in almost every case, some form of MFA will be needed to log into this, but many users still don’t see the need to have MFA on their work accounts and systems.

In addition to this, administration rights and user privileges are very often leveraged by cybercriminals for malicious purposes. Implementing strategies such as role-based access control (RBAC) and privileged access management will not only increase your organisation’s overall security posture, by applying tighter controls to what users can and can’t access, it also can mean that should a user account be compromised, the damage that a threat actor is able to do could be lessened.

4. Security awareness training

With the rise of social engineering and phishing, the users of a system are becoming the conduit for so many attacks these days. Therefore, it is absolutely vital that your organisation trains its staff regularly and continuously. Similarly, human error can also be a leading cause of breaches, so awareness is your first line of defence.

5. Threat monitoring

Once we have our systems and infrastructure set out in the most optimum way possible, we then need to ensure that things are actively defended around the clock. This is where an you should look to deploy tools like security information and event management (SIEM) and security orchestration automation and response (SOAR)  to monitor systems in real time on a 24/7/365 basis, and integrate threat intelligence for early warning. Your organisation might not have the personnel to man a security operations centre (SOC) 24/7, so outsourcing this to a third party Managed Security Services Provider (MSSP) should be considered.

Let’s move on now and look at the reactive side of things, specifically, how to respond when things go wrong.

Have a clear incident response plan. Define your response team, escalation paths, and communication strategies. Additionally, it is vital that these plans are rigorously tested on a regular basis (often referred to as an “IR tabletop exercise”) to ensure that, in the event of a real incident, your plan is executed correctly and effectively.

Ensure you can restore critical services quickly. Regularly test your backup and recovery processes. Use the 3-2-1-1-0 backup rule to ensure that your backup and recovery strategies are as effective as possible, should the worst happen:

3 – there should be at least 3 copies of your data

2 - on two different storage media types (e.g. HDD and Cloud)

1 – at least one copy of your data is kept offsite/separate to your primary location

1 – at least one copy of your data is kept air-gapped/immutable

0 – verify that your backup contains zero errors

Enlist incident response expertise

While it may be tempting to try to recover as soon as possible in the heat of a cyber incident, this can sometimes cause more problems (especially if regulatory or data protection standards have been affected. Additionally, today’s sophisticated threat actor groups have many ways to maintain access to a system (also called persistence) even after full system recovery.

Therefore, it is vital to have a professional team of incident responders ensure that threats have been investigated, contained and properly eradicated - before the recovery process begins, as this can save time and effort in the long run.

After an incident, IR responders can also conduct root cause analyses that will enable you to learn from the event and update your defences accordingly.

Final thoughts

Cyber resilience is not a one-time project - it’s a continuous journey. By combining proactive defences with robust response capabilities, public sector organisations like your own can protect their missions and maintain public trust in an increasingly digital world.

Remember that collaboration is key. Cyber resilience isn’t a solo effort. Collaborate with national cyber security centres (like the UK’s NCSC), participate in sector-specific information sharing groups (ISACs), and engage in public-private partnerships. It can also be beneficial to investigate cyber insurance, as this can make a difference and be the backbone of your incident response planning.

Lastly, set clear metrics and KPIs to track your progress. Conduct regular audits and use feedback loops to continuously improve your resilience posture.

If you'd like to learn more about how our solutions can help your organisation build cyber resilience, get in touch with one of our cyber security specialists. You can also explore how CHECK strengthens public sector cyber security, including our case study with the Birmingham Community Healthcare NHS Foundation Trust, where we strengthened and future-proofed their defences while improving usability and reliability.

Martin Clews - Cyber security specialist

Martyn has over 25 years’ experience in IT and eight years’ experience in cyber security. He holds over 30 cyber security accreditations including Microsoft Identity & Security, M365 and the XDR Defender Suite, CrowdStrike, Darktrace, Qualys, AWS Security Fundamentals, KnowBe4, and ISC2.