Penetration Test Report (PwC): PwC   HM Revenue and Customs

Review of information security at
HM Revenue and Customs
Final report
Kieran Poynter
June 2008
Kieran Poynter
Review of information security at
HM Revenue and Customs
Final report
June 2008
© Crown copyright 2008
Published with the permission of HM Treasury on behalf of the
Controller of Her Majesty’s Stationery Office.
The text in this document (excluding the Royal Coat of Arms and
departmental logos) may be reproduced free of charge in any format
or medium providing that it is reproduced accurately and not used
in a misleading context. The material must be acknowledged as
Crown copyright and the title of the document specified.
Any enquiries relating to the copyright in this document should be
sent to:
The Licensing Division
HMSO
St Clements House
2-16 Colegate
Norwich
NR3 1BQ
Fax: 01603 723000
E-mail: licensing@cabinet-office.x.gsi.gov.uk
HM Treasury contacts
This document can be accessed at:
www.hm-treasury.gov.uk
For enquiries about obtaining the publication, contact:
Correspondence and Enquiry Unit
HM Treasury
1 Horse Guards Road
London
SW1A 2HQ
Tel: 020 7270 4558
Fax: 020 7270 4861
E-mail: public.enquiries@hm-treasury.gov.uk
Printed on 100% recycled paper.
When you have finished with it, please recycle it again.
ISBN: 978-1-84532-473
PU567
Contents
Foreword by Kieran Poynter 1
I Preface 3
PART 1: THe InvesTIgATIon
II The Investigation – executive summary 7
III Background to The Investigation 13
Iv The circumstances leading up to the data loss 15
v overview of relevant policies and procedures 3 3
vI other organisational issues 3 7
PART 2: THe WIdeR RevIeW
vII The Wider Review – executive summary 4 3
vIII What has changed since the incident? 4 7
IX What has The Wider Review found? 4 9
X How have we gone about our work? 5 3
XI What does good information security look like? 5 5
XII How to get there – the strategy 5 7
XIII Moving in the right direction – HMRC's new organisational structure 6 3
XIv What are we recommending? 6 5
Xv What progress has HMRC made? 89
APPendICes
A Poynter Review terms of reference 9 5
B glossary of key terms and abbreviations 9 7
C The Investigation approach 9 9
d organogram of relevant individuals in HMRC 101
e diagram of key events leading to the loss 103
Foreword by Kieran Poynter
Dear Chancellor,
Information security review at HMRC
I am pleased to submit my report. The report is split into two distinct parts:
• The first part, entitled The Investigation, provides a narrative of how the Child Benefit CDs
were lost and a commentary on the causes of the loss.
• The second part, entitled The Wider Review, is more forward-looking and contains my
recommendations on how to improve information security at HMRC.
Whether working on The Investigation or The Wider Review, my team has consistently had the full
and constructive co-operation of HMRC staff and management. Their reaction to what could have
been a disruptive review has been impressive and I would like to thank HMRC for the time that
has been given and the openness of the interaction.
Yours sincerely,
Kieran Poynter
Chairman and senior Partner of PricewaterhouseCoopers LLP
Review of information security at HM Revenue and Customs 1
I
Preface
I.1 This report contains high level findings and recommendations arising from my review of
information security in HM Revenue and Customs (“HMRC”). The review was commissioned
following the loss of two compact discs containing personal information about families derived
from the Child Benefit Office (“CBO”) computer system. My report sets out a detailed factual
account of the circumstances giving rise to that incident in Part 1.
I.1 In Part 2, I describe the Wider Review I have conducted across HMRC. That part contains
my principal findings of lessons to be learnt and high level recommendations for the future arising
from both phases of the review. In the course of my work I also made several hundred detailed
recommendations, many specific to individual Business Units. In the interests of security and
brevity these are not included in this report. The terms of reference for the review as a whole can
be found at Appendix A.
I.2 Though complementary, the two parts necessarily have different styles to them. The
Investigation summarises a forensic analysis and is quite formal in tone whereas The Wider Review
is written in a more conversational style and is intended to bring to life the findings and
recommendations coming from my review without the need for specialist knowledge.
I.3 In adopting the language used by HMRC, I have inevitably used many abbreviations. A
table giving the full titles for abbreviations used in both parts of this report can be found at
Appendix B.
I.4 The data loss incident arose following a sequence of communications failures between junior
HMRC officials and between them and the National Audit Office (“NAO”). The loss was entirely
avoidable and the fact that it could happen points to serious institutional deficiencies at HMRC.
I.5 The two major institutional deficiencies from which many of the more detailed issues flow
were:
• Information security simply wasn’t a management priority as it should have been,
and
• HMRC had an organisational design which was unnecessarily complex and
crucially, did not clearly focus on management accountability.
I.6 Both of these issues have now been addressed, but a great deal of work will be required to
bring HMRC up to and to sustain the world class standard for information security to which it now
properly aspires. Much can be done in the short and medium term to establish and consolidate
control, but in the longer term, investment is required in new systems. My report sets out
recommendations which when followed will enable HMRC to achieve its ambitions. I am pleased to
acknowledge the progress the Department has made in this area, which is reflected in sections VIII
(What has changed since the incident?) and XV (What progress has HMRC made?) of this report.
I.7 In my view, this represents a great opportunity. Modernising work practices and the
systems which support them should lead to significant efficiency gains as well as the restoration of
the reputation of HMRC.
Review of information security at HM Revenue and Customs 3
I.8 I am pleased to report that HMRC has accepted my findings and recommendations and
has made progress on 39 out of 45 of them, implementing 13 of them. I understand that my
findings and recommendations are consistent with those of Sir Gus O’Donnell arising from his
cross-government review.
4 Review of information security at HM Revenue and Customs
PART 1
The
Investigation
II
The Investigation – executive summary
OveRvIew
II.1 My review team has undertaken a highly detailed analysis of the chain of events leading to
the loss of the Child Benefit data in October 2007 and a full description of the work undertaken
is contained within Appendix C of this report. This work has shown that more than thirty HMRC
officials, from four different departments, and a number of NAO staff, played some part in the
story. It has been a complex task to understand the intricacies of what took place, though there has
been broad agreement of the parties involved as to the chronology of events.
II.2 My review team has concluded that there were a number of factors that contributed to the
loss of the data, but it has not encountered any evidence of malice or knowing disregard for policy
or procedure in any of the circumstances leading to this loss. Rather it was an unfortunate catalogue
of inter-locking factors which, in their totality, triggered the events which unfolded. These factors
can be characterised in two ways:
(a) Factors directly contributing to the loss which, by their nature, are very specific to
the events in question; and
(b) General factors within HMRC, in particular within the four relevant departments,
which are evidence of institutional deficiencies.
II.3 The specific factors directly contributing to the loss of the child benefit data, examined in
greater deta