Why state and local government still struggle with cybersecurity
Connecting state and local government leaders
In addition to mitigating malware and phishing attacks, agencies must build domain name system resilience into their risk management programs.
State and local governments are struggling to deal with a number of cybersecurity threats. Tight budgets, lack of talent in the workforce and the constantly evolving nature of threats are a few reasons why the challenge is mounting. But cybersecurity cannot go neglected. State and local agencies store massive amounts of sensitive constituent data such as Social Security numbers, health care records and driver license numbers. And without a secure infrastructure, the public transportation systems, electric grids and water plants powering our nation’s cities remain vulnerable.
Complex attacks like malware pose a particularly large risk for state and local governments. Such attacks could cast a wide net aimed to negatively impact as many people as possible, or they could be targeted threats designed to attack a specific individual or organization. Both the reputational and financial impact that a cyberattack can have on a state and local entity can cause irreparable damage.
Many state and local agencies have security solutions in place, yet attacks continue. Others have the most basic of protections in place but realize that more is needed as the threat landscape continues to grow and change. But why is a robust cybersecurity solution so hard to find?
The use of the domain name system, a core internet protocol, is a common element exploited in many attacks. Any time an internet user types in a web address like www.example.com, the request is resolved by the recursive DNS infrastructure to recognize the IP address of the physical web server that hosts example.com. A kind of phone book for the internet, DNS translates easy-to-remember resource names into the IP addresses of the server where that resource is located.
But DNS has no capacity to determine if a requested domain comes from a safe source or a malicious one that hosts malware. It does not discriminate between good or bad actors but rather returns the IP address for all requests. This is what makes phishing schemes attractive for cyber criminals. If an agency employee receives a phishing email and clicks on the enclosed link, DNS will answer that request with the IP address of the server that hosts the phishing domain. And unfortunately, very few technologies are available on the market to adequately address phishing issues.
Malware works like any other software when it’s installed on a device – it tries to install additional software or receive updates. The majority of modern malware calls home by making a DNS request to learn which command and control server it should connect to. That makes it easier for enterprise firewalls to block access to malicious sites and trace such attempts.
Bad actors also use DNS data exfiltration, which uses DNS requests to encrypt data and send it outside of the organization. Cyber criminals then unencrypt the information and rent or sell that data, or they may even use it to undertake additional attacks. DNS data exfiltration is attractive for criminals because most typical state and local government organizations are unable to review every packet.
Although many state and local agencies do have endpoint security, firewalls and Secure Web Gateways in place, malicious actors are still able to get through by exploiting weaknesses. For instance, negligent insiders and unpatched vulnerabilities leave agencies susceptible to risk.
Unfortunately, it’s very difficult for any government entity to have a 100 percent effective security. Malicious actors spend significant money and time developing and modifying tools to circumvent security defenses. As new attack vectors evolve, organizations must stay ahead of the threats in order to keep their organizations safe.