I spoke to Tessian about securing government digital services and the role of digital identity and trusted attributes.
The interview drew on my work setting up business transformation at DWP, which distributes around £167 billion of benefits a year in 2.8 million separate payments, and then at the Government Digital Service. Public sector transformation is driven by a mix of efficiency, a better experience for citizens, and the government’s policy agenda, and it has to serve everyone, including people who are vulnerable or cannot deal with government online. Security is integral to leading transformation in that environment, not an afterthought: the vision for the organisation of the future needs a security perspective, which means moving from securing networks and endpoints to designing secure services.
The human factor is critical, both for the people who use government services and for those who work inside government. A digital service balances a low-friction user journey against proportionate controls on risk, and that is only done well by putting users at the centre of the design.
For cybersecurity practitioners working through transformation, I picked out three themes:
- help senior leaders understand cybersecurity, since transformation is a leadership problem
- create the conditions for teams to deliver secure services, because someone in the organisation will attempt secure service design with or without specialist help
- embrace experimentation, safely, so that services keep evolving with the threats they face
Tessian Spotlight: Andrew Besford, former Deputy Director, Government Digital Service, UK Government, Tessian, 30 July 2019
Tessian was an AI-powered email security company focused on reducing human-layer risks in organisations. It was acquired by Proofpoint in 2023.