NHS Secure Boundary – the next layer of cyber protection for the NHS

Last summer, NHS Digital announced the NHS Secure Boundary, which aims to strengthen cyber resilience across health and care. Alfie Harvey, strategic delivery lead at NHS Digital’s Data Security Centre, talks about how the project is going.

NHS Digital’s plan to provide world-class next generation firewalls to help protect the increasing digital perimeter of the NHS has reached a significant milestone, York Teaching Hospitals NHS Foundation Trust is the first organisation to be fully integrated into NHS Secure Boundary and will lead the way for other organisations to get on board.

Last summer, we announced the delivery of NHS Secure Boundary and our partnership with Accenture, and we now hope that more NHS organisations will take up this centrally funded service, which will enable us to strengthen cyber resilience across health and care.

Over the past four months, we have been working with organisations across the NHS to develop NHS Secure Boundary as a pilot. This has involved gathering their vital feedback so we can learn the best way to extend this solution across the wider NHS.

One of the key things to come out of the feedback is a clear message that organisations need us to vary our approach to onboarding onto the solution. This allows us to walk them through each step of the process, providing support with a dedicated set of expert resources, tailored to their needs.

Organisations can manage how they go through the onboarding process. If local IT teams want to be more hands on in how they manage their set up, then that is fine and we will take a step back, offering support if and when they need it. We have produced an onboarding manual which details every step from inception through to implementation

So why Secure Boundary?

NHS Secure Boundary is a powerful cyber security tool that gives NHS organisations the chance to control what passes in and out of their digital estate. IT teams can benefit from secure filtering for web content, next generation firewalls, secure DNS services and data loss prevention, among other things.

It also gives us a chance to see a broader picture centrally of what is happening with internet traffic.  The more we can see across the NHS system, the better we can scan for potential threats in real time, detecting and neutralising them to help NHS organisations to protect themselves.

The NHS Secure Boundary also supports essential programs, such as HSCN and Internet First, by helping to modernise security for organisations’ access to the internet. This will give front-line clinicians across organisations the ability to access more timely information and therefore make more informed decisions on patient care.

There are the longer-term strategic objectives to keep in mind, as well.  NHS Secure Boundary supports both the NHS Long Term Plan and the Secretary of State’s Tech Vision. It does this by providing additional protection for accessing the internet, leveraging the cloud, and taking advantage of innovative technologies and services which, in turn, will deliver greater operational efficiencies and better clinical outcomes.

Over the last couple of years, we have been analysing, identifying, neutralising and responding to cyber security risks in the NHS, using data from the Data Security and Protection Toolkit,  our on-site cyber assessments, our Security Operations Centre and our Cyber Security Support Model.

Organisations without specialist cyber security expertise will benefit hugely from the central support delivered by NHS Secure Boundary. NHS Digital and our supporting partners, Accenture, Imperva and Palo Alto Networks, can provide a helping hand, supporting organisations to manage their firewalls and protect internet traffic, though the option is still there to locally manage firewalls.

It also protects HSCN or National Gateway connections as well as local internet breakouts, to a national standard. Internet-facing applications, like appointment booking systems, are often vulnerable to a range of potential threats like Distributed Denial of Service (DDOS) attacks.  The NHS Secure Boundary not only protects these systems, but the patients using them as well.

Next steps

The more NHS organisations that sign up to NHS Secure Boundary, the better for the whole system as it will build an even stronger network to fight against cyber threats and manage attempts to infiltrate the system.

Working with Accenture, Imperva and Palo Alto Networks, we will be focussed on supporting NHS organisations and central network service providers to get them onboard over the next two years with managed support from our partners over the next five years.

There is a centrally funded two-year programme to onboard organisations with a dedicated team on hand to manage and support them, which started in January 2020.

NHS Secure Boundary complements and supports the other services provided by NHS Digital’s Data Security Centre to help mitigate the risks we identified in our analysis of the wider system. These include Microsoft Advanced Threat Protection, our email filtering service, the Cyber Security Support Model, our workforce simulated phishing campaigns and our board level-training, providing both physical protection from threats and better awareness of cyber issues for staff.

Feedback from our early adopter

Shane Martin, Network Manager at York Teaching Hospital NHS Foundation Trust said: “NHS Secure Boundary has given us an extra layer of security for our internet access at almost zero cost for our trust, saving potentially hundreds of thousands on a similar product if we’d had to buy it in ourselves.

“Its next-generation firewall, which identifies potential threats early on and reduces our risk of exposure to hackers, was really appealing to us and the fact that NHS Secure Boundary helps to fulfil the Cyber Essentials+ and Data Security and Protection Toolkit requirements was also a big bonus.

“We’ll be using NHS Secure Boundary’s Web Application Firewall, which will protect all of our external-facing web services from potentially malicious inbound access requests.

“This means that we will be able to host our patient administration systems on our own network, and both community workers and sanctioned external organisations will be able to securely access them from wherever they are.  So, this will enable a much more mobile and connected workforce, allowing clinical information to be available securely at the point of care, be that on our premises or at a patient’s home.

So, NHS Secure Boundary will not only save the trust money, it will ensure that the best possible protection surrounds our most critical systems and allow us to provide an even better level of care to our patients.”

We want more organisations to start sharing in the benefits of NHS Secure Boundary, to help better protect themselves and each other.  To find out more about the potential benefits that NHS Secure Boundary can give your organisation and sign up, contact the mailbox nhssecureboundary@nhs.net