Resilience over resources: Closing the cybersecurity gap in state and local government

When nation-state attacks hit federal agencies, the headlines often dominate the news cycle. But state and local governments face similar threats, often without the resources and staffing to mount an effective defense. 

The good news? There are practical steps they can take to improve security without requiring significant new investments.

While federal agencies benefit from dedicated cybersecurity teams and robust funding, state and local governments typically operate under tight budgets, but face the same scrutiny. This disparity has made them a favored target for ransomware operators who disrupt city infrastructure, public schools and local services.

Many smaller jurisdictions don’t have dedicated cybersecurity teams. IT staff often wear multiple hats, handling network maintenance, user support and cybersecurity as one of many responsibilities. Some rely on part-time contractors or shared services, which creates gaps in coverage and institutional knowledge.

Cybersecurity funding in state and local government is often just a fraction of the IT budget. Every dollar must be justified to decision-makers who may lack technical expertise, making it difficult to secure funding for incremental improvements. Layers of bureaucracy in the procurement process further slow the adoption of critical tools.

Even when funding aligns, deploying new cybersecurity solutions can overwhelm stretched-thin teams. Disruptions from new appliances or software agents, along with the need for staff training, often delay or stall projects that could strengthen security.

The Rise of Ransomware

These challenges have made state and local governments an ideal target for ransomware gangs. Attackers know that these organizations:

• Manage sensitive citizen data, making them attractive for extortion.
• Operate critical infrastructure, where downtime can create public safety risks.
• Often lack the resources to recover quickly from an attack, increasing the likelihood of paying a ransom.

Public school districts, for instance, have seen an alarming rise in attacks. A successful breach can disrupt classes, compromise student data, and cost millions of dollars in recovery efforts. Similarly, municipal governments have faced attacks that cripple traffic systems, emergency services, and public utilities.

Given these constraints, state and local government teams must maximize the value of their existing tools and infrastructure. Investing in advanced solutions isn’t off the table, but the key is to focus on integrations that enhance what’s already in place. Here’s how:

Leverage Existing Tools

Many government organizations already have foundational cybersecurity tools like firewalls, intrusion detection systems, and endpoint protection. The challenge is ensuring these tools are properly configured and utilized to their fullest potential. Regular audits can identify misconfigurations or gaps in coverage that leave systems vulnerable to ransomware attacks.

Integrate New Technology

When introducing new security technology, simplicity is critical. Tools that integrate seamlessly with existing infrastructure — without requiring new software agents or disruptive changes — are more likely to be adopted successfully. For example, network monitoring tools that leverage existing telemetry data can provide advanced threat detection without adding operational complexity.

Automate Wherever Possible

Automation can alleviate the burden on understaffed teams by streamlining routine security tasks. Automated patch management, for instance, ensures that systems are kept up to date with minimal manual intervention. 

Similarly, automation can be applied to threat detection and response, enabling teams to act quickly on potential threats without constant monitoring.

Prioritize Ransomware Protection

Ransomware remains one of the most significant threats to state and local governments. Organizations should prioritize controls that mitigate ransomware risk, such as immutable backups, endpoint detection and response, and user training to prevent phishing attacks. 

Even basic measures, like enforcing multi-factor authentication for all accounts, can significantly reduce the likelihood of a successful attack.

Building Resilience

While cybersecurity threats are inevitable, resilience is achievable. State and local governments can take several steps to prepare for and recover from attacks:

1. Develop an incident response plan: A clear, actionable plan ensures that everyone knows their role in the event of a breach. Regularly testing the plan through tabletop exercises can identify weaknesses and improve coordination.
2. Enhance cyber hygiene: Routine maintenance, such as updating software, managing user privileges, and enforcing password policies, reduces the attack surface and makes it harder for adversaries to gain a foothold.
3. Collaborate across agencies: State and local governments can benefit from sharing resources and expertise. Regional partnerships and federal programs, such as the Cybersecurity and Infrastructure Security Agency (CISA), provide valuable support and threat intelligence.
4. Invest in training: Even the best tools are ineffective without knowledgeable users. Regular training programs help staff recognize phishing attempts, understand security policies, and respond appropriately to incidents.

State and local governments will never benefit from the same resources as federal agencies — but they can improve security posture with a more resourceful approach. By leveraging existing tools more effectively, seamlessly integrating new technologies, and fostering a culture of resilience, they can close critical gaps in their defenses. 

While attackers will always seek out vulnerabilities, proactive strategies can shift the balance, making smaller governments less attractive targets and better prepared to respond when threats arise.

Sameer Malhotra is the CEO and co-founder of TrueFort. Sameer has spent more than 20 years in senior IT executive roles in the world’s top financial institutions, including JPMorgan Chase, Bank of America Merrill Lynch and Goldman Sachs. Sameer is widely recognized for his extensive and in-depth knowledge of infrastructure and security, and owns multiple patents in the field.