Archaic legacy tech crippling UK Public Services – IT modernisation expert from Rocket Software comments

Neil Fowler, SVP of hybrid cloud engineering at Rocket Software, an expert in IT modernisation – and has worked on IT modernisation projects with the UK Department of Work and Pensions – offers the following comments on the findings, highlighting the need for better data management, supply chain visibility, and simplified reporting:

"Modernisation within highly regulated sectors such as public services and healthcare needs to be done with careful consideration that mitigates the risks, not just the cost. These organisations hold sensitive personal information which makes them an attractive target for cybercriminals and a lot of legacy technology which can make modernisation projects a challenge. The government needs to fix the source of the problem instead of slapping a bandaid on the symptoms. However, that doesn't mean starting from scratch. Instead of the "rip and replace" approach that inevitably comes with major disruptions to critical services, and instead leverage existing core assets better. This includes investing in permanent staff and training instead of temporary contractors, implementing robust internal data management practices, and recognising the need for increased visibility within the wider supply chain.

"Modernisation without disruption is achievable, but adding more security tools alone will not improve cyber resilience or reduce the number of successful attacks. Each new tool requires additional training and resources, as well as a new reporting structure that is often obsolete as soon as it's functioning and will not translate into meaningful vulnerability management. The lack of interoperability leads to reduced visibility of critical issues for security teams. This means more vulnerabilities, numerous attack vectors, and excessive access for threat actors to exploit, while also contributing to ineffectiveness. Instead, we should adapt a strategic approach that prioritises understanding, operating, and updating systems, including security, in order to improve services in a cost effective manner."