E-government security threats focuses on BYOD (bring your own device) as a major risk. BYOD allows personal devices like smartphones and tablets owned by employees, citizens, or contractors to access government networks and data. However, BYOD introduces information security risks because the devices are not owned or managed by the government. Risks include malware, data breaches, and lack of device controls. Governments must conduct risk assessments and treat risks through controls like mobile device management to securely support BYOD while protecting data confidentiality, integrity, and availability.

1. E-Government Security Threats
BYOD – “The Elephant in the Room”
Dr Martin Koyabe
Head of Research & Consultancy (CTO)

2. © Commonwealth Telecommunications Organisation
What is e-Government ?
“ The use by government agencies of information
communications technology to transform relations
with citizens, businesses, and other arms of
government.”
Source: World Bank
2
radically

3. © Commonwealth Telecommunications Organisation
Why e-Government ?
“around 170 out of 193 countries have implemented some
form of ICT (i.e. just having a website or even an email) “
Source: ITU
3
Better
Government
Government
Efficient
ParticipatoryEffective
Accountable
Transparent

4. © Commonwealth Telecommunications Organisation
e-Government Interactions & Relationships
4
Government
Citizens
BusinessG-to-C
C-to-G
B-to-C
C-to-B
G-to-B
B-to-GG-to-G
C-to-C
B-to-B

5. © Commonwealth Telecommunications Organisation
South Korea e-Government Portal
5
Note: Very interactive despite having complex backend processing

6. © Commonwealth Telecommunications Organisation
Swedish Tax Agency Portal
6
Note: Very trusted and easy to use

7. © Commonwealth Telecommunications Organisation
Challenges & Obstacles in e-Government
#1 – Technical
– Lack of adequate IT infrastructure
o public service legacy systems still being used
– Lack of technical knowledge
o in deploying e-government strategic programs
– Lack of efficient & robust secure system
o in terms of information security & data privacy
7

8. © Commonwealth Telecommunications Organisation
Challenges & Obstacles in e-Government
#2 – Political
– Low prioritization of e-Government initiatives
o Lack of policies, regulatory structures & resources
– Poor strategic vision
o Lack of integration with mainstream strategies
– Lack of broad partnerships & collaborations
o with relevant multi-stakeholders
8

9. © Commonwealth Telecommunications Organisation
Challenges & Obstacles in e-Government
#3 – Cultural
– e-Government -> “Big Brother”
o Perception of government spying on its citizens
– e-Government -> “Retrenchment”
o Fears by public service staff about loosing jobs
– Lack of confidence/trust in using e-Government systems
o Poor education and lack of awareness
– General fears
o About loosing control or ownership of information
9

10. © Commonwealth Telecommunications Organisation
Challenges & Obstacles in e-Government
#4 – Legal/Regulatory
– Lack of relevant legislation
o Data protection & privacy laws critical
– Non-existence of cross-border peering agreements
o To apprehend or pursue cybercriminal criminals
– Less friendly regulatory environment
o Need to encourage investment
10

11. © Commonwealth Telecommunications Organisation
Hundreds of
targets
Dozens of
campaigns
Direct/Indirect
attacks
Target Security Threats
Source: Symantec

12. © Commonwealth Telecommunications Organisation
Target Security Threats (per Sector & Function)
Source: Symantec

13. © Commonwealth Telecommunications Organisation
Security Trends Impacting e-Government
13
“The Mobile – Paradigm Shift, is among the four key security
trends impacting e-Government. Others are Malware,
Targeted and Data Breaches attacks. “ Source: Symantec

14. © Commonwealth Telecommunications Organisation
“The Elephant in the Room”
• Bring Your Own Device (BYOD)
– BYOD refers to smart phones and tablets that are not
owned by the organisation
14

15. © Commonwealth Telecommunications Organisation
Unmasking “The Elephant in the Room”
• Despite high rate of BYOD adoption
– Governance not well understood by many organisations
– Initiatives sometimes approved without a business case
– Inadequate information security functions
15
Study on BYOD
Source: ISF/Ponemon Institute

16. © Commonwealth Telecommunications Organisation
Main BYOD Risks
• Caused by ownership of the device
– Exposes organisations to different risk caused by
owners behaviour & constrains available controls
16
Study on mobile devices
Source: ISF/Trustwave Study (2013)

17. © Commonwealth Telecommunications Organisation
How do you manage BYOD risks?
• Approach should be information-centric
– Impact on data (information) should be the focus
17
Physical
Software
Data
• Hardware
• Connectivity
• Operating
system
• Applications
• Information

18. © Commonwealth Telecommunications Organisation
Managing BYOD risks
• #2 A threat and Vulnerability assessment
– Determines the likelihood of that impact
18
• #1 Conduct a Business Impact Assessment
– Impact on organisation should Confidentiality,
Integrity or Availability of information is compromised
– Where applicable, use existing BIA for guidance

19. © Commonwealth Telecommunications Organisation
Managing BYOD risks
• #3 Conduct a Risk Treatment
– Mitigation – applying appropriate security controls
o e.g. malware protection, mobile devise management (MDM) or Data
Loss Prevention (DLP)
– Transfer – risks are shared with an external or via insurance
– Avoidance – risk are avoided by cancelling a particular BYOD initiative
– Acceptance – Business owners take responsibility
19

20. © Commonwealth Telecommunications Organisation
Managing BYOD risks
• Other deployment issues to consider
– Implementing BYOD in the organisation
o Need to define governance structures and policies
– Evaluation
o Collect metrics and user feedback
– Enhancement
o Maintain effective risk management efforts
o Update the BYOD programme strategy and policies
20

21. © Commonwealth Telecommunications Organisation
My thoughts
• BYOD is here to stay
• Ignore BYOD risk at your own peril
• BYOD ownership behaviour adds more risk
• If you want BYOD be prepared to compromise
• BYOD data/stored information is more important
21

22. © Commonwealth Telecommunications Organisation
Finally
• e-Government is not the destination it’s the path
to the destination
22

23. © Commonwealth Telecommunications Organisation
Martin Koyabe
e: m.koyabe@cto.int
m: +44 (0) 791 871 2490
t: +44 (0) 208 600 3815
23
Q & A Session