How volunteers help states shore up cybersecurity

Three states are tapping volunteer information security workers to help strengthen local communities’ cybersecurity posture.      

Volunteer units in Michigan, Wisconsin and Ohio have refined the volunteer model, bringing in  trained civilian technology experts to conduct cybersecurity assessments and incident response on government systems and networks, according to a new report from the National Governors Association (NGA).

Michigan Cyber Civilian Corps

Launched in 2013, the Michigan Cyber Civilian Corps (MiC3) began as a public-private partnership between the Michigan Department of Technology, Management and Budget (DTMB), the state’s Department of Health and Human Services’ Volunteer Registry and Merit Network Inc.

The Merit Network initially recruited 50 experts through word-of-mouth and oversaw a volunteer force whose goal was to provide low-cost support to resource-strapped government, education or business organizations during critical cyber incidents. Members were broken into 10 five-person teams and were first assigned to a geographic region in the state, but as oversight moved to DTMB and virtual access became ubiquitous, the program’s focus shifted to a more general response.

The key strength of the MiC3 is its flexibility, NGA said, as it does not require elected officials to declare “a formal state of emergency to initiate their deployment.” To activate MiC3, “client” organizations contact state police and text a central dispatcher operated by the Michigan Cyber Command Center. They are then directed to the proper channel based on descriptions of the event. This procedure also enables a conversation between the police, MiC3 and MC3 about whether a criminal investigation is necessary.

Despite its successes, the group struggles with attrition, with membership at 61. Currently, MIC3 is exploring ways to lower barriers to entry without compromising quality.

Wisconsin Cyber Response Team 

Following in its neighboring state’s footsteps, Wisconsin created its own Cyber Response Team volunteer program in 2014. CRT also began with a regional structure but eventually transitioned to a more hybrid model that calls volunteers “based on their proximity to the incident, if it requires on-site activity,” NGA said.

Unlike MiC3, Wisconsin’s CRT only provides its services to non-governmental organizations, such as government offices, schools and public libraries. The only private-sector clients accepted are critical infrastructure organizations. 

CRT is also much more proactive than MiC3 in its approach to cyber preparedness and recruitment. Pre-incident cybersecurity services often include “disseminating threat intelligence among stakeholders and partners and conducting initial risk assessments so recipients [of CRT services] can better understand their posture,” the report said. In addition to word-of-mouth recruitment, CRT also invites entities to participate after they request assistance – it's how the program has quickly grown to 216 volunteers.

The CRT mobilizes in many ways. Requests go through the Wisconsin Emergency Management duty officer system, and in conjunction with the cyber response management group, the customer’s technical needs are assessed and a plan of action is formed. Response teams also include a member who hasn’t yet participated in a response mission, to provide hands-on experience and skills development.

CRT has developed crucial relationships with cybersecurity insurance providers. Victims that have insurance are often told to contact their insurance provider first, leading to delays and added damage. In Wisconsin, victims simultaneously notify the insurance carrier and CRT, which can begin incident response while the insurance company’s digital forensics team is on route.

Ohio Cyber Reserve 

Compared to Michigan and Wisconsin, Ohio’s program is much newer. Created in 2019, the Ohio Cyber Reserve is housed under the state’s National Guard to reduce overhead costs and kindle more trust in the new program. Ohio sticks to a regional model, with enough in the budget to support “at least two ten-person teams per region” but hopes to increase that number to 20 individuals per team, the report said.

OhCR was formed to reduce cyber vulnerabilities in municipalities, small utilities and emergency service providers, elections bodies and qualifying nonprofit organizations, according to the report.

Since OhCR works under the National Guard, membership is competitive. Mobilization of the group requires the governor’s activation; as a result, the volunteers have only conducted two missions as of the report’s publication. The regional model has also presented challenges with recruitment in less populous areas.

NGA’s analysis of the Michigan, Wisconsin and Ohio programs shows a common framework for establishing a statewide volunteer cybersecurity team. 

NGA recommends states conduct an initial assessment of their cyber posture to identify gaps in capability, inventorying tools, equipment and gaining an understanding of government employees’ knowledge of cybersecurity best practices.

By housing the volunteer cybersecurity team under a governing agency that is already involved with cyber response, states can reduce overhead and provide flexibility. Understanding where the group fits in the chain of command and information-sharing procedures is critical, as are tabletop exercises and common incident principles and terminology, NGA advises. 

In addition, forming partnerships, establishing a task force composed of public, private, nonprofit and academic stakeholders will help to include perspectives from both critical infrastructure sectors and the potential volunteers’ industries. States should reach out to underrepresented communities to diversify the volunteer pool and include college students who are highly motivated to earn credit or certifications that will help their entrance to the workforce, the report states. 

Documentation of standard operating procedures as well as policies and regulations associated with participating groups will help ensure consistent response and service. Finally, to help identify workforce and security trends and evaluate impact, NGA recommends collecting both qualitative and quantitative data.

“Michigan’s MiC3, Wisconsin’s CRT and Ohio’s Cyber Reserve have found unique ways to leverage the skills and knowledge of cybersecurity practitioners to improve outcomes across SLTT organizations, the cybersecurity workforce and the general public,” the report said. “Their experiences can provide ‘lessons learned,’ as well as a benchmark for similar programs that are being planned or launched across the country.”