Industry · Government
Citizen services that stay online, patched and owned
I assess the portals, agency APIs and vendor-built systems citizens rely on, and turn the findings into a plan that fits procurement and budget cycles.
- Top priorityEdge & WAAPDefacement and floods on citizen sites are public and politically costly.
- Top priorityVulnerabilities & exposureOutdated CMS and framework versions linger on departmental sites.
- Top priorityGovernance & maturitySecurity testing and patch duties are often missing from tenders.
- ElevatedAPI security
- ElevatedMonitoring & visibility
- BaselineMobile apps
In short
Application security for government bodies covers citizen portals, departmental websites, APIs (application programming interfaces) shared between agencies, and the many systems vendors build under tender. I assess edge protection against defacement and floods, patching of internet-facing platforms, data access on agency integrations, and whether contracts require security testing and fixes. The output is a prioritised plan that procurement and budget cycles can absorb.
Where I usually start
- WAAP & API protection assessment
- Exposure management (CTEM) assessment
- Executive briefing or team workshop
The pressure
What government security teams are up against.
- Public, high-profile targetsHacktivists pick government sites for defacement and floods, often timed to news events.
- Vendor-built systemsMost systems are built under tender, and security testing is often missing from the contract.
- Citizen data at scaleIdentity, tax, land and health records make agencies an obvious target for data theft.
- Slow budget cyclesFixes compete for funds set a year ahead, so priorities have to be clear and defensible.
Attack scenarios
The attacks I test your defences against.
Each scenario maps to one of the six areas, so you can see which layer should have stopped it.
Try the attack simulator- Scenario 01Portal flooded during a news eventHacktivists flood or deface a ministry site at a sensitive moment, and the outage becomes the headline.Edge & WAAP
- Scenario 02Outdated plugin on an agency siteA departmental site runs a CMS plugin with a public exploit, and nobody is assigned to patch it.Vulnerabilities & exposure
- Scenario 03Full records from an agency APIAn integration API returns full citizen records to any caller with a valid token, not just the fields needed.API security
- Scenario 04Go-live with no security sign-offA system launches on a tender deadline with no security testing, no patch owner and default admin passwords.Governance & maturity
Recommended
Where I would start with you.
Three engagements that fit this sector best. Each ends in a prioritised plan; delivery is your call.
- 01WAAP & API protection assessmentChecks that citizen portals can absorb floods and block attacks, and that origins are not exposed.2–4 weeksFixed feeSee the service
- 02Exposure management (CTEM) assessmentFinds and ranks outdated, internet-facing systems across departments by real exploitability.2–4 weeksFixed feeSee the service
- 03Executive briefing or team workshopPlain-language briefings for officials and tender committees on what to require from vendors.½–1 dayFixed feeSee the service
Rules you work under
The frameworks I map findings to.
Findings are written so your risk, audit and compliance teams can use them directly. This is orientation, not legal advice.
- Parliament of Sri LankaPersonal Data Protection Act, No. 9 of 2022Applies to public authorities as well as companies, covering citizen data held in government apps.
- National Cybersecurity Authority, Saudi ArabiaEssential Cybersecurity Controls (ECC)The mandatory baseline for Saudi government bodies, with controls that cover web application security.
- TDRA, United Arab EmiratesUAE Information Assurance RegulationInformation assurance controls for UAE government entities and critical sectors, with applications in scope.
- Australian Signals Directorate (ASD)Essential Eight Maturity ModelRequired for Australian federal non-corporate entities. Patching applications and hardening them are two of the eight.
- ISO and IECISO/IEC 27001:2022A common reference for public sector security programmes, and a useful source of security clauses for tenders.
Proof
Programmes I have led, and why they transfer.
My delivery work so far has been in banking and a global group. The controls, failure modes and lessons carry straight across to government.
- 112applications migrated112 bank applications moved to cloud WAAP, wave by waveBanking · A leading Sri Lankan private bankF5 Distributed CloudRead the case
- 120applications protectedAround 120 applications under WAAP, API and bot protectionManufacturing · A global apparel group headquartered in Sri LankaImpervaRead the case
- T1bank vulnerability programmeTier-1 bank scanning upgraded and extended to web applicationsBanking · A Tier-1 Sri Lankan commercial bankTenable Security CenterRead the case
- RASPin-app protection liveIn-app runtime protection live in a customer banking appBanking · A leading private bank’s mobile appZimperiumRead the case
Where I work with government teams
How can government bodies protect websites from defacement and DDoS attacks?
Put every public site behind an edge platform that combines a WAF (web application firewall) with DDoS (distributed denial-of-service) protection, and make sure origin servers accept traffic only from that platform. Patch content management systems and plugins promptly, remove unused admin pages, and monitor for unexpected content changes. Then rehearse what happens when a site goes down, including who speaks to the media.
What security requirements should go into a government software tender?
At minimum: secure development practices, independent security testing before go-live and after major changes, critical findings fixed before acceptance, patch timelines for the life of the contract, logging that feeds your monitoring, and handover of admin access and documentation. Each requirement should be measurable, so acceptance can be refused if it is not met. A short workshop can walk tender committees through these clauses.
Where do government application security gaps usually sit?
Common gaps sit in the long tail: departmental sites on outdated content management systems, test environments left online, and APIs (application programming interfaces) between agencies that return more data than needed. Ownership often becomes unclear once a vendor contract ends. Flagship portals tend to get attention and budget; the smaller, forgotten systems are usually the easier way in.
Can you brief senior officials on application risk?
Yes. Executive briefings run for half a day to a day and explain application risk in plain language: what attackers target, where the organisation stands, and which decisions need leadership support, such as funding or tender requirements. Workshops for technical teams go deeper into specific controls. Each session is fixed-fee and built around the audience and the systems they are responsible for.
Is the assessment independent of any vendor?
Yes. Findings start from your risks, not from a product list, and you can take the plan to any supplier or procurement route. I also head the Application Security Business Unit at Innov8 (Pvt) Ltd, which is one possible delivery option. That relationship is disclosed up front, and choosing Innov8 is never a condition of the assessment.
Other industries