The continuity of public service is being compromised by the increase in cyberattacks in the public sector. How can the crisis be managed and cyber-resilience ensured?
Definition of public service
Public service is defined by the European Parliament as “based on a need of general interest, that is to say, both common and essential to all.” It generally includes:
- the distribution of electricity, gas, and water;
- railways and local public transport;
- postal services and telecommunications.
Among the major principles to which public service actors are subject, adaptability and continuity of the public service are particularly noteworthy.
The continuity of public service in the face of increased cyber threats
Responding to the general interest need
The European Parliament also emphasizes that one of the major principles of public service is continuity: “the service [public] must be provided continuously and on a regular basis (obligation to supply).” This principle ensures that citizens can benefit from their essential services at all times. This is the case, for example, for emergency hospital services or police and gendarmerie services.
The Public Sector Particularly Targeted
With increasing digitalisation, public administrations become prime targets for cyberattacks. Cyber threats are exacerbated by teleworking and the increased use of the Cloud. Dependence on external providers and the emergence of “Ransomware-as-a-service” heighten their vulnerability. In 2023, the public sector was the most affected by cyberattacks, ahead of health and finance.
Indeed, in Europe, between July 2022 and June 2023, 19% of cyberattacks targeted public administrations, according to the latest ENISA report.
In France, between January 2022 and June 2023, 187 cyberattacks targeting local authorities were addressed by the National Agency for the Security of Information Systems (Anssi). Indeed, local and regional authorities and the public hospital sector remain the most targeted, ahead of the state public service.
Examples of loss of public service continuity following a cyberattack
Cyberattack at a hospital centre in Corbeil-Essonnes
In France, in August 2022, the South Francilien Hospital Centre in Corbeil-Essonnes was hit by a cyberattack that significantly slowed down the facility’s operations. The staff could no longer access their internal software. Some essential equipment was put out of service. Its emergency plan had to be activated to ensure care in a highly degraded context. Moreover, a return to normal was observed several weeks after the cyberattack. Healthcare workers had to resort to makeshift methods to barely maintain the continuity of hospital service.
Cyberattack affecting the Danish railway network
In Europe, in November 2022, the Danish railway network experienced a major outage following a cyberattack. The attack targeted the software testing environment of a subcontractor for the train operator DSB. Although indirect, this attack led to the shutdown of the subcontractor’s servers and long-term disruption of rail traffic. The consequence: an inability for many travellers to move, right in the middle of the weekend.
Cyberattack affecting a city and its services
Finally, in 2023, the city of Lille was also faced with a major cyberattack that resulted in the cutting of telephone lines and disrupted access to online services for residents. The officials were forced to stop using their computer tools.
Public service continuity through secure video conferencing
Managing the crisis
In the event of a cyberattack or computer failure, an entire infrastructure can malfunction.
The first step for crisis management teams is to stay in contact with collaborators. In a company as in a public administration, it is also fundamental to maintain a link with clients or citizens.
Secure video conferencing can meet these needs by offering a dedicated and secure communication channel. Crisis management teams continue their discussions, and collaborators stay in touch internally as well as with the outside world.
Tixeo offers a secure video conferencing solution, with end-to-end encryption of audio, video, and data communication flows. Available in the private cloud, certified SecNumCloud, it allows public administrations to benefit from a privileged tool for sensitive meetings and a secure emergency communication tool.
Ensuring cyber-resilience
Secure video conferencing thus enables public organisations to strengthen their cyber-resilience. Faced with an upsurge in cyber threats, administrations today have no choice but to prepare for potential large-scale cyberattacks.
To guarantee the continuity of public service, the secure emergency communication tool must be able to operate off the internet network, with deployment in an on-premise version. Indeed, this type of deployment is carried out directly on the organisation’s infrastructure. Even in the midst of a general network outage, teams continue to exchange information securely. Secure video conferencing thereby limits the recovery time and return to normal.
Moreover, the NIS 2 directive will require many European organisations to implement a secure emergency communication tool by the end of the year.
ANSSI Security Visa: a mark of reliability
For over 6 years, Tixeo has been the only French secure video conferencing solution to be certified and qualified by the ANSSI, thanks to its Secure By Design approach and its end-to-end encryption technology.
