{"id":5012,"date":"2024-05-16T13:25:09","date_gmt":"2024-05-16T13:25:09","guid":{"rendered":"https:\/\/blogs.gov.scot\/digital\/?p=5012"},"modified":"2024-05-16T13:25:09","modified_gmt":"2024-05-16T13:25:09","slug":"security-by-design-and-default-scotaccount","status":"publish","type":"post","link":"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/","title":{"rendered":"Security by design and default \u2013 ScotAccount\u202f\u00a0"},"content":{"rendered":"

Laurie Brown, Digital Information Security Officer, provides strategic information security direction, assurance, and governance across a number of Scottish Government digital public services including the work to introduce ScotAccount.\u00a0<\/strong><\/p>\n

ScotAccount is the secure and simple way to access public services online.<\/span>\u00a0<\/span><\/p>\n

It makes accessing services easier because you can use one account to sign in to a variety of services. You can also verify your identity, if necessary, and choose to save your verified personal information in your ScotAccount, so you can use it again when applying for other public services.<\/span>\u00a0<\/span><\/p>\n

Our approach towards security \u202f<\/span><\/b>\u00a0<\/span><\/p>\n

In my original blog<\/span><\/a>, I introduced you to the principles I use to embed security in service design. These are: (1) Privacy by design and default, (2) Security by design and default and (3) Usability by design and default. Following on from my last blog which focused on \u2018<\/span>Privacy by design and default\u2019<\/span><\/a>, I now share more detail on the second of those three principles \u2018Security by design and default\u2019.\u202f<\/span>\u00a0<\/span><\/p>\n

Security is not just something security professionals are responsible for <\/span>\u2013 <\/span>everyone has a role to play. The National Cyber Security Centre (NCSC) offers some excellent guidance, and the <\/span>information available to individuals and families<\/span><\/a>,<\/span> in particular, is as relevant to how you use ScotAccount as it is to any online service, be that banking, email, shopping or social media.<\/span>\u00a0<\/span><\/p>\n

Security by design and default requires having in place both proactive security measures to protect information from cyber-attack, as well as reactive capabilities to respond to and limit the impact of cyber-attacks. To do this, I use <\/span>NCSC guidance on risk management<\/span><\/a> and wrap this with robust security governance and assurance.\u00a0<\/span>\u00a0<\/span><\/p>\n

I created a methodology to support my security by design and default principle several years ago, which ScotAccount robustly follows. This methodology aligns with the recently published <\/span>UK Government Secure by Design Framework<\/span><\/a>, and ensures effective proactive security measures and reactive capabilities are embedded in the delivery and running of ScotAccount. This helps meet people’s expectations of how they want to interact with government, securely and in a manner which protects their privacy.<\/span>\u00a0<\/span><\/p>\n

Security Governance<\/span><\/b>\u00a0<\/span><\/p>\n

For security governance, again <\/span>NCSC guidance<\/span><\/a> plays an important role for me.\u00a0<\/span>\u00a0<\/span><\/p>\n

To ensure ScotAccount security governance has the right people, structures, and risk management processes in place, I recruited and empowered a team with the required security expertise to help deliver my security by design and default principle and methodology.\u00a0<\/span>\u00a0<\/span><\/p>\n

I also set up a security and privacy governance board to provide robust oversight of the security programme. And I implemented an agile way of working across the security, user-centred design, and product teams to delegate and support rapid risk-based decision making and change management.\u00a0<\/span>\u00a0<\/span><\/p>\n

Security Assurance<\/span><\/b>\u00a0<\/span><\/p>\n

For security assurance, the <\/span>NCSC model<\/span><\/a> provides a great example of my approach. As ScotAccount reaches the latter stages of its Beta phase, the ‘extrinsic assurance’ mechanism as defined in the NCSC model is being given extra focus, through increased efforts around external compliance and certification assessment including the <\/span>UK Government GovAssure scheme<\/span><\/a>. Independent security assessments have already been completed on ScotAccount\u2019s approaches to <\/span>authentication quality<\/span><\/a> and <\/span>verification confidence<\/span><\/a>, with full Medium level compliance in place.<\/span>\u00a0<\/span><\/p>\n

ScotAccount is also examining whether compliance with the UK Government <\/span>digital identity and attributes trust framework<\/span><\/a> would help support potential future interoperability with the <\/span>GOV.UK One Login service<\/span><\/a>.<\/span>\u00a0<\/span><\/p>\n

Coming Next<\/span><\/b>\u00a0<\/span><\/p>\n

In my next and final blog of this series, I will talk more about \u2018Usability <\/span>by design and default\u2019 where I will explore the user experience we want to deliver and how we are making <\/span>ScotAccount<\/span> as widely usable as possible.\u202f\u202f<\/span>\u202f<\/span>\u00a0<\/span><\/p>\n

How to contact the team<\/span><\/b>\u202f<\/span>\u00a0<\/span><\/p>\n

You can subscribe to\u202f<\/span>Scottish Government Digital Scotland newsletter<\/span><\/a>\u202ffor regular updates on ScotAccount and other digital projects.\u202f<\/span>\u00a0<\/span><\/p>\n

If you work for a public service organisation and are interested in finding out more about ScotAccount, or would like to access our test environment, you can get in touch with the team by emailing:<\/span>\u202fscotaccount@gov.scot<\/span><\/a>\u202f<\/span>\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Laurie Brown, Digital Information Security Officer, provides strategic information security direction, assurance, and governance across a number of Scottish Government digital public services including the work to introduce ScotAccount.\u00a0 ScotAccount is the secure and simple way to access public services online.\u00a0 It makes accessing services easier because you can use one account to sign in…<\/p>\n","protected":false},"author":317,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[157,6,400],"tags":[19,146,98,387],"class_list":["post-5012","post","type-post","status-publish","format-standard","hentry","category-digital-identity","category-digital-scotland","category-scotaccount","tag-digital","tag-digital-scotland","tag-identity","tag-scotaccount"],"yoast_head":"\nSecurity by design and default \u2013 ScotAccount\u202f\u00a0 - Digital<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Security by design and default \u2013 ScotAccount\u202f\u00a0 - Digital\" \/>\n<meta property=\"og:description\" content=\"Laurie Brown, Digital Information Security Officer, provides strategic information security direction, assurance, and governance across a number of Scottish Government digital public services including the work to introduce ScotAccount.\u00a0 ScotAccount is the secure and simple way to access public services online.\u00a0 It makes accessing services easier because you can use one account to sign in...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/\" \/>\n<meta property=\"og:site_name\" content=\"Digital\" \/>\n<meta property=\"article:published_time\" content=\"2024-05-16T13:25:09+00:00\" \/>\n<meta name=\"author\" content=\"Stewart Hamilton\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Stewart Hamilton\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/\"},\"author\":{\"name\":\"Stewart Hamilton\",\"@id\":\"https:\/\/blogs.gov.scot\/digital\/#\/schema\/person\/fd47935c780321ad6c4ecbb2f10da552\"},\"headline\":\"Security by design and default \u2013 ScotAccount\u202f\u00a0\",\"datePublished\":\"2024-05-16T13:25:09+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/\"},\"wordCount\":662,\"commentCount\":0,\"keywords\":[\"digital\",\"Digital Scotland\",\"identity\",\"ScotAccount\"],\"articleSection\":[\"Digital Identity\",\"Digital Scotland\",\"ScotAccount\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/\",\"url\":\"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/\",\"name\":\"Security by design and default \u2013 ScotAccount\u202f\u00a0 - Digital\",\"isPartOf\":{\"@id\":\"https:\/\/blogs.gov.scot\/digital\/#website\"},\"datePublished\":\"2024-05-16T13:25:09+00:00\",\"author\":{\"@id\":\"https:\/\/blogs.gov.scot\/digital\/#\/schema\/person\/fd47935c780321ad6c4ecbb2f10da552\"},\"breadcrumb\":{\"@id\":\"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blogs.gov.scot\/digital\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security by design and default \u2013 ScotAccount\u202f\u00a0\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blogs.gov.scot\/digital\/#website\",\"url\":\"https:\/\/blogs.gov.scot\/digital\/\",\"name\":\"Digital\",\"description\":\"Updates from the Scottish Government's Digital Directorate\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blogs.gov.scot\/digital\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blogs.gov.scot\/digital\/#\/schema\/person\/fd47935c780321ad6c4ecbb2f10da552\",\"name\":\"Stewart Hamilton\",\"description\":\"Communications and Engagement Officer\",\"url\":\"https:\/\/blogs.gov.scot\/digital\/author\/stewarthamilton\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Security by design and default \u2013 ScotAccount\u202f\u00a0 - Digital","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/","og_locale":"en_GB","og_type":"article","og_title":"Security by design and default \u2013 ScotAccount\u202f\u00a0 - Digital","og_description":"Laurie Brown, Digital Information Security Officer, provides strategic information security direction, assurance, and governance across a number of Scottish Government digital public services including the work to introduce ScotAccount.\u00a0 ScotAccount is the secure and simple way to access public services online.\u00a0 It makes accessing services easier because you can use one account to sign in...","og_url":"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/","og_site_name":"Digital","article_published_time":"2024-05-16T13:25:09+00:00","author":"Stewart Hamilton","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Stewart Hamilton","Estimated reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/#article","isPartOf":{"@id":"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/"},"author":{"name":"Stewart Hamilton","@id":"https:\/\/blogs.gov.scot\/digital\/#\/schema\/person\/fd47935c780321ad6c4ecbb2f10da552"},"headline":"Security by design and default \u2013 ScotAccount\u202f\u00a0","datePublished":"2024-05-16T13:25:09+00:00","mainEntityOfPage":{"@id":"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/"},"wordCount":662,"commentCount":0,"keywords":["digital","Digital Scotland","identity","ScotAccount"],"articleSection":["Digital Identity","Digital Scotland","ScotAccount"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/","url":"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/","name":"Security by design and default \u2013 ScotAccount\u202f\u00a0 - Digital","isPartOf":{"@id":"https:\/\/blogs.gov.scot\/digital\/#website"},"datePublished":"2024-05-16T13:25:09+00:00","author":{"@id":"https:\/\/blogs.gov.scot\/digital\/#\/schema\/person\/fd47935c780321ad6c4ecbb2f10da552"},"breadcrumb":{"@id":"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/blogs.gov.scot\/digital\/2024\/05\/16\/security-by-design-and-default-scotaccount\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blogs.gov.scot\/digital\/"},{"@type":"ListItem","position":2,"name":"Security by design and default \u2013 ScotAccount\u202f\u00a0"}]},{"@type":"WebSite","@id":"https:\/\/blogs.gov.scot\/digital\/#website","url":"https:\/\/blogs.gov.scot\/digital\/","name":"Digital","description":"Updates from the Scottish Government's Digital Directorate","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blogs.gov.scot\/digital\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Person","@id":"https:\/\/blogs.gov.scot\/digital\/#\/schema\/person\/fd47935c780321ad6c4ecbb2f10da552","name":"Stewart Hamilton","description":"Communications and Engagement Officer","url":"https:\/\/blogs.gov.scot\/digital\/author\/stewarthamilton\/"}]}},"_links":{"self":[{"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/posts\/5012","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/users\/317"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/comments?post=5012"}],"version-history":[{"count":0,"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/posts\/5012\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/media?parent=5012"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/categories?post=5012"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/tags?post=5012"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}