NHS Digital has launched an organisation-wide cyber security campaign to provide staff with the most up-to-date guidance on how to avoid and mitigate potential cyber threats and data breaches.
With the NHS being one of the biggest direct and indirect targets for cyber criminals, NHS Digital's 'Keep I.T. Confidential' campaign is hoping to educate the workforce on the impact of cyber security on patient safety and care.
As part of the programme run by NHS Digital's Data Security Centre (DSC), staff will be reminded of a host of key cyber security threats that could compromise the NHS' defences. There will also be information on what actions staff can take to reduce the risk of attack.
"Cyber security is the responsibility of all NHS staff and we want to inspire a cultural change by supporting health and care organisations to embed it in their daily best practice," said NHS Digital deputy chief executive Rob Shaw.
"To do this, we need to support all NHS staff on the direct impact of data security on patient care, and the steps they can take personally to reduce this threat."
Areas to be highlighted include weak password hygiene, phishing scams and business email compromise (BEC), keeping devices unlocked, and social engineering campaigns.
The campaign will also aim to reduce 'tailgating' on NHS sites, the practice of cyber criminals attempting to gain physical access to unauthorised areas by following staff or posing as workers.
Physical infiltration is deemed a major cyber security risk given there are a host of vulnerabilities and exploits that require an attacker to be in close proximity to a target device.
"We know how busy NHS staff are so we are helping them to understand the importance of data security and how it can impact on and benefit their working lives, including patient care," Shaw continued.
"NHS organisations are vast and diverse so Keep I.T. Confidential can be tailored to suit the individual needs of health and care providers and their staff."
Cyber security in the NHS has been given far more attention since the devastating WannaCry outbreak in 2017. Attention has not been sufficient to bolster cyber defences, however, with zero Trusts passing cyber security assessments one year after the incident, according to results from April 2018.
Moreover, the results of a freedom of information request published in December revealed the NHS has been spending as little as 250 on cyber security in some areas. The average spend on training across 159 Trusts was 5,356 throughout 2018, but this varied wildly from between 238 and 78,000, and bore no correlation to the size of Trust or its location.
These findings were highlighted again in July this year, with the Institute of Global Health Innovation (IGHI) urging the government to pump more money into cyber security. Its research suggested this was needed in order to plug existing gaps that render the NHS vulnerable to an attack more destructive than WannaCry.
-
RSAC Conference 2025: The front line of cyber innovationITPro Podcast Ransomware, quantum computing, and an unsurprising focus on AI were highlights of this year's event
-
Anthropic CEO Dario Amodei thinks we're burying our heads in the sand on AI job lossesNews With AI set to hit entry-level jobs especially, some industry execs say clear warning signs are being ignored
-
The FBI says hackers are using AI voice clones to impersonate US government officialsNews The campaign uses AI voice generation to send messages pretending to be from high-ranking figures
-
Employee phishing training is working – but don’t get complacentNews Educating staff on how to avoid phishing attacks can cut the rate by 80%
-
Russian hackers tried to lure diplomats with wine tasting – sound familiar? It’s an update to a previous campaign by the notorious Midnight Blizzard groupNews The Midnight Blizzard threat group has been targeting European diplomats with malicious emails offering an invite to wine tasting events, according to Check Point.
-
This hacker group is posing as IT helpdesk workers to target enterprises – and researchers warn its social engineering techniques are exceptionally hard to spotNews The Luna Moth hacker group is ramping up attacks on firms across a range of industries with its 'callback phishing' campaign, according to security researchers.
-
Hackers are using Zoom’s remote control feature to infect devices with malwareNews Security experts have issued an alert over a new social engineering campaign using Zoom’s remote control features to take over victim devices.
-
State-sponsored cyber groups are flocking to the 'ClickFix' social engineering techniqueNews State-sponsored hackers from North Korea, Iran, and Russia are exploiting the ‘ClickFix’ social engineering technique for the first time – and to great success.
-
Have I Been Pwned owner Troy Hunt’s mailing list compromised in phishing attackTroy Hunt, the security blogger behind data-breach site Have I Been Pwned, has fallen victim to a phishing attack targeting his email subscriber list.
-
LinkedIn has become a prime hunting ground for cyber criminals – here’s what you need to knowNews Cyber criminals are flocking to LinkedIn to conduct social engineering campaigns, research shows.
