How one state bakes cyber into disaster response planning
GettyImages/Cecilie_Arcurs
California uses playbooks and multi-stakeholder exercises to prepare for cyberattacks, focusing on making its response “agile.”
By treating cyberattacks like any other disaster – engaging in intensive preparation and shaping multi-stakeholder responses – California is as prepared for them as the state might be for wildfires, earthquakes or anything else, a leading cybersecurity official said.
Lt. Col. Ty Shepard, Joint Task Force Cyber Commander at the California Military Department, said during a GCN webinar that cyber response is baked into the state’s disaster response plans and funding, which makes military and civilian agencies available alongside law enforcement to assist.
Civilian partners on statewide cybersecurity include the California Department of Technology and the California Office of Emergency Services, while the California Highway Patrol is a law enforcement partner, and federal agencies are called in when necessary. From the state government down to localities, Shepard said everyone knows what to expect in cybersecurity response.
“Just like all hazards, whether it's fires or floods, we have a whole playbook already scripted,” he said. “The counties and the cities, and then the state knows what that playbook is for cyber, so the jurisdiction and the laws and the processes are all codified, so we're not guessing on how this is going to work or how it goes.”
Like other states, California continues to wrestle with the impacts of cybercrime. Shepard said in 2020, cyberattacks cost the state $755 million in damages, but that number ballooned by 85% in 2021 to $1.4 billion. Health care and higher education institutions have been among those targeted by hackers, while state agencies including the California Department of Corrections and Rehabilitation have also been impacted.
Attacks on the state’s health care sector prompted Attorney General Rob Bonta to issue a bulletin last year to facilities and providers urging them to comply with the state’s health data privacy laws and report data breaches in light of a slew of attacks.
Ensuring state and local government agencies and institutions are prepared for cyberattacks also involves a number of intensive practice exercises like Cyber Dawn, an event hosted alongside the California National Guard that pits cybersecurity teams against each other in live exercises and simulations to test their ability to respond.
Shepard said the event, which has been conducted for four years, attracts attendees from across the state and the federal government, as well as international representatives from as far afield as Ukraine and India – all looking to learn best practices in cyber response and prepare for the real thing. Arizona, Hawaii, Louisiana and Nevada have put together similar training programs, while Shepard said the National Guard and White House are also keen to learn more.
“It's just like a sports event, where you hear the red team cheering when they drop a beacon or they get an exploit, and you'll see the blue team get really excited when they see the enemy or they shut something down,” Shepard said. “It's back and forth. And then at the end of the exercise when everything clears, the red team and the blue team, they sit together, and they really walk through it.”
When institutions are attacked, either at the state or local level, Shepard said plans are in place for the response to spring into action. If a local jurisdiction is attacked, the onus is on officials there to respond first, Shepard said, then call in reinforcements from state authorities. The state could then deploy assistance remotely or send in an in-person incident response team.
Shepard said an incident response team typically comprises people who look to immediately mitigate the threat, as well as experts who can shut down systems and prevent any further breaches. The California Military Department works closely with law enforcement agencies to turn over any evidence of criminal activity behind the hack. It also has the ability to escalate the response to federal agencies like the FBI, National Security Agency or U.S. Cyber Command, depending on each response’s needs.
A response team can deploy in as little as four hours, Shepard said, meaning it is very “agile” in digital warfare, an area of conflict he said will only become more important in the future.
“When I joined the military, I wanted to go chase bad guys around the world. I thought that was a cool thing: jumping out of planes and hunting down people,” Shepard said. “And that was the tip of the spear. But you know, 20 years later now in my career, the tip of the spear is cyber.”