<\/p>\n
Capita was warned in December that the security of the web domain which manages the pensions of 1.7 million members of the Civil Service Pension Scheme (CSPS), lacked \u201cbasic controls\u201d.<\/p>\n
Only after the warning, through what Capita\u2019s chief information security officer (CISO) Luke Beeson acknowledged as a “responsible disclosure,” did Capita enable DNSSEC<\/a> on the CSPS domain.<\/p>\n DNS hijacking\/DNS redirection is the biggest risk if DNSSEC is not enabled, meaning users could type the correct domain name and still go to a malicious site.\u00a0\u00a0<\/p>\n Capita took over CSPS administration on 1 December last year, after a \u00a3239m contract was won in 2023. It has been beset by problems (see box, below<\/a>).<\/p>\n CSPS warning<\/p>\n That same month, a warning to Capita from attack-surface management expert Andrew Jenkinson informed officials at the company, including CEO Adolfo Hernandez, that there were serious vulnerabilities in the CSPS domain. \u00a0<\/p>\n In his initial contact on 6 December, soon after Capita took over CSPS administration, Jenkinson – an expert in areas including Domain Name System (DNS) and Public Key Infrastructure (PKI) security – wrote: \u201cNews of the CSPS issues prompted us to undertake some research as cited experts and the threat intelligence is simply too damning not to try and reach out to you all collectively.\u201d<\/p>\n Jenkinson offers chargeable consultancy work to companies when he unearths security holes. \u201cWe identify vulnerabilities and share that information. Should a company want to take our consulting expertise that is discussed and agreed,\u201d he told Computer Weekly.<\/p>\n The UK government encourages security experts to report any vulnerabilities they discover, with advice on how to respond to such disclosures published by the National Cyber Security Centre<\/a>. Security researchers will often subsequently report those vulnerabilities publicly once they have been resolved by the affected company.<\/p>\n In a follow-up email, Jenkinson told Capita CISO Beeson: \u201cThe report, like our expertise, are not a free service.\u201d Beeson replied: \u201cUnderstood, it would be very helpful to see the report when it\u2019s ready.\u201d<\/p>\n Acted on warnings<\/p>\n Beeson acknowledged in an email to Jenkinson that Capita enabled DNSSEC on the CSPS domain, along with other changes, after his warning.<\/p>\n In an email to Beeson on 5 January this year, Jenkinson wrote: \u201cI am very pleased that following the threat intelligence we shared in December, DNSSEC has been implemented at the top-level domain for civilservicepensionscheme.org.uk, which addressed a key visibility and integrity gap.\u201d<\/p>\n Beeson replied on 14 January: \u201cI\u2019m glad you spotted that we\u2019ve enabled DNSSEC on the CSPS domain.\u201d<\/p>\n In another email to Jenkinson on 27 March, Beeson wrote: \u201cThank you again for all the responsible disclosures you\u2019ve shared. I can assure you that we\u2019re taking them seriously internally and acting on them where we can as we did with the CSPS DNSSEC implementation.\u201d<\/p>\n Bare minimum<\/p>\n Cindy Lawless, a US-based expert in cyber security quality, trust, and DNS security infrastructure, said failure to enable DNSSEC suggests a lack of skills.<\/p>\n \u201cThis is pretty basic bare minimum stuff for managing a website,\u201d she told Computer Weekly. \u201cIt is a serious failure for a site that is financial in nature. Up until the time DNSSEC was enabled anyone could redirect that traffic and pretend to be the pension site. And the end-user wouldn\u2019t really know without digging,\u201d she added. \u201cIt\u2019s a huge blind spot.\u201d<\/p>\n Lawless said there is no way to have the chain of trust authentication without it: \u201cThis is the only way to prove the DNS records are genuine.\u201d<\/p>\n One source told Computer Weekly that a high-threat domain like CSPS \u201cneeds belt and braces,\u201d which DNSSEC provides.<\/p>\n \u201cIn this context not having it is a big red flag, but not catastrophic depending on what else you have next. If [architecture] professionals went to a government or financial services website and it wasn\u2019t there, they would switch it on, they would want belt and braces.\u201d<\/p>\n Steve Forbes, a security expert at UK internet domain registrar Nominet, said: “DNSSEC is an important tool for strengthening domain authenticity and protecting against certain types of DNS tampering, but it also introduces additional operational complexity, so needs to be carefully managed to avoid unintended availability risks.\u201d<\/p>\n Forbes said it should be seen as a single part of a broader security approach, rather than a universal one-size-fits-all solution.<\/p>\n \u201cIt may not be suitable in all situations, and there are other security measures that could be used to reduce the risk of attacks like cache poisoning and tampering in transit – which are common attacks that DNSSEC is used to prevent,” he added.<\/p>\n Responsible disclosure<\/p>\n Beeson offered to pay Jenkinson\u2019s company for work already completed. \u201cWhat value would you place on the work done to date? I ask as we have benefited from your responsible disclosure and therefore, I think it\u2019s right that we pay for that. If you could share what your fee would be we can discuss and agree terms via procurement,” he wrote on 30 March. Jenkinson\u2019s colleague wrote back setting out a price for work done and the fee arrangement.\u00a0<\/p>\n On 7 April, after receiving the fee outline Beeson wrote to Jenkinson: \u201cWe appreciate you reaching out to us to share your concerns regarding Capita\u2019s external security posture. I am also grateful to you for finding the time to offer your services and subsequently share details of your fees were Capita minded to engage you.\u00a0<\/p>\n \u201cI have previously explained to you that I am content with our security posture, which is always under constant review, and improvement, where required. On this basis, I do not think it necessary that Capita engage you and your services.\u201d<\/p>\n A few days later, Jenkinson informed Capita of his intention to release information about the original vulnerability to the regulators and press.<\/p>\n Following this Capita, through its legal representative Eversheds Sutherland, wrote to Jenkinson. It said he had \u201cnot been engaged by Capita to carry out any work on its behalf, nor [had] Capita at any time agreed to pay [him] for any actions [he] may have chosen to take of [his] own volition.\u201d<\/p>\n Computer Weekly asked Capita why DNSSEC was not enabled on the CSPS domain when it went live and why was it only enabled after being warned about vulnerabilities by Jenkinson? The company did not answer.<\/p>\n Computer Weekly also asked why, after offering to pay Jenkinson for what Beeson described as \u201cresponsible disclosures\u201d and future work, did Capita decide not to work with him? The company did not answer.<\/p>\n Capita said: \u201cCapita takes cyber security extremely seriously and we are confident in our security posture. We have a comprehensive, continuously monitored security framework in place, and work transparently with government clients and the National Cyber Security Centre. Our latest annual cyber security maturity assessment – conducted by reputable external independent assessors – assessed us favourably across all dimensions of the National Institute of Standards and Technology (NIST) cyber maturity framework.\u00a0<\/p>\n \u201cOur security measures meet all contractual requirements, and we continually review and strengthen them to keep pace with the rapidly changing security environment.<\/p>\n \u201cCapita received an unsolicited approach from Andrew Jenkinson; we decided not to work with him for multiple reasons.\u201d<\/p>\n BCS, Chartered Institite of IT, Fellow and cyber security expert Daniel Card said: \u201cI can only assume that Capita enabled DNSSEC to respond to a brand and reputational threat\/risk.<\/p>\n \u201cDNSSEC has a place in some rather niche scenarios but generally speaking I advise caution – as mirrored by NCSC guidance etc,\u201d he told Computer Weekly.<\/p>\n \u201cThe technical threat presented to Capita seems overplayed, their response seems like a PR move more than a technical one, and I don’t blame them, they probably felt they had no choice.\u201d<\/p>\n Data breaches<\/p>\n In late March, <\/a>the CSPS scheme experienced\u00a0a minor data breach<\/a> affecting 138 members. According to the outsourcer, the issue led to scheme members being able to view personal annual benefit statements that were not their own. Computer Weekly has seen no evidence to suggest this was related to flaws identified by Jenkinson.\u00a0<\/p>\n