Public safety cybersecurity slowly ramps up

Vulnerability management, proactive threat hunting and next-generation firewalls are the top areas of cybersecurity investment for government agencies this year, according to an IDC report.

More than 1,300 people in federal, state and local government and public safety jobs responded to the “Government Buyer Intelligence Survey: Analysis of Trends in Cybersecurity in U.S. Public Safety Agencies.” It’s designed to help tech suppliers and government technology buyers, decision-makers and policymakers maximize benefits and services through sound investment decisions.

Those investment areas track with what respondents said are core drivers of purchases. For instance, about 36% said they are vulnerable because of legacy systems and outdated hardware and software, about 34% said leaders have made security a top priority and about 33% cited constituent concerns about security and privacy.

“Leaders don’t want to get called out on [vulnerability], and the fact that there’s huge constituent concerns around trust and service delivery, those are really what drive the vulnerability management,” said Alison Brooks, research vice president at IDC and report author. 

Threat hunting lets agencies identify new attack tools and tactics by actively searching out and analyzing dangerous activity on a network. Another top cyber investment, firewalls are foundational to basic security posture. (Gartner defines next-generation firewalls as deep-packet inspection firewalls that go beyond port and protocol inspection and blocking to application-level inspection, intrusion prevention and intelligence from outside the firewall.)

When asked where their agency is implementing identity management, endpoint security, network security, cloud security and a zero trust architecture, most respondents said they’re in the researching phase for all areas. Almost 40% of respondents said they were in full production with identity management, but the next closest area was network security at 20%. The amount of respondents who said they were in production but not enterprisewide or were implementing was at or well below about 20% across all areas.

“The most interesting finding was … the amount of technical debt that is hampering investments, particularly in cybersecurity but then also in data management and analytics,” Brooks said. “Basically, technical debt is when you’re using previous generations’ investments to limp along and do things that they’re no longer supposed to be delivering on.”

What’s more, technical debt hinders agencies’ ability to work across platforms and solutions. For public safety, that means it can get in the way of deriving situational awareness because much of the core operational technology – computer-aided dispatch and records management systems – is 15 to 20 years old, Brooks said. That complicates the use of modern technologies such as artificial intelligence and drones for, say, surveillance. 

About 40% of respondents said that less than 10% of their total operational budget is dedicated to reducing technical debt, and almost 60% said technical debt has a medium impact on their agency, increasing its risk profile and limiting abilities. In the public safety sector, technical debt is causing sizeable financial and personnel time losses, the report stated.

The report also found that more than half – 51% – of respondents said they develop cybersecurity capabilities in-house, while about 27% use third-party software developers and 15% use third-party services providers. At the same time, respondents said that the biggest factor inhibiting successful implementation of cybersecurity investments is a mismatch between what vendors promise and actual capabilities. Weak vendor partnerships and products with inadequate features and functions also topped the list.

“I think it’s a classic tension that exists out there” between vendors and agencies, Brooks said. “Public safety, in particular, is the vertical/sub-vertical that is the most likely to say that the vendor community writ large, not just in cybersecurity, does not understand the business of public safety.” 

One example is vendors who make touchscreens that are incompatible with firefighters’ gloves, she explained.

Another notable finding is the larger number of non-IT personnel getting involved in cybersecurity purchases. Specifically, the report found that about 56% of stakeholders in the process are still tech staff, but almost half are from legal departments and 40% are non-IT senior leaders.

“IT is only one piece of the security puzzle,” Brooks said. “There’s a growing understanding that you need to be able to train and enlighten the workforce…. Cybersecurity is a layer that has to be embedded into every single piece of technology. It’s got a pervasive, almost granular-like element to it, and I think that’s something agencies are starting to understand a little bit more now. I think the reason for that is we have so much technology at our fingertips in our phones and there’s a consumerization of IT -- just broadly speaking -- that is raising all boats to understand perils of cybersecurity.”

Stephanie Kanowitz is a freelance reporter based in northern Virginia.