UK’s infosec chiefs must be paid more than PM, say officials • The Register

Senior UK civil servants are acknowledging that to secure the nation, they must offer competitive salaries, potentially higher than that of the Prime Minister, to attract top cybersecurity talent. This radical shift in salary strategy is driven by the urgent need to bolster defenses against cyber threats. Historically, the UK has viewed high civil service salaries as unacceptable, but past controversies, like the case of Sue Gray’s remuneration, have shown cracks in this attitude. Today, the government is compelled to rethink its compensation policies to secure the cyber resilience it needs.

The strategy is clear: rather than spreading resources thinly across numerous contractors, the focus will be on placing key cybersecurity professionals in pivotal roles across agencies. Cat Little, COO of the UK civil service, outlined a vision where a few strategically positioned IT leaders can create a multiplying effect across the government. With a digital-specific pay framework, the civil service signals its commitment to attracting and retaining high-caliber cybersecurity experts.

The introduction of high salaries for top cybersecurity talent is not just about retaining talent but about ensuring effective cyber defenses. As PAC member Rachel Gilmour noted, investing in skilled practitioners could alleviate costs associated with recovery from cyber incidents, like the 2023 ransomware attack on the British Library. High-quality talent could deter attacks and minimize recovery costs, presenting a compelling case for increased spending.

Legacy systems remain a vulnerability. The January 2024 NAO report highlighted that legacy accounts for a significant portion of the government’s IT estate, with some departments having as much as 60 percent exposure. This technological antiquity is compounded by a lack of consistent assessment and knowledge across government bodies. The GSG’s GovAssure framework, although a step in the right direction, relies heavily on departments’ self-assessment capabilities.

Information sharing remains a weakness, particularly involving arm’s-length bodies. The complexity of their supply chains and layers of accountability contribute to gaps in understanding and addressing legacy system risks. This fragmentation complicates efforts to build a comprehensive defense strategy against cyber threats.

Why is the UK government reconsidering its pay structure for cybersecurity roles? To attract and retain top talent necessary for securing cybersecurity defenses.

What impact do legacy systems have on the UK government’s cybersecurity? They pose significant risks as they are often outdated and vulnerable, and the lack of consistent assessment exacerbates these vulnerabilities.

For organizations looking to enhance their cybersecurity posture, investing in both seasoned experts and a robust assessment framework can vastly improve resilience.

As the government continues to refine its strategies, it’s crucial for the public and private sectors to collaborate on sharing best practices and data. Subscribe to our newsletter for further insights and updates on cybersecurity developments.