The social housing sector’s ongoing shift to digital in the provision of services brings with it a whole host of potential risks and threats, writes Rick Goud; resilience in cyber security is vital
While the stock of social housing in the UK may be decreasing due to fewer homes being built, it remains an integral part of the country’s social system.
Social housing offers lower-cost options for individuals and families where rent is strictly controlled and often means tested. Social housing currently accounts for roughly 17% of households in England and Wales, and 23% of households in Scotland – a significant proportion of the population.
Waiting lists for social housing are also on the rise. As of March 2023, there were 1.29 million households on local authority waiting lists in England alone – a year-on-year increase of just over 6%.
Housing associations and local authorities in the UK are busier than ever, and as well as dealing with a growing backlog of applications, they are often relying on outmoded IT infrastructure that leaves them vulnerable to data breaches and cyberattacks.
While the social housing sector may seem like an unlikely target for cybercriminals, the vast amount of sensitive data they hold makes them a lucrative option for coordinated strikes.
Clarion Housing Association, which manages roughly 125,000 properties in the UK, reported a major breach in 2022 that resulted in phone lines and IT systems being taken offline to protect tenant’s sensitive information.
Bromford Housing Association, which has a stock of 40,000 homes, also shut down its systems following what it called a “major cyber incident” which put the data of thousands of renters at risk.
More recently, in December 2023, Connexus – a housing association that operates in Shropshire and Hertfordshire – said it was investigating a security incident involving unauthorised access to its systems, thought to be the result of a phishing-based social engineering attack.
These incidents only scratch the surface of what the social housing sector is currently dealing with. According to research by tax consultancy firm, RSM UK, roughly a quarter (25%) of the country’s housing associations were impacted by a cyberattack between 2022 and 2023, and there are fears that this number is likely to rise.
Where are the vulnerabilities?
Regrettably, the cybersecurity challenges facing the social housing sector are not unique when it comes to public sector operations.
Many are often blending analogue and paper systems with newer digital services in a bid to modernise their operations. However, due to budget constraints and a lack of any cohesive digital transformation strategy, this modernisation is disjointed and faces constant delays and setbacks.
Roughly 60% of UK council leaders say their IT systems are ill-equipped to deal with the increasingly sophisticated cyberthreats they are facing; a sentiment that is likely to be echoed by housing associations, which typically work under – or near – local councils. After all, a chain is only as strong as its weakest link, particularly when it comes to cyberattacks.
The push towards digital transformation in social housing, which is designed to improve efficiency and tenant services, may be exacerbating the problem.
As providers increasingly adopt online platforms for tenant interactions and internal operations, the risk of cyber threats multiplies. This digital shift, while beneficial, demands an equal investment in cybersecurity measures to ensure that advancements in service delivery do not compromise data security – and that is where the issues are emerging.
Human services have human weaknesses
Vulnerabilities in the social housing sector are not just due to technological inadequacies. The human element plays a pivotal role in cybersecurity within the social housing sector, often representing the frontline of defence against cyber threats.
According to a recent survey of security decision makers conducted by Insight Avenue and Zivver, human error was identified as the number one concern in terms of outbound threats for 74% of respondents.
Human errors, such as falling for phishing emails or mishandling confidential information, can lead to significant vulnerabilities. Addressing this requires not only stringent protocols and IT measures, but also a comprehensive education and awareness strategy.
Regular training sessions, up-to-date information on the latest cyber scams, and a culture of cybersecurity mindfulness can empower employees to act as diligent custodians of tenant data, significantly reducing the risk of breaches.
Proactive defence
Implementing proactive cybersecurity measures within the social housing sector has now become an imperative.
Beyond good cyber hygiene on networks, secure communication channels must be established for all internal and external communications, alongside the implementation of data encryption protocols to protect sensitive tenant information during transmission and storage.
For instance, enhancing email security might involve the integration of encryption technologies to ensure the confidentiality and integrity of email communications.
Tools can be deployed that automatically detect sensitive information within an email and then encrypt it, ensuring that sensitive information is only read by the intended recipient.
Additionally, implementing multi-factor authentication adds an extra layer of security, verifying the identity of users before granting access to email systems and sensitive data.
These measures collectively fortify the defences against cyber threats, ensuring that tenant information and organisational data remain protected.
By taking these steps, housing associations can not only defend against the immediate risks they are facing, but also lay the groundwork for future resilience, ensuring the long-term protection of sensitive tenant data.
Rick Goud is CIO and founder of Zivver
Image credit: Rawpixel/Shutterstock
Read next: Great Places’ Dean named successor to long-serving chief
Are you a social housing professional? Sign up for a FREE MEMBERSHIP to upload news stories, post job vacancies, and connect with colleagues on our secure social feed.
