HTN was joined by Julian Wiggins, solutions director at Rackspace Technology, and Nasser Arif, cyber security manager at London North West University Healthcare NHS Trust and Hillingdon Hospitals NHS Foundation Trust, for a recent webinar on the topic of cyber resilience.
Our panel discussed challenges around AI and emerging tech, practical considerations for NHS organisations preparing for the next phase of digital transformation heading toward 2027, operational resilience expectations, supply chain and third-party accountability, and modern cyber strategies.
In his position as cyber security manager at Hillingdon Hospitals and London North West University Healthcare, Nasser talked about needing to manage areas such as incident response, infrastructure compliance, assurance with DSPT and CAF, and cyber awareness training. “I try to find out as much as possible about other departments in the hospital, and gain a big picture understanding of what it is our organisations do on a daily basis and how I can secure that as best I can,” he said.
The NHS approach to cyber has changed over the last few years, according to Nasser, with a lot of cyber work several years ago being focused almost solely on prevention, and stopping things getting “past the net”. Post-COVID, the dependency on so many different digital systems, and even the way we look after our health, has moved on. From a cyber perspective, there are now a lot of dependencies on things we cannot see, he considered, “and if the worst happens, we can’t be in a position where we’ve never practiced something; we need to be ready, so we can bounce back”.
Julian talked about his role with Rackspace Technology, focusing specifically on the NHS, and ensuring that the company fully understands the needs of its NHS customers. “I was looking at how to qualify this discussion a little bit before I started,” he explained, “and although cyber resilience is obviously ensuring our systems have the ability to withstand a level of cyber threat; I think it’s also important we talk about cyber recovery so those systems can be recovered.”
Cyber attacks will be looking to cause as much damage to an organisation as possible, so it’s important to protect things like backups, Julian continued. “It’s not just about having backup systems or systems that can replace others in the event of them being compromised; it’s about having a robust strategy in place so those systems can be recovered.” That is increasingly important now services are being made more digital and common platforms are becoming more a part of the NHS’s ambitions, as it makes the potential value of targeting those systems particularly high.
Ownership of cyber risk
Stakeholder engagement is absolutely critical to maintaining cyber resilience, and promoting a broad understanding of the impact of cyber risks is essential, Julian told us. “As we achieve value from our digital systems, I think it’s important that they’re adequately invested in, such that resilience and recovery plans are budgeted for,” he said. “It’s not just about standing a platform up and migrating operations to it. It’s making sure that platform is robust and resilient in the event of a failure or an attack.”
“Cyber security is not just an IT issue any more,” suggested Nasser. “It’s become more of an organisational issue – we can be there to define what the risk is, talk about the consequences, or provide information on options, but the organisation ultimately needs to decide what amount of risk we’re willing to tolerate, where additional resource is needed, and so on.” It doesn’t always come down to funding, and sometimes simply looking at what is already in place and redesigning how things operate can be enough to make the difference.
Cyber resilience and recovery is now reaching all the way up to board level, largely due to the increased frequency of attacks and the wider scale of their impact, noted Julian. “That prompts discussion, definitely, which tends to revolve around how fantastically robust and secure your systems are, but regardless, there need to be things in place.” Understanding which teams use which systems, and how those teams would be able to function in the event of those systems going down, is vital. It’s also about putting backups in place to allow service continuity, and having a system whereby staff can be informed about what is happening, he went on.
“Us in NHS cyber security are used to protecting the perimeter and looking after systems and platforms within our control,” Nasser explained. “But we’re suddenly moving to a place where patients are being encouraged to use things like fitness trackers and other devices that are outside of that scope. That leaves a lot of reliance on third party suppliers to make sure those devices are safe, and that loss of visibility will be a challenge moving forward.”
What good looks like
Julian and Nasser moved on to explore what “good” looks like for NHS organisations in terms of cyber resilience and recovery, with Julian emphasising the importance of contemplating potential cyber events and the kind of response they would require, prior to them actually happening. What that might look like in practice is coming up with a “minimum viable business” type scenario, with the key systems staff are reliant on identified and plans to emulate those until they can be recovered.
“When I’ve been helping with cyber events, the gravity of the situation cannot be underestimated,” Julian discussed. “You can have fantastic documented processes sitting on your SharePoint site that have been violated, or great runbooks that rely on you communicating with people you no longer have the phone number for – that type of thing makes pre-work enormously valuable.” An idea might be keeping a locked filing cabinet with printed runbooks inside, along with lists of everybody’s phone number, he continued. “Proactivity will really bring value, whether that’s understanding systems, putting in place new infrastructure, looking to immutable backups that cannot be targeted, or having isolated recovery environments with dedicated computing platforms that are there specifically for your cyber recovery.”
The emphasis needs to be on getting the best backup solutions in place, developing immutable or off-site backups, and all around strengthening of recovery processes, Nasser agreed, but without regular testing, that won’t be available to be used to best effect. “I know it can be difficult to find capacity, but we need to be doing more recovery testing and simulation,” he said. “The way things are right now with the current threat landscape, you almost need a separate function purely focused on regularly testing backups and incident response plans.” The group model being adopted by trusts can be highly beneficial because it allows collaboration, Nasser went on. “There’s lots of direct links between organisations both technically and non-technically, so we have to do this together and make sure we’re all on the same page, and that’s the direction I see us heading.”
Investing in planning, and moving forward with activities like war-gaming is a good way to learn about potential vulnerabilities and what the reality of a cyber event might look like for an organisation, Julian told us. “It’s an interesting approach, and it’s very useful, because you might get midway through a simulation and learn something new, like a new system that goes down that you didn’t realise would go down, and then you can look at how you could back that up,” he said.
“I was sitting in on a business continuity exercise a few weeks ago at one of my trusts,” Nasser shared, “and it was about downtime and how certain clinical areas would recover. Our clinical colleagues have a very different recovery mindset, because they plan for that downtime, and they know what happens when you need to switch back to paper, for example, so there’s a lot of learning we can do from them.” As a cyber professional, it’s important to take those opportunities to gain exposure to different areas of the organisation, he considered, as it could lead to the chance to see things from a different perspective.
The Cyber Resilience Bill
Exploring the implications of the Cyber Resilience Bill, Nasser talked about its mention of designating certain suppliers as critical to the NHS, leading to greater obligations around reporting incidents and demonstrating recovery trajectories. “In the past, it would have been simply just asking if they had an incident response plan, whereas now it would be asking for examples of when a supplier has tested their incident response plan,” he outlined. “For us cyber professionals, it gives us something to use as our foundation. Quite often, non-digital teams might just want something done with, and it’s us who are delaying things because we haven’t put it through the full supplier assurance process yet, but it’s finding that balance.”
“Understanding the criticality of some of the service providers, and kicking their cyber resilience and recovery tyres a little bit, to make sure you feel confident in their ability, is important,” said Julian. “Also, we are starting to see a commonality of providers across multiple organisations, and there’s a real opportunity to identify best practice and share knowledge. It’s easy when you’re rolling projects out to pay a level of lip service to these things, but we’re providing clinically vital services using third parties, so we need to make sure they’re up to scratch.”
It may take a while to mature on how we deploy new services using partners, and make sure there’s a robust custody of responsibility all the way through the supply chain, Julian went on, “but I like the fact we’re becoming aware of the impact our suppliers have on our wider clinical outcomes, ultimately, and how essential it is to get a good understanding of our systems and how they perform”.
Two-way conversation about things like recovery timeframes and the levels of support required for different departments is key, according to Nasser. “We have to make sure that we are being very honest, especially with our board and wider organisation, about what we can actually achieve. We need to be more honest about our vulnerabilities, and it takes the right support from senior management to have a culture and environment where teams are able to speak up and admit to areas they might not be performing well in.” The current model of performance reviews and annual appraisals doesn’t work very well in cyber, he acknowledged, “because the nature of our industry is that your objectives could change at any moment”.
What needs to happen to make progress?
When new solutions are being introduced, questions are being asked more regularly to suppliers about recoverability, Nasser observed, as well as simply about compliance and infrastructure. “Questions about recovery point objective and recovery time objective are now being included in a lot of the assurance work I’ve seen across the NHS,” he said, “and I do like that, because it gets the conversation started. It’s not about being perfect, because this is a relatively new kind of era we’re going into where recovery has become a focus; we have to be flexible and work with the suppliers.” Things like the Cyber Resilience Bill will help set that level of expectation on a national basis, he added.
“If we can start thinking about things like resilience requirements when we are doing digital transformation, ensuring digital solutions are robust and able to recover from a cyber incident, we will make progress,” Julian shared. “Making that recovery readiness into KPIs for our platforms so we can almost get a heat map of where our systems are compliant and ready for cyber events and cyber recovery, and where they’re not, means we can start prioritising where we spend time on remediation and preparedness.” A central part of that is understanding the business and clinical value of platforms and making sure you have a plan in place to continue operating in the event they become unavailable, he recommended, “and doing that will give your stakeholders confidence, and help make sure your projects are properly resourced”.
Looking ahead, it would be good to see the cyber security role in the NHS become “a bit more well defined”, Nasser highlighted. “At the moment, every organisation seems to be doing its own thing in terms of the specific types of roles they have, and there isn’t one specific structure we use across the board,” he said. “There’s a lot of work being done nationally to improve that, but we’ve still got some way to go. What I’d like to see is the cyber security role not just being limited to cyber security, and being more exposed to the clinical area; it should be part of our work to have that outreach and those relationships.”
We’d like to thank Julian and Nasser for taking the time to share these insights with us.
