As states lag on cyber training, agencies are fertile phishing grounds

This article originally appeared in Stateline, an initiative of the Pew Charitable Trusts.

Answering a seemingly routine HR email, the Utah workers typed in their credentials as requested.

And then they had a paycheck stolen.

Cybercriminals had tricked the state workers into opening fake links. The scammers used the information to access the state payroll system and change employees’ direct deposit information, diverting their paychecks into phony bank accounts.

Only three workers fell victim to the June scam, thanks in part to Utah’s mandatory cyber awareness training, said Chief Information Officer Michael Hussey.

But that training is not standard practice in all states.

Unlike lots of companies, many states don’t require training for every staffer, although nearly every state offers it, according to the National Conference of State Legislatures (NCSL).

Some states are wary of placing yet another demand on employees’ time, and state agencies may balk at having IT workers dictate requirements to them.

In other places, mandatory cyber training just isn’t a top priority.

“This is very frustrating for those who are on the front line of fighting the cybersecurity fight every day,” said Meredith Ward, a senior policy analyst at the National Association of State Chief Information Officers (NASCIO). “It’s not flashy. It’s not sexy. But cybersecurity awareness training is necessary.”

A 2018 survey by NASCIO and consulting firm Deloitte & Touche LLP found that only 45 percent of states require that all executive branch employees complete cyber training, Ward said. That’s up from 37 percent in 2016.

The officials named phishing and ransomware as two of the top cyber threats facing states.

The Utah staffers fell victim to phishing, or unwittingly clicking on emailed links designed to get personal information, such as passwords.

Ransomware hijacks government computer systems and holds them hostage until their victims pay a ransom or restore the system on their own.

In Colorado, for example, when hackers in 2018 targeted the state Department of Transportation with ransomware, they disrupted the agency’s operations for weeks. State officials had to shut down 2,000 computers and employees were forced to use pen and paper or personal devices instead of their work computers.

Training won’t stop every data breach, but it teaches staffers how to detect irregularities and report them.

“Everyone should have mandatory cybersecurity training,” said Srini Subramanian, a state cybersecurity principal at Deloitte. “It is absolutely important. It is fundamental.”

State rules differ

In every state, certain employees, such as those handling health care, criminal justice and tax records, must take cybersecurity training because of federal requirements. Beyond that, it’s a hodgepodge.

Michigan, Oklahoma and Wyoming are among the states that encourage training without requiring it. Other states don’t have formal programs but offer online tools and tips, according to NCSL.

In some states, such as Idaho, training is mandatory for all state executive branch employees, under a governor’s executive order. In others, it is required by legislation.

In Illinois, for example, cyber training had been voluntary until the legislature in 2017 voted to make it mandatory.

In some states, such as Indiana, CIOs or chief information security officers have the authority to require mandatory training. That can be easier if the CIO has control over all executive branch agency IT departments, officials say.

That’s what happened in Utah, where the chief IT officer requires every employee to take online cyber training annually. “From a cybersecurity perspective, it’s paramount,” Hussey said.

Utah also sends out phony phishing emails to employees every so often to see how many click on them. Officials use that information to improve the training curriculum.

'Bureaucratic tensions'

Getting buy-in for training isn’t always easy.

“There’s often a resistance by state agencies to be told to do something by another agency, especially when they’re required to show they’ve complied with it,” said David Forscey, a senior policy analyst at the National Governors Association. “There are bureaucratic tensions.”

States also worry about burdening employees, many of whom aren’t thrilled with adding another time-consuming task, Forscey said.

That’s one of the main reasons cyber training is voluntary in Connecticut, said Mark Raymond, the state’s CIO.

“The desire to make one more thing mandatory has a really high bar,” Raymond said. “We’ve got ethics training. We’ve got sexual harassment awareness training. There are a bunch of things employees have to do.”

Employee unions also would have to give the OK for cyber training to become mandatory in his state, Raymond said. “That’s one of the things that may make it more difficult. We would have to work it through the unions.”

Connecticut has shifted from a once-a-year voluntary online training session, which took 40 minutes to two hours, to a program offered once every two months. It uses shorter, easier exercises and is more popular among staffers, Raymond said.

The state pays a vendor about $63,000 for 12 months of training for up to 30,000 trainees. Last year, 57 percent of employees completed the training.

“I think eventually it will become mandatory,” Raymond said. “It just takes much longer to create a mandatory program and monitor it than it does for a voluntary one.”

Whether voluntary or mandatory, states should ensure that cyber training is not “a once-a-year, check-the-box thing,” said Dan Lohrmann, chief security officer for Security Mentor, a national security training firm that works with states. “The quality of the training is important, and it should be done year-round.”

Lohrmann, formerly Michigan’s chief information security officer, said it is “very concerning” that every state doesn’t have some basic level of mandatory cyber training for all employees.

“The threats are coming at government employees every day, all the time,” he said. “It’s relentless. Security teams are doing all they can do, but threats get through.”

Making it fun

Deloitte’s Subramanian says moving to shorter, more frequent snippets of real-life examples is the most effective way to train state workers. “Make it interesting to people,” he said. “Make them learn something. And make it fun.”

Alabama is trying to do that: State workers there can play a daily game in which they answer a few trivia questions, mostly about cybersecurity. At the week’s end, if they’ve gotten all of them right, they get virtual coins. If they collect enough, they can redeem them for small prizes, such as Starbucks gift cards or earbuds. There’s a limit of $25 a prize and $50 a year.

Ryan Allen, Alabama’s chief information security officer, said more than a thousand staffers play every week.

While the game is optional, every executive branch employee with access to the state computer network is required to take cyber training consisting of 25 or more short videos and a quiz at least once a year. Many agencies choose to divide up the curriculum and offer it quarterly.

“If you are a road worker and you have to lay asphalt and you don’t have a computer, I’m not going to make you take it,” Allen said. “But we have very few exceptions.”

The training software, which costs $126,000 for 23,000 employees, is well worth the investment, Allen said.

“If 90 percent of ransomware comes in through email, raising awareness about cyber issues across the state is one of the things that will pay the biggest dividend,” he said. “The weakest link in the chain is the one that’s going to get you in trouble.”