Understand your data before collecting more
Connecting state and local government leaders
A top-down data review helped Virginia develop a shared service model for cybersecurity.
An organization needs to know what data it is already working with before building an internet-of-things infrastructure that collects still more data on a regular basis, according to government officials who spoke at Symantec’s Dec. 5 Government Symposium.
Reviews of existing datasets also can help with cybersecurity and privacy and guide the build-out of smart city solutions by helping to find gaps in existing information.
“When we came into office, we started asking questions about data: Where is it? Who has access to it? How is it secured?” Virginia's Secretary of Technology Karen Jackson said. "And there had never been a complete data inventory ever done."
Jackson said her office spent about a year reviewing agencies' data with the goal of finding and securing personally identifiable information. In the end, they identified those agencies with the riskiest data, and those with the most PII.
This was the state's first top-down review of agency data, Jackson said. Prior to this review, the knowledge on data was siloed into the specific agencies that collected it.
This information was then used to prioritize the security level of different agencies. Agencies with more PII and more sensitive data will need more resources. But that didn't mean agencies with less PII didn't need help with security as well, Jackson said.
In place for about a year now, shared services allow different agencies to reach out with cyber questions.
Not every agency needs the same level of security, Jackson said. Some need a full-time CISO, others have fewer security requirements, but still need occasional assistance.
John McCaffrey, the CIO for Westchester County, N.Y., said his agency is in the early stages of looking at IoT and smart technology, and an important part of that discussion is the review of the data.
“We’re really tip of the iceberg,” McCaffrey said about the county's smart city efforts. “We’re looking more at the gathering of data then the deployment of IoT at this point.”
The county already collects data from its sewer and water systems, but it has plans to do more with transportation information, which could result in changes to bus routes, he said. Those kinds of changes will also need to be informed with data, specifically ridership numbers, he added.
“You've got to know what you got and where you’re starting from in order to make any kind of sizable achievements or differences,” Jackson said.