Connecticut's cyber strategy

At the National Association of State CIOs Midyear conference in Baltimore, Connecticut CIO Mark Raymond spoke with GCN about a recent WannaCry attack on 160 government computers and how his state is implementing its Connecticut Cybersecurity Strategy.

Raymond’s answers have been edited for length and clarity.

What happened in the February WannaCry attack?

We had 160 machines that were affected by the attack.  Nothing was encrypted and it was an old variant of the virus. We detected the movement of a worm-like virus through the network and contained it.  The worm side of the virus spreads through unpatched machines. 

For the majority of the machines, we had 30,000 machines fully patched and ready to go, which is why the spread was smaller. Through the process, we found things that agencies thought that they were patching or third-party endpoint solutions that perhaps were not being updated.  Those were the ones that created an anomaly.  We had to take those offline and reimage them to make sure that no data was lost before patching them and getting them back in operation.

How do you work with federal agencies on cybersecurity?

We have the folks at the Department of Homeland Security who help to coordinate broader resources that are available to us like the Information Sharing and Analysis Centers.  We share those insights with our private businesses and law enforcement.  Most of our contacts are through the Multi-State ISAC, so we use them, the fusion center and InfraGard [a partnership between the FBI and the private sector for critical infrastructure protection]. to really get the right people at the table to understand our current status and what we need to do.

What about at the municipal level?

Municipalities would like us to do much more, but neither one of us have the funding to do it.  We have a special section in our upcoming cybersecurity action plan about how to treat things at the municipal level.  Connecticut doesn’t have county governments, so we have regional councils that we work with to identify common needs and areas where we can help or they can begin to work together.  We are seeing some of the municipalities work together to provide services to each other. 

We also have the Connecticut Education Network, which connects 106 of 169 towns through fiber optics.  We are using that to provide some services like a managed firewall or distributed denial of service protection to municipalities that could not afford it on their own.  We are leveraging our network to improve the security. 

How are agencies using multifactor authentication?

We use MFA for all of our administrative users and state employees who are accessing our systems from the outside.  It is mandatory for folks to be able to get in.  We look at the user population based on the criticality of what they are looking at and then transition from single factor to multifactor. 

We are running a pilot for our pension population, which is folks who have retired.  We put a new pension system online.  We would like for them to do more self-service, but we need to have a higher degree of service for that.  We are extending MFA to that pilot, which needs to work with a wide range of audiences and technologies.  Retirees can pick up and move some place else, so doing things with paper forms isn’t necessarily the best way to deal with that population.  They are okay with engaging online, but we may need to support the desktop technology or they may only have a smartphone or flip phone. 

How is your IT operations structured?  What applications have moved into the cloud?

We are federated when it comes to IT, and some of the larger agencies have substantial IT staffs. Some of the smaller ones have none and rely entirely on us.  We are the infrastructure provider for consolidated networks, data centers, email services and some security.  The Department of Transportation or Labor have substantial technical staffs of their own, but some of the smaller agencies work more directly with us.

We moved into a data center in 2015, and we partnered with the commonwealth of Massachusetts to share their disaster recovery data center.  You could call it a private cloud, but we have real-time replication between the two sources and we don’t own any of the physical buildings.  We have moved some public data into the cloud services, and we are dabbling as certain applications come up for modernization.  We can assess whether the economics make sense.

Our website is hosted by a provider; our open data platform is an outside solution.  Our sex offender registry is cloud based.  We have a workforce management solution that we are putting in place this year that will be a cloud-based capability. We are not taking a lot of the underlying infrastructure and moving it to the cloud but we are utilizing platform as a service and software as a service. 

Because we are still in the figuring-it-out phase and we are doing lots of different variants, we are spending more time doing due diligence around solutions.  Our current environments are known, and for some of us these new solutions are unknown.  There is a learning curve that we are climbing up.  We haven’t saved any money yet, but the promise is there.