IT Security Strategy - Freedom of information

1. Do you have a formal IT security strategy? (Please provide a link to the strategy)

Yes. Devon County Council’s current IT Security Strategy is part of the wider Digital and Technology strategy which can be viewed on this Devon County Council webpage.

More information can be found on this Devon County Council webpage.

2. Does this strategy specifically address the monitoring of network attached device configurations to identify any malicious or non-malicious change to the device configuration?

Yes.

3. If yes to Question 2, how do you manage this identification process – is it:

A) Totally automated – all configuration changes are identified and flagged without manual intervention.
B) Semi-automated – it’s a mixture of manual processes and tools that help track and identify configuration changes.
C) Mainly manual – most elements of the identification of configuration changes are manual.

Devon County Council can confirm that we hold the requested information, however, we consider this information is exempt from disclosure on the grounds that the law enforcement exemption at Section 31(1)(a) of the Freedom of Information Act 2000 applies.

The reason that this exemption applies is because releasing the requested information would reveal intelligence about our cyber security and information position. If this information were to be released into the public domain, the Council considers that this may increase the number of cyber-attacks against our infrastructure. Furthermore, we consider that releasing intelligence regarding our cyber security position may also increase the chances of an attack against our infrastructure being successful.

Whilst the Council is mindful that there is a public interest in openness and transparency regarding the IT security arrangements of local government organisations, we recognise that local and national government institutions are seeing an increase in the number of targeted cyber-attacks from various national and international sources. As such, we do not consider that there is a public interest in releasing information that might increase the number of these attacks that our organisation may face. We consider that there is a stronger public interest in the council working to uphold the confidentiality, integrity, and availability of our IT infrastructure. For this reason, we consider that the balance of public interest is best served by refusing this request at this time.

4. Have you ever encountered a situation where user services have been disrupted due to an accidental/non malicious change that had been made to a device configuration?

A) Yes
B) No
C) Don’t know

5. If a piece of malware was maliciously uploaded to a device on your network, how quickly do you think it would be identified and isolated?

A) Immediately
B) Within days
C) Within weeks
D) Not sure

6. How many devices do you have attached to your network that require monitoring?

A) Physical Servers: record number
B) PC’s & Notebooks: record number

In response to question 6(A) and 6(B), Devon County Council can confirm that we hold the requested information, however, we consider this information is exempt from disclosure on the grounds that the law enforcement exemption at Section 31(1)(a) of the Freedom of Information Act 2000 applies.

Whilst the Council is mindful that there is a public interest in openness and transparency regarding the IT security arrangements of local government organisations, we recognise that local and national government institutions are seeing an increase in the number of targeted cyber-attacks from various national and international sources. As such, we do not consider that there is a public interest in releasing information that might increase the number of these attacks that our organisation may face. We consider that there is a stronger public interest in the council working to uphold of confidentiality, integrity, and availability of our IT infrastructure. For this reason, we consider that the balance of public interest is best served by refusing this request at this time.

7. Have you ever discovered devices attached to the network that you weren’t previously aware of?

A) Yes
B) No

If yes, how do you manage this identification process – is it:

A) Totally automated – all device configuration changes are identified and flagged without manual intervention.
B) Semi-automated – it’s a mixture of manual processes and tools that help track and identify unplanned device configuration changes.
C) Mainly manual – most elements of the identification of unexpected device configuration changes are manual.

The Council is concerned that releasing the information you have requested, would reveal intelligence about our cyber security and information position. If this information were to be released into the public domain, the Council considers that this may increase the number of cyber-attacks against our infrastructure. Furthermore, we consider that releasing intelligence regarding our cyber security position may also increase the chances of an attack against our infrastructure being successful.

8. How many physical devices (IP’s) do you have attached to your network that require monitoring for configuration vulnerabilities?

Record Number:

9. Have you suffered any external security attacks that have used malware on a network attached device to help breach your security measures?

A) Never
B) Not in the last 1-12 months
C) Not in the last 12-36 months

10. Have you ever experienced service disruption to users due to an accidental, non-malicious change being made to device configurations?

A) Never
B) Not in the last 1-12 months
C) Not in the last 12-36 months

11. When a scheduled audit takes place for the likes of PSN or Cyber Essentials, how likely are you to get significant numbers of audit fails relating to the status of the IT infrastructure?

A) Never
B) Occasionally
C) Frequently
D) Always