The Challenge

The National Policing Digital Strategy (2020-2030) clearly lays out the challenges faced by UK policing: ‘We need to respond to more complex criminality, requiring more specialist skills, with an accelerating demand from cyber-crime, set against an enduring challenge around efficiency, effectiveness and funding.’

Police forces are entrusted with huge amounts of personal and other sensitive data which must be stored and processed in accordance with information security and legislative requirements. With the increased adoption of digital technology, the sector is seeing a rapid shift to cloud-based services for better citizen engagement, secure hosting, and collaboration. However, traditional technical infrastructure still exists which typically spans wide geographic areas with multiple physical locations such as police stations and kiosks. Policing also has critical systems such as 999 control rooms and national systems supporting operational capability.

There are also compliance requirements from GDPR for protecting personal data to the recently introduced Security Assessment for Policing (SyAP) managed by Police Digital Services.

The common theme for all the above is a need to manage information security risks in a manner that allows policing to deliver its objectives efficiently whilst defending against emerging cyber threats.

The Solution

Aristi has a long history of working with UK emergency services. In 2013, we won the SC Magazine Information Security Project of the Year (Europe) for our work with the South West Fire & Rescue Services. More recently, we acted as independent information assurance advisors to the National Enabling Programmes (NEP) for the development of blueprints for Microsoft 365 collaboration tools which were rolled out across UK police forces during the pandemic. We continue to support national systems as well as individual police forces, providing cyber advice and guidance and risk management.

Aristi is a National Cyber Security Centre (NCSC) approved CHECK penetration test company and we have been testing Police systems since 2016. Our testers hold NPPV3 and security clearances and are familiar with the technologies that constitute a modern Police force IT environment including the nuances and complexities that come with conducting an assessment in a live operational environment.

Large-area and complex networks are assessed in a manner appropriate to the force, which may include testing of representative systems or sample testing if required, in order to ensure that an accurate and detailed picture of the security posture of the force is obtained and reported. We have proven experience in assessing networks of differing security classifications including ensuring that PSNP specific testing requirements are met where appropriate, as well as reviewing system build configurations against national build standards e.g., the NEP blueprints.

We work with forces to ensure that testing of critical infrastructure is handled in a manner that does not impact live services. This could for example include limiting concurrent testing of systems or by structuring the testing activities so that services can be flexibly maintained during the assessment.

The Outcome

We continue to build long term partnerships with our Police clients who trust us to deliver high quality assessments tailored to specific needs. Our experience of policing systems combined with testing expertise provides a unique blend of service that is contextualised and collaborative. From initial engagement and scoping to the delivery of the test report, we work closely with our police clients to ensure they get best value and achieve the outcomes they set out to achieve, whether that be compliance with national standards or gauging the security posture for system assurance.

Our success in delivering cyber services to policing is evidenced by the amount of positive feedback we receive.