How local governments can protect themselves against third-party threats

The results are in, and the message is clear: Cybersecurity is the biggest problem facing local governments in the U.S. In December, the National Association of State Chief Information Officers’ (NASCIO) annual list of top 10 technology priorities for state CIOs again ranked cybersecurity first. However, as governments rush to shore up their internal networks, the risks are expanding.  

One of the biggest threats to state and local governments comes not from direct attacks on their own systems, but via third parties. Attackers can compromise the companies that sell software, hardware and computing services to government. Those compromised third-party products and services then act as conduits into state and local government networks.  

Third-party attacks, also known as supply-chain attacks, are becoming more prevalent. For example, a 2021 hack at software at file transfer service Accellion compromised citizen data in Washington state as part of a global incident.  

Hitting the mother lode  

Attacks delivered via third-party systems are often opportunistic. Cyber criminals attacking a service or product are not always sure who their downstream victims will be, but hitting any of the 90,000 local governments in the U.S. could enable them to harvest sensitive data on those governments' citizens.  

The Biden administration’s cybersecurity executive order requires federal agencies to scrutinize third-party risk, but it has no such power at the state or local level. Local governments are not mandated to prioritize cybersecurity, either internally or upstream, and often lack the resources to do so. A 2022 joint local government cybersecurity survey by Deloitte and NASCIO cited inadequate staffing as one of the biggest problems facing local government cybersecurity.  

Local governments that are not shoring up their own defenses are even less likely to audit their suppliers. Only one in five of them had a high level of confidence in their third-party contractors, according to the survey.  

HEAT attacks: A new third-party risk  

Now, a new category of attacks is exacerbating third-party risk. Highly evasive adaptive threat (HEAT) attacks use web browsers to dodge firewalls and secure web gateways and deploy techniques like HTML allowing them to evade traffic inspection.  

A frequent method for initiating a HEAT attack involves exploiting software-as-a-service (SaaS) platforms, which are accessed by local government employees through their web browsers. If attackers manage to breach a service provider, they can use the browser as a vulnerable entry point to deliver malware directly to the user's device. 

What can local governments do to protect themselves as the volume and sophistication of cyberattacks rise? Simply tweaking firewall rules won't protect them against attacks like these, and a compromised SaaS provider won't show up on a list of malicious domains.  

Instead, a multilayered defense strategy is key. Existing cybersecurity measures are still useful for stopping many kinds of attacks, but as malicious techniques evolve, municipalities must integrate another layer of protection atop their existing security stack. This layer should be preventative in nature, rather than reactive, to stop new waves of sophisticated attacks before they can make it to the network.  

A core principle in this new layer of HEAT-resistant protection is adaptability. HEAT attackers are adapting quickly, using dynamically generated malware and innovative new delivery techniques that fly under the radar. New solutions must protect against unknown threats. It is not acceptable just to look for threats in the rear-view mirror.  

These solutions must also stretch beyond email or web browsers to touch all traffic. Local government cybersecurity professionals must protect users from threats that arrive via any channel, from SMS to social media apps and SaaS platforms.  

Finally, these solutions cannot get in the way of user productivity. Multiple generations of modern computer users have repeatedly proved that sacrificing usability for security doesn't work. Cybersecurity solutions must protect users without hindering their work. Otherwise, users will simply work around them. That means no blocking access to online resources, no disabling browser functions, and no new software to learn. 

Taking a holistic approach  

Applying preventative layers should form just one part of a local government's approach to cybersecurity. Another is to take advantage of the funding. The federal government has committed $1 billion to its State and Local Cybersecurity Grant Program over the next four years, giving state administrative agencies the funding to help local governments tackle cybersecurity issues including third-party risk.

Working together and exchanging knowledge are perennial protections against cyberthreats, but the right tooling is also crucial. Adaptive, forward-looking protections are a critical part of securing a local government ecosystem under constant and rising threats. 

Andi Welch is a senior cybersecurity strategist for the public sector at Menlo Security.